title: Testing WS Security using soapUI - using security header in message payload
body: <p>I am new to webservice and WS Security.  I have a sample webservice using CFX interceptor. Following is the config file I have.</p>
  
  <p>Cfx-servelet.xml:</p>
  
  <pre><code> &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:jaxws="http://cxf.apache.org/jaxws"
          xsi:schemaLocation="
               http://www.springframework.org/schema/beans 
               http://www.springframework.org/schema/beans/spring-beans.xsd
               http://cxf.apache.org/jaxws
               http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  
          &lt;jaxws:endpoint 
             id="doubleit"
             implementor="service.DoubleItPortTypeImpl"
            address="/doubleit" &gt;
  
            &lt;!-- Uncomment only if using WS-SecurityPolicy
            &lt;jaxws:properties&gt;
               &lt;entry key="ws-security.callback-handler" value-ref="myPasswordCallback"/&gt;
            &lt;/jaxws:properties&gt;
            --&gt;
  
            &lt;!-- Uncomment only if using standard WSS4J interceptors --&gt;
            &lt;jaxws:inInterceptors&gt;
               &lt;bean
                      class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                  &lt;constructor-arg&gt;
                     &lt;map&gt;
                        &lt;entry key="action" value="UsernameToken"/&gt;
                        &lt;entry key="passwordType" value="PasswordText"/&gt;
                        &lt;entry key="passwordCallbackRef" value-ref="myPasswordCallback"/&gt;
                     &lt;/map&gt;
                 &lt;/constructor-arg&gt;
               &lt;/bean&gt;
            &lt;/jaxws:inInterceptors&gt;
         &lt;/jaxws:endpoint&gt;
  
        &lt;bean id="myPasswordCallback" class="service.ServerPasswordCallback" /&gt;
      &lt;/beans&gt;
  </code></pre>
  
  <p>When I generated security attribute in the HTTP headers (not in the message payload) using soapUI tool, it worked.  But I need to pass the wsse:security attribute in message payload (something like below)</p>
  
  <p>soap request:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"        xmlns:doub="http://www.example.org/schema/DoubleIt"&gt;
  &lt;soapenv:Header&gt;
  &lt;soapenv:Header&gt;
  &lt;wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-   open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
  &lt;wsse:UsernameToken wsu:Id="UsernameToken-27777511" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;wsse:Username&gt;joe&lt;/wsse:Username&gt;
  &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;joespassword&lt;/wsse:Password&gt;
  &lt;/wsse:UsernameToken&gt;
  &lt;/wsse:Security&gt;
  &lt;/soapenv:Header&gt;
  
     &lt;soapenv:Body&gt;
        &lt;doub:DoubleIt&gt;
           &lt;numberToDouble&gt;10&lt;/numberToDouble&gt;
        &lt;/doub:DoubleIt&gt;
     &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>It is giving fault message back:</p>
  
  <p>Soap Response:</p>
  
  <pre><code>&lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"&gt;
     &lt;soap:Body&gt;
        &lt;soap:Fault&gt;
           &lt;faultcode&gt;soap:Server&lt;/faultcode&gt;
           &lt;faultstring&gt;Fault occurred while processing.&lt;/faultstring&gt;
        &lt;/soap:Fault&gt;
     &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>
  
  <p>Log file has the following exception:</p>
  
  <pre><code>2014-03-07 15:44:20,438 [http-8080-1] WARN  org.apache.cxf.phase.PhaseInterceptorChain    - Interceptor for {http://www.example.org/contract/DoubleIt}DoubleItService has thrown exception, unwinding now
      java.lang.NullPointerException
          at org.apache.cxf.staxutils.StaxUtils.getDocument(StaxUtils.java:944)
          at org.apache.cxf.staxutils.StaxUtils.readDocElements(StaxUtils.java:981)
          at     org.apache.cxf.binding.soap.saaj.SAAJInInterceptor.handleMessage(SAAJInInterceptor.java:223)
          at     org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getSOAPMessage(WSS4JInInterceptor.java:     154)
          at   org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:203)
          at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:89)
          at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
          at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
          at   org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:207)
          at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:209)
          at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:191)
          at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:114)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:185)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:108)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:164)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at com.connecture.stateadvantage.ui.healthplanmanagement.PublicResourceFilter.doFilter(PublicResourceFilter.java:120)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at com.connecture.services.planservice.ui.PublicResourceFilter.doFilter(PublicResourceFilter.java:108)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at com.connecture.services.applicationservice.ui.PublicResourceFilter.doFilter(PublicResourceFilter.java:107)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:369)
          at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
          at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
          at com.connecture.securityservice.ui.SecAnonymousAuthenticationFilter.doFilter(SecAnonymousAuthenticationFilter.java:51)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
          at com.connecture.securityservice.ui.SecureLoginCookieFilter.doFilter(SecureLoginCookieFilter.java:122)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
          at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
          at com.connecture.stateadvantage.ui.common.TimerFilter.doFilter(TimerFilter.java:37)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
          at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:168)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
          at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:879)
          at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:600)
          at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1703)
          at java.lang.Thread.run(Unknown Source)
  </code></pre>
  
  <p>Can any one tell me whether I am doing something wrong with the header?  Any help would be appreciated.</p>
  
  <p>Thanks</p>