title: Error while executing soap request on ws security with cxf interceptor
body: <p>I have developed a service in top down approach and it is working fine using apache cxf. Now I am trying to add basic authentication to the service. I have configured the server call back handler and spring bean (cxf-servlet.xml) as per the apache cxf documentation. But still
  I am getting below error executing a soap request on SOAP UI.</p>
  
  <pre><code>&lt;soapenv:Header&gt;
  &lt;wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;wsu:Timestamp wsu:Id="TS-14"&gt;&lt;wsu:Created&gt;2017-01-20T13:54:07Z&lt;/wsu:Created&gt;&lt;wsu:Expires&gt;2017-01-20T14:27:27Z&lt;/wsu:Expires&gt;&lt;/wsu:Timestamp&gt;
  &lt;wsse:UsernameToken wsu:Id="UsernameToken-13"&gt;
  &lt;wsse:Username&gt;username&lt;/wsse:Username&gt;
  &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;password&lt;/wsse:Password&gt;
  &lt;wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;vPFjyEznvPB8HkWDOoL7dw==&lt;/wsse:Nonce&gt;
  &lt;wsu:Created&gt;2017-01-20T13:54:07.244Z&lt;/wsu:Created&gt;
  &lt;/wsse:UsernameToken&gt;
  &lt;/wsse:Security&gt;
  &lt;/soapenv:Header&gt;
  </code></pre>
  
  <p>Below is the my servercallback handler part.</p>
  
  <pre><code>&lt;bean id="myPasswordCallback"
          class="com.firstbest.webservice.ofacimpl.ServerPasswordCallback" /&gt;
      &lt;jaxws:endpoint publish="true" id="ofacid"
          implementor="com.firstbest.webservice.ofacimpl.OfacInquirySearchImpl"
          address="/PerformOFACValidationWS"&gt;
          &lt;jaxws:inInterceptors&gt;
              &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                  &lt;constructor-arg&gt;
                      &lt;map&gt;
                          &lt;entry key="action" value="UsernameToken" /&gt;
                          &lt;entry key="passwordType" value="PasswordText" /&gt;
                          &lt;entry key="passwordCallbackRef"&gt;
                              &lt;ref bean="myPasswordCallback" /&gt;
                          &lt;/entry&gt;
                      &lt;/map&gt;
                  &lt;/constructor-arg&gt;
              &lt;/bean&gt;
          &lt;/jaxws:inInterceptors&gt;
      &lt;/jaxws:endpoint&gt;
  </code></pre>
  
  <p>I have tried different solution regarding this on net. But couldn't help me much.</p>
  
  <p>Below is the error:-</p>
  
  <blockquote>
    <p>WARNING: Interceptor for
    {<a href="http://sdawweaid1.gc.win-na.com/QBE_OFAC/Producer/BridgerInsight/WS/executeIService_SearchWS" rel="nofollow noreferrer">http://sdawweaid1.gc.win-na.com/QBE_OFAC/Producer/BridgerInsight/WS/executeIService_SearchWS</a>}OfacInquirySearchImplService#{<a href="http://sdawweaid1.gc.win-na.com/QBE_OFAC/Producer/BridgerInsight/WS/executeIService_SearchWS" rel="nofollow noreferrer">http://sdawweaid1.gc.win-na.com/QBE_OFAC/Producer/BridgerInsight/WS/executeIService_SearchWS</a>}executeIService_Search
    has thrown exception, unwinding now
    org.apache.cxf.binding.soap.SoapFault: A security error was
    encountered when verifying the message    at
    org.apache.cxf.ws.security.wss4j.WSS4JUtils.createSoapFault(WSS4JUtils.java:233)
      at
    org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:317)
      at
    org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:171)
      at
    org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:80)
      at
    org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
      at
    org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
      at
    org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:252)
      at
    org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)
      at
    org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)
      at
    org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)
      at
    org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:180)
      at
    org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:299)
      at
    org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:218)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)     at
    org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:274)
      at
    org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
      at
    org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:401)
      at
    org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
      at
    org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
      at
    org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:766)
      at
    org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:450)
      at
    org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:230)
      at
    org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
      at
    org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
      at org.mortbay.jetty.Server.handle(Server.java:326)     at
    org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
      at
    org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:945)
      at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756)  at
    org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)  at
    org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)  at
    org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:410)
      at
    org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)
    Caused by: org.apache.wss4j.common.ext.WSSecurityException: An error
    was discovered processing the  header  at
    org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.checkActions(WSS4JInInterceptor.java:361)
      at
    org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInIntercept</p>
  </blockquote>