title: Configuring WSS4J with CXF
body: <p>I was doing pretty well with setting up a contract first set of web services using CXF until I started adding in the WSS4J piece. </p>
  
  <p>I'm trying to debug sending a password and login in the soap header. I am getting null when I call getPassword() in the WSPasswordCallback class.  I can see from the soap envelope that a password was sent.   </p>
  
  <p>This post, <a href="http://old.nabble.com/PasswordDigest-and-PasswordText-difference-td24475866.html" rel="nofollow">http://old.nabble.com/PasswordDigest-and-PasswordText-difference-td24475866.html</a>, from 2009, made me wonder if I am missing (need to create) a UsernameTokenHandler.   </p>
  
  <p>And if that is true, can someone point me to how I would configure it in the spring/cxf bean xml file? </p>
  
  <p>Any advice or suggestions would be appreciated. </p>
  
  <p>Here's the Java file in question:</p>
  
  <pre><code>package com.netcentric.security.handlers;
  
  import java.io.IOException;
  import javax.annotation.Resource;
  import javax.com.urity.auth.callback.Callback;
  import javax.com.urity.auth.callback.CallbackHandler;
  import javax.com.urity.auth.callback.UnsupportedCallbackException;
  import org.apache.ws.com.urity.WSPasswordCallback;
  
  public class ServicePWCallback implements CallbackHandler
  {
     @Override
     public void handle(Callback[] callbacks) throws IOException, 
                  UnsupportedCallbackException {
          try {
              for (int i = 0; i &amp;lt; callbacks.length; i++) {
                  if (callbacks[i] instanceof WSPasswordCallback) {
  
                      WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
  
                      sString login = pc.getIdentifier();
  
                      String password = pc.getPassword();
                      // password is null, not the expected myPASSWORD**1234
  
                      int n = pc.getUsage(); 
                      // this is 2 == WSPasswordCallback.USERNAME_TOKEN
  
                //...
  </code></pre>
  
  <p>The CXF/Spring configuration file:</p>
  
  <pre>
  
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:jee="http://www.springframework.org/schema/jee"
             xmlns:jaxws="http://cxf.apache.org/jaxws"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
      http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-2.5.xsd
      http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd
      http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd"
          default-dependency-check="none" default-lazy-init="false"&gt;
  
          &lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
          &lt;import resource="classpath:META-INF/cxf/cxf-servlet.xml" /&gt;
  
          &lt;bean id="serverPasswordCallback" class="com.netcentric.security.handlers.ServicePWCallback"/&gt;
          &lt;bean id="wss4jInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
              &lt;constructor-arg&gt;
                  &lt;map&gt;
                      &lt;entry key="action" value="UsernameToken"/&gt;
                      &lt;entry key="passwordType" value="PasswordText"/&gt;
                                      &lt;entry key="passwordCallbackRef"&gt;
                          &lt;ref bean="serverPasswordCallback"/&gt;
                      &lt;/entry&gt;
                  &lt;/map&gt;
              &lt;/constructor-arg&gt;
          &lt;/bean&gt;
  
          &lt;jaxws:endpoint id="FederationImpl"
              implementor="com.netcentric.services.federation.FederationImpl"
              endpointName="e:federation"
              serviceName="e:federation"
              address="federation"
              xmlns:e="urn:federation.services.netcentric.sec"&gt;
  
                      &lt;jaxws:inInterceptors&gt;
                              &lt;bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/&gt;
                              &lt;ref bean="wss4jInInterceptor"/&gt;
                      &lt;/jaxws:inInterceptors&gt;
          &lt;/jaxws:endpoint&gt;
      &lt;/beans
  
  </pre>
  
  <p>The soap message:</p>
  
  <pre>
  
      &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
          &lt;soapenv:Header&gt;
              &lt;wsse:comurity xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wscomurity-comext-1.0.xsd" soapenv:mustUnderstand="1"&gt;
                  &lt;wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wscomurity-utility-1.0.xsd" wsu:Id="Timestamp-16757598"&gt;
                      &lt;wsu:Created&gt;2011-09-22T18:21:23.345Z&lt;/wsu:Created&gt;
                      &lt;wsu:Expires&gt;2011-09-22T18:26:23.345Z&lt;/wsu:Expires&gt;
                  &lt;/wsu:Timestamp&gt;
                  &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wscomurity-utility-1.0.xsd" wsu:Id="UsernameToken-16649441"&gt;
                      &lt;wsse:Username&gt;pam&lt;/wsse:Username&gt;
                      &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;myPASSWORD**1234&lt;/wsse:Password&gt;
                  &lt;/wsse:UsernameToken&gt;
              &lt;/wsse:comurity&gt;
          &lt;/soapenv:Header&gt;
          &lt;soapenv:Body&gt;
              &lt;getVersion xmlns="urn:federation.services.netcentric.com"&gt;
                  &lt;getVersionRequest/&gt;
              &lt;/getVersion&gt;
          &lt;/soapenv:Body&gt;
      &lt;/soapenv:Envelope&gt;
  
  </pre>