title: Calling a secured Web Service in Java
body: <p>I need to write a web service client to call a third party web service (SOAP based).  The third party published a wsdl and the associated xsd files.  </p>
  
  <p>The third party secure their website and services using .p12 certificates</p>
  
  <p>I used wsdl2java to generate my stubs.  I modified the endpoints and called the service.  I received the following error:</p>
  
  <pre><code>&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"&gt;
     &lt;SOAP-ENV:Header&gt;&lt;/SOAP-ENV:Header&gt;
     &lt;SOAP-ENV:Body&gt;
        &lt;SOAP-ENV:Fault&gt;
           &lt;faultcode xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;wsse:InvalidSecurity&lt;/faultcode&gt;
           &lt;faultstring&gt;SECU1075: An error was discovered processing the &amp;lt;wsse:Security&gt; header&lt;/faultstring&gt;
           &lt;detail&gt;SECU3510: Signature requirements validation failed: Element (/soapenv:Envelope/soapenv:Body) was not signed&lt;/detail&gt;
        &lt;/SOAP-ENV:Fault&gt;
     &lt;/SOAP-ENV:Body&gt;
  &lt;/SOAP-ENV:Envelope&gt;
  </code></pre>
  
  <p>Hmmm, ok.  Makes sense that I should be signing the document.  </p>
  
  <p>The strange part (to me) is there isn't a security definition anywhere in the WSDL file.  Is this normal?  I contacted the third party and they sent me a pdf of what the SOAP message needs to look like.  The following tags appear in the header:
      
  containing:</p>
  
  <pre><code>&lt;wsse:BinarySecurityToken&gt;
  </code></pre>
  
  <p>and</p>
  
  <pre><code>&lt;dsig:SignedInfo&gt;
  </code></pre>
  
  <p>so from what I gather, it requires my certificate and some digital signatures.</p>
  
  <p>Can someone recommend how to generate these in Java?  I started down the Axis2/Rampart path but honestly, it seems those are predicated on having the security requirements defined in the WSDL file (correct me if I'm wrong).</p>