title: How to implement WS-SecurityPolicy on the endpoint (server) with JAX-WS Metro?
body: <p>I have the following policy in my WSDL file:</p>
  
  <pre><code>&lt;wsp:Policy wsu:Id="UsernameToken" 
     xmlns:wsp="http://www.w3.org/ns/ws-policy" 
     xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" 
     xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
     &gt;
     &lt;wsap:UsingAddressing xmlns:wsap="http://www.w3.org/2006/05/addressing/wsdl"/&gt;
     &lt;sp:SymmetricBinding&gt;
         &lt;wsp:Policy&gt;
             &lt;sp:ProtectionToken&gt;
                 &lt;wsp:Policy&gt;
                     &lt;sp:SecureConversationToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient" /&gt;
                 &lt;/wsp:Policy&gt;
             &lt;/sp:ProtectionToken&gt;
         &lt;/wsp:Policy&gt;
     &lt;/sp:SymmetricBinding&gt;
  &lt;/wsp:Policy&gt;
  </code></pre>
  
  <p>and I have included it in the binding:</p>
  
  <pre><code>    &lt;wsp:PolicyReference xmlns:wsp="http://www.w3.org/ns/ws-policy" URI="#UsernameToken"/&gt;
  </code></pre>
  
  <p>It seem like it passes through the WSDL, except for when in my handler I do:</p>
  
  <pre><code>        List&lt;?&gt; securityList = soapEnvelope.getSecurity(null, true);
  
          if ((securityList == null) || (securityList.size() == 0))
          {
              securityList = soapEnvelope.getSecurity();
          }
  </code></pre>
  
  <p>it returns <strong>null</strong>. soapEnvelop here is: <strong>WSSOAPEnvelope</strong> soapEnvelope, and it's not null;</p>
  
  <p>I would appreciate your help a lot! Have been struggling with this for a while now.</p>
  
  <p>I have a feeling that the security header is being cropped from the envelop.</p>
  
  <p>Also if I remove policy definition from WSDL file, then it passes without <code>soap:mustUnderstand="1"</code>, if I do include this attribute then it gives me error message:</p>
  
  <pre><code>MustUnderstand headers:[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood
  </code></pre>