title: What is the correct configuration for a CXF SOAP Service with UsernameTokenSignature?
body: <p>I'm trying to setup a CXF Service and Client using UsernameTokenSignature. Startingpoint is an existing, code first, service. Unfortunatly all examples I found use WS-Policy, which is - as I understand - not supported by CXF in a code first scenario.</p>
  
  <p>I managed to create a client which sends messages like I expect using this configuration:</p>
  
  <p><strong>Client:</strong></p>
  
  <pre><code>&lt;jaxws:client id="clientWithUsernameTokenSignature" serviceClass="mypackage.MyServiceInterface" address="http://localhost:8081/ws-security-secured-soap-service/services/Service_v1"&gt;
      &lt;jaxws:outInterceptors&gt;
          &lt;ref bean="WSS4JOutInterceptor_UsernameTokenSignature" /&gt;
      &lt;/jaxws:outInterceptors&gt;
  &lt;/jaxws:client&gt;
  </code></pre>
  
  <p><strong>WSS4JOutInterceptor</strong></p>
  
  <pre><code> &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor" id="WSS4JOutInterceptor_UsernameTokenSignature"&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="action" value="UsernameTokenSignature" /&gt;
              &lt;entry key="user" value="Admin" /&gt;
              &lt;entry key="passwordCallbackClass" value="mypackage.ClientCallbackHandler" /&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>However I failed setting up a service to process the messages from this client correctly. I tried:</p>
  
  <p><strong>Service:</strong></p>
  
  <pre><code>&lt;jaxws:endpoint id="soapServ_v3" implementor="#myServiceFacade" address="/MyService_v1"&gt;
          &lt;jaxws:inInterceptors&gt;
              &lt;ref bean="WSS4JInInterceptor_UsernameTokenSignature" /&gt;
          &lt;/jaxws:inInterceptors&gt;
  &lt;/jaxws:endpoint&gt;
  </code></pre>
  
  <p><strong>WSS4JInInterceptor</strong></p>
  
  <pre><code>&lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor" id="WSS4JInInterceptor_UsernameTokenSignature"&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="action" value="UsernameTokenSignature" /&gt;
              &lt;entry key="passwordCallbackClass" value="mypackage.ServerCallbackHandler" /&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Doing this the server doesn't accept messages from the client and responds with a security error.
  Debugging I found that the first place it fails is in verifyUnknownPassword of org.apache.wss4j.dom.validate.UsernameTokenValidator.
  Here allowUsernameTokenDerivedKeys is set to false. I presume there is some configuration I can set to get this to to true.</p>
  
  <p><strong>Which is the correct configuration on the server to allow username token derived keys?</strong></p>
  
  <p>Even if I use the debugger to change the value to true the service call still fails. In that case the interceptor throws an exception at checkActions: 'An error was discovered processing the  header'.</p>
  
  <p>So I presume there's something else I need to configure aswell. <strong>Anyone knows how to set this up correctly?</strong></p>