title: How can configure ws-security with CXF or anything missing
body: <p>I'm trying to create a web service with WS-Security so far I have configured the following:</p>
  
  <p><strong><code>cxf.xml</code></strong>:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  
      &lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
      &lt;import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" /&gt;
      &lt;import resource="classpath:META-INF/cxf/cxf-servlet.xml" /&gt;
  
      &lt;bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor" /&gt;
      &lt;bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor" /&gt;
  
      &lt;bean class="com.palominocia.capa_datos_nodo.servicios.NodoCentralImpl"
          id="NodoCentralImpl" /&gt;
      &lt;jaxws:endpoint address="/NodoCentralImplWS" id="NodoCentralImplWS"
          implementor="#NodoCentralImpl"&gt;
          &lt;jaxws:properties&gt;
              &lt;entry key="schema-validation-enabled" value="true" /&gt;
          &lt;/jaxws:properties&gt;
      &lt;/jaxws:endpoint&gt;
  
      &lt;bean class="com.palominocia.capa_datos_nodo.servicios.HelloWorldImpl"
          id="HelloWorldImpl" /&gt;
      &lt;jaxws:endpoint address="/HelloWorldImplWS" id="HelloWorldImplWS"
          implementor="#HelloWorldImpl"&gt;
          &lt;jaxws:properties&gt;
              &lt;entry key="schema-validation-enabled" value="true" /&gt;
          &lt;/jaxws:properties&gt;
  
  &lt;!-- ?? --&gt;
          &lt;jaxws:inInterceptors&gt;
              &lt;bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" /&gt;
              &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                  &lt;constructor-arg&gt;
                      &lt;map&gt;
                          &lt;entry key="action" value="UsernameToken" /&gt;
                          &lt;entry key="passwordType" value="PasswordText" /&gt;
                          &lt;entry key="passwordCallbackClass" value="com.palominocia.capa_datos_nodo.servicios.ClientPasswordCallback" /&gt;
                      &lt;/map&gt;
                  &lt;/constructor-arg&gt;
              &lt;/bean&gt;
          &lt;/jaxws:inInterceptors&gt;
      &lt;/jaxws:endpoint&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>The CallBack class that would control the user and password is this:</p>
  
  <p>The idea is to control against BD and the execution grant or deny.</p>
  
  <p><strong><code>ClientPasswordCallback.java</code></strong></p>
  
  <pre><code>package com.palominocia.capa_datos_nodo.servicios;
  
  import java.io.IOException;
  import javax.security.auth.callback.Callback;
  import javax.security.auth.callback.CallbackHandler;
  import javax.security.auth.callback.UnsupportedCallbackException;
  import org.apache.ws.security.WSPasswordCallback;
  
  public class ClientPasswordCallback implements CallbackHandler {
  
      public void handle(Callback[] callbacks) throws IOException, 
              UnsupportedCallbackException {
          WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
          System.out.println("pc.getPassword() " + pc.getPassword());
          System.out.println("pc.getIdentifier() " + pc.getIdentifier());
          if ("joe".equals(pc.getIdentifier())) {
              pc.setPassword("joespassword");
          } // else {...} - can add more users, access DB, etc.
      }
  }
  </code></pre>
  
  <p>The <strong><code>web.xml</code></strong> file is configured as follows: </p>
  
  
  
  <pre><code>&lt;web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.5" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
  
  
      &lt;display-name&gt;capa_datos_nodo&lt;/display-name&gt;
  
      &lt;description&gt;Roo generated capa_datos_nodo application&lt;/description&gt;
  
  
      &lt;!-- Enable escaping of form submission contents --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;defaultHtmlEscape&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;classpath*:META-INF/spring/applicationContext*.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;CharacterEncodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;forceEncoding&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
  
  
  
      &lt;filter&gt;
          &lt;filter-name&gt;HttpMethodFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.HiddenHttpMethodFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;Spring OpenEntityManagerInViewFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;CharacterEncodingFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;HttpMethodFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;Spring OpenEntityManagerInViewFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Creates the Spring Container shared by all Servlets and Filters --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;!-- Handles Spring requests --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;capa_datos_nodo&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;WEB-INF/spring/webmvc-config.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;capa_datos_nodo&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;session-config&gt;
          &lt;session-timeout&gt;10&lt;/session-timeout&gt;
      &lt;/session-config&gt;
  
      &lt;error-page&gt;
          &lt;exception-type&gt;java.lang.Exception&lt;/exception-type&gt;
          &lt;location&gt;/uncaughtException&lt;/location&gt;
      &lt;/error-page&gt;
  
      &lt;error-page&gt;
          &lt;error-code&gt;404&lt;/error-code&gt;
          &lt;location&gt;/resourceNotFound&lt;/location&gt;
      &lt;/error-page&gt;
  
          &lt;servlet&gt;
          &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.apache.cxf.transport.servlet.CXFServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;config-location&lt;/param-name&gt;
              &lt;param-value&gt;WEB-INF/conf_cxf_context.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/servicios/datos/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>This class is for the web service has only one method of return is only for testing</p>
  
  <p><strong><code>HelloWorldImpl.java</code></strong></p>
  
  <pre><code>package com.palominocia.capa_datos_nodo.servicios;
  
  import java.util.List;
  import java.util.Map;
  
  
  import javax.annotation.Resource;
  import javax.jws.WebService;
  import javax.xml.ws.WebServiceContext;
  import javax.xml.ws.handler.MessageContext;
  
  import org.apache.cxf.interceptor.InInterceptors;
  import org.apache.cxf.interceptor.OutInterceptors;
  
  //Service Implementation Bean
  @WebService(endpointInterface = "com.palominocia.capa_datos_nodo.servicios.HelloWorld")
  @InInterceptors(interceptors = "org.apache.cxf.interceptor.LoggingInInterceptor")
  @OutInterceptors(interceptors = "org.apache.cxf.interceptor.LoggingOutInterceptor")
  public class HelloWorldImpl implements HelloWorld{
  
      @Resource
      WebServiceContext wsctx;
  
      @Override
      public String getHelloWorldAsString() {
  
      MessageContext mctx = wsctx.getMessageContext();
      System.out.println("header "+mctx);
      //get detail from request headers
          Map http_headers = (Map) mctx.get(MessageContext.HTTP_REQUEST_HEADERS);
          List userList = (List) http_headers.get("Username");
          List passList = (List) http_headers.get("Password");
  
          String username = "";
          String password = "";
  
          if(userList!=null){
              //get username
              username = userList.get(0).toString();
          }
  
          if(passList!=null){
              //get password
              password = passList.get(0).toString();
          }
          System.out.println("userList "+userList);
          System.out.println("passList "+passList);
          //Should validate username and password with database
          if (username.equals("mkyong") &amp;&amp; password.equals("password")){
              return "Hello World JAX-WS - Valid User!";
          }else{
              return "Unknown User!";
          }
  
      }   
  }
  </code></pre>
  
  <p>Previously used for authentication by the head but I am proving the library ws-security.</p>
  
  <p>What happens is that if I create the web client with netbeans and I run it just jumps me the following <strong>error</strong>: </p>
  
  <pre><code>Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: An Error was discovered processing the &lt;wsse: Security&gt; header.
  </code></pre>
  
  <p>The client is written so:</p>
  
  <pre><code>HelloWorldImplService serv = new HelloWorldImplService();
          HelloWorld port = serv.getHelloWorldImplPort();
          System.out.println(" *** " + port.getHelloWorldAsString());
  </code></pre>
  
  <p>I built the program according to the resources found online, before adding ws-security running properly and that I may be missing.</p>
  
  <p>Sorry for the English but I'm not good at writing</p>