title: Soap request signed by certificate. WS-Security
body: <p>I received the WSDL which contains the security policy, as for now, judging by the wsdl i found out that it means that i need it to sign with certificate. No token server should be used.</p>
  
  <p><strong>What i did:</strong>
  I used cxf wsdl2java to create java classes from the wsdl file. As far i saw CXF handles pretty well all the signing automatically so i added on java side STSClient with ws-security.signature.crypto and ws-security.encryption.crypto on the Client. Which basically does nothing and my Soap request contains only the body without any signing data. As a result nothing happens and no errors are printed out, which makes it really hard to solve my problem.</p>
  
  <p><strong>Question:</strong> 
  How to sign the soap request without token server without any username/password?
  Also address is http in the provided wsdl, should i override it to https?</p>
  
  <p><strong>Received wsdl Policy snippet:</strong></p>
  
  <pre><code> &lt;wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
                xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                wsu:Id="SigOnly"&gt;
      &lt;wsp:ExactlyOne&gt;
        &lt;wsp:All&gt;
          &lt;sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:InitiatorToken&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:X509Token
                          sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always"&gt;
                    &lt;wsp:Policy&gt;
                      &lt;sp:WssX509V3Token10/&gt;
                    &lt;/wsp:Policy&gt;
                  &lt;/sp:X509Token&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:InitiatorToken&gt;
              &lt;sp:RecipientToken&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:X509Token
                          sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always"&gt;
                    &lt;wsp:Policy&gt;
                      &lt;sp:WssX509V3Token10/&gt;
                    &lt;/wsp:Policy&gt;
                  &lt;/sp:X509Token&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:RecipientToken&gt;
              &lt;sp:AlgorithmSuite&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:TripleDesRsa15/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:AlgorithmSuite&gt;
              &lt;sp:Layout&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:Strict/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:Layout&gt;
              &lt;sp:IncludeTimestamp/&gt;
              &lt;sp:OnlySignEntireHeadersAndBody/&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:AsymmetricBinding&gt;
          &lt;sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:MustSupportRefKeyIdentifier/&gt;
              &lt;sp:MustSupportRefIssuerSerial/&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:Wss10&gt;
          &lt;sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
            &lt;sp:Body/&gt;
          &lt;/sp:SignedParts&gt;
        &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
    &lt;/wsp:Policy&gt;
  </code></pre>
  
  <p><strong>Received message header example:</strong></p>
  
  <pre><code>  &lt;soap:Header&gt;
      &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                     xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                     soap:mustUnderstand="1"&gt;
        &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-****"&gt;
          &lt;ds:SignedInfo&gt;
            &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
              &lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soap"/&gt;
            &lt;/ds:CanonicalizationMethod&gt;
            &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
            &lt;ds:Reference URI="#id-***"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
              &lt;ds:DigestValue&gt;value=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;
            signatureValue==
          &lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo Id="KI-***"&gt;
            &lt;wsse:SecurityTokenReference wsu:Id="STR-***"&gt;
              &lt;ds:X509Data&gt;
                &lt;ds:X509IssuerSerial&gt;
                  &lt;ds:X509IssuerName&gt;issuer name
                  &lt;/ds:X509IssuerName&gt;
                  &lt;ds:X509SerialNumber&gt;nmber&lt;/ds:X509SerialNumber&gt;
                &lt;/ds:X509IssuerSerial&gt;
              &lt;/ds:X509Data&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/ds:KeyInfo&gt;
        &lt;/ds:Signature&gt;
      &lt;/wsse:Security&gt;
    &lt;/soap:Header&gt;
  </code></pre>
  
  <p><strong>My java snippet:</strong></p>
  
  <pre><code>    Client client = ClientProxy.getClient(generatedService);
  
      Init.init();
      Properties properties = new Properties();
      properties.setProperty("org.apache.ws.security.crypto.provider", "org.apache.ws.security.components.crypto.Merlin");
      properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.type", "jks");
      properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.password", keystorePassword);
      properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.alias", signedCertificateAliasInTheKeystore);
      properties.setProperty("org.apache.ws.security.crypto.merlin.file", new ClassPathResource(keyStore).getPath());
      properties.setProperty("org.apache.ws.security.crypto.merlin.keystore.private.password", keystorePassword);
  
      Merlin crypto = null;
      try {
        crypto = (Merlin) CryptoFactory.getInstance(properties);
      }
      catch (WSSecurityException e) {
        e.printStackTrace();//temp
      }
  
      STSClient stsClient = new STSClient(((EndpointImpl) client.getEndpoint()).getBus());
      Map&lt;String, Object&gt; stsClientProperties = new HashMap&lt;&gt;();
      stsClient.setWsdlLocation(new ClassPathResource("MyWsdl.wsdl").getPath());
      stsClientProperties.put("ws-security.signature.crypto", crypto);
      stsClientProperties.put("ws-security.encryption.crypto", crypto);
      stsClient.setProperties(stsClientProperties);
  
      BindingProvider bindingProvider = (BindingProvider) generatedService;
      bindingProvider.getRequestContext().put("ws-security.sts.client", stsClient);
      generatedService.callToTheOuterWorld(data);
  
  
  </code></pre>
  
  <p><strong>Second try which is basically copy of 
  <a href="https://cwiki.apache.org/confluence/display/CXF20DOC/WS-Security" rel="nofollow noreferrer">link</a>:</strong></p>
  
  <pre><code>org.apache.cxf.endpoint.Client client = ClientProxy.getClient(generatedService);
  org.apache.cxf.endpoint.Endpoint cxfEndpoint = client.getEndpoint();
  Map&lt;String,Object&gt; outProps = new HashMap&lt;String,Object&gt;();
  outProps.put(WSHandlerConstants.USER, "keystoreAlias");
  outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS,
          ClientPasswordCallback.class.getName()); //callback has keystore password
  outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.SIGNATURE + " " + WSHandlerConstants.ENCRYPT);
  outProps.put(WSHandlerConstants.SIG_PROP_FILE, new ClassPathResource("client_sign.properties").getPath());
  WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);
  cxfEndpoint.getOutInterceptors().add(wssOut);
  generatedService.callToTheOuterWorld(data)
  </code></pre>
  
  <p>which throws : Caused by: org.apache.wss4j.common.ext.WSSecurityException: EncryptionCrypto instantiation failed
  If i remove the WSHandlerConstants.ENCRYPT i get no exception but header is still missing in the request.</p>