Working on SWS-207

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jInterceptorTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jInterceptorTest extends Wss4jInterceptorTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorAcegiCallbackHandlerTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorAcegiCallbackHandlerTest
+        extends Wss4jMessageInterceptorAcegiCallbackHandlerTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorEncryptionTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorEncryptionTest extends Wss4jMessageInterceptorEncryptionTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorHeaderTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorHeaderTest extends Wss4jMessageInterceptorHeaderTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorSignTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptorSignTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorTimestampTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorTimestampTest extends Wss4jMessageInterceptorTimestampTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorUsernameTokenSignatureTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorUsernameTokenSignatureTest
+        extends Wss4jMessageInterceptorUsernameTokenSignatureTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorUsernameTokenTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorUsernameTokenTest extends Wss4jMessageInterceptorUsernameTokenTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jInterceptorTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jInterceptorTest extends Wss4jInterceptorTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorAcegiCallbackHandlerTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorAcegiCallbackHandlerTest
+        extends Wss4jMessageInterceptorAcegiCallbackHandlerTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorEncryptionTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorEncryptionTest extends Wss4jMessageInterceptorEncryptionTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorHeaderTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorHeaderTest extends Wss4jMessageInterceptorHeaderTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorSignTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptorSignTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorTimestampTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorTimestampTest extends Wss4jMessageInterceptorTimestampTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorUsernameTokenSignatureTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorUsernameTokenSignatureTest
+        extends Wss4jMessageInterceptorUsernameTokenSignatureTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorUsernameTokenTest.java

@@ -0,0 +1,5 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorUsernameTokenTest extends Wss4jMessageInterceptorUsernameTokenTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jInterceptorTestCase.java

@@ -0,0 +1,57 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.WsSecuritySecurementException;
+import org.springframework.ws.soap.security.WsSecurityValidationException;
+
+public abstract class Wss4jInterceptorTestCase extends Wss4jTestCase {
+
+    public void testhandleRequest() throws Exception {
+        SoapMessage request = loadMessage("empty-soap.xml");
+        final Object requestMessage = getMessage(request);
+        SoapMessage validatedRequest = loadMessage("empty-soap.xml");
+        final Object validatedRequestMessage = getMessage(validatedRequest);
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor() {
+            protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecuritySecurementException {
+                fail("secure not expected");
+            }
+
+            protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecurityValidationException {
+                assertEquals("Invalid message", requestMessage, getMessage(soapMessage));
+                setMessage(soapMessage, validatedRequestMessage);
+            }
+        };
+        MessageContext context = new DefaultMessageContext(request, getMessageFactory());
+        interceptor.handleRequest(context, null);
+        assertEquals("Invalid request", validatedRequestMessage, getMessage((SoapMessage) context.getRequest()));
+    }
+
+    public void testhandleResponse() throws Exception {
+        SoapMessage securedResponse = loadMessage("empty-soap.xml");
+        final Object securedResponseMessage = getMessage(securedResponse);
+
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor() {
+
+            protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecuritySecurementException {
+                setMessage(soapMessage, securedResponseMessage);
+            }
+
+            protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecurityValidationException {
+                fail("validate not expected");
+            }
+
+        };
+        SoapMessage request = loadMessage("empty-soap.xml");
+        MessageContext context = new DefaultMessageContext(request, getMessageFactory());
+        context.getResponse();
+        interceptor.handleResponse(context, null);
+        assertEquals("Invalid response", securedResponseMessage, getMessage((SoapMessage) context.getResponse()));
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorAcegiCallbackHandlerTestCase.java

@@ -0,0 +1,79 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Properties;
+
+import org.acegisecurity.Authentication;
+import org.acegisecurity.context.SecurityContextHolder;
+import org.acegisecurity.userdetails.memory.InMemoryDaoImpl;
+import org.apache.ws.security.WSConstants;
+
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.aop.support.NameMatchMethodPointcutAdvisor;
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.server.EndpointInterceptor;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.acegi.AcegiCallbackHandler;
+import org.springframework.ws.soap.security.wss4j.callback.acegi.AcegiSecurityContextUpdateAdvice;
+
+public abstract class Wss4jMessageInterceptorAcegiCallbackHandlerTestCase extends Wss4jTestCase {
+
+    private Properties users = new Properties();
+
+    protected void onSetup() throws Exception {
+        users.setProperty("Bert", "Ernie,ROLE_TEST");
+    }
+
+    public void testValidateUsernameTokenDigest() throws Exception {
+        EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, true);
+        SoapMessage message = loadMessage("usernameTokenDigest-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.handleRequest(messageContext, null);
+        assertValidateUsernameToken(message);
+    }
+
+    protected void assertValidateUsernameToken(SoapMessage message) throws Exception {
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+        Authentication authentication = SecurityContextHolder.getContext()
+                .getAuthentication();
+        assertNotNull("authentication must not be null", authentication);
+    }
+
+    protected EndpointInterceptor prepareInterceptor(String actions, boolean validating, boolean digest)
+            throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        if (validating) {
+            interceptor.setValidationActions(actions);
+        }
+        else {
+            interceptor.setSecurementActions(actions);
+        }
+        AcegiCallbackHandler callbackHandler = new AcegiCallbackHandler();
+        InMemoryDaoImpl userDetailsService = new InMemoryDaoImpl();
+        userDetailsService.setUserProperties(users);
+        userDetailsService.afterPropertiesSet();
+        callbackHandler.setUserDetailsService(userDetailsService);
+        if (digest) {
+            callbackHandler.setPasswordDigestRequired(true);
+            callbackHandler.setPasswordPlainTextRequired(false);
+            interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
+        }
+        else {
+            callbackHandler.setPasswordDigestRequired(false);
+            callbackHandler.setPasswordPlainTextRequired(true);
+            interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
+        }
+        interceptor.setValidationCallbackHandler(callbackHandler);
+        interceptor.afterPropertiesSet();
+
+        ProxyFactory factory = new ProxyFactory(interceptor);
+        AcegiSecurityContextUpdateAdvice advice = new AcegiSecurityContextUpdateAdvice();
+        NameMatchMethodPointcutAdvisor advisor = new NameMatchMethodPointcutAdvisor(advice);
+        advisor.setMappedName("handleRequest");
+        factory.addAdvisor(advisor);
+        return (EndpointInterceptor) factory.getProxy();
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorEncryptionTestCase.java

@@ -0,0 +1,68 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Properties;
+
+import org.apache.ws.security.components.crypto.Crypto;
+import org.w3c.dom.Document;
+
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.SimpleCallbackHandler;
+import org.springframework.ws.soap.security.wss4j.support.CryptoFactoryBean;
+
+public abstract class Wss4jMessageInterceptorEncryptionTestCase extends Wss4jTestCase {
+
+    protected Wss4jSecurityInterceptor interceptor;
+
+    protected void onSetup() throws Exception {
+        interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setValidationActions("Encrypt");
+        interceptor.setSecurementActions("Encrypt");
+
+        SimpleCallbackHandler callbackHandler = new SimpleCallbackHandler();
+        callbackHandler.setKeyPassword("123456");
+        interceptor.setValidationCallbackHandler(callbackHandler);
+
+        CryptoFactoryBean cryptoFactoryBean = new CryptoFactoryBean();
+
+        Properties cryptoFactoryBeanConfig = new Properties();
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.provider",
+                "org.apache.ws.security.components.crypto.Merlin");
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.keystore.type", "jceks");
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.keystore.password", "123456");
+
+        // from the class path
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.file", "private.jks");
+        cryptoFactoryBean.setConfiguration(cryptoFactoryBeanConfig);
+        cryptoFactoryBean.afterPropertiesSet();
+        interceptor.setValidationDecryptionCrypto((Crypto) cryptoFactoryBean
+                .getObject());
+        interceptor.setSecurementEncryptionCrypto((Crypto) cryptoFactoryBean
+                .getObject());
+
+        interceptor.afterPropertiesSet();
+    }
+
+    public void testDecryptRequest() throws Exception {
+        SoapMessage message = loadMessage("encrypted-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, messageContext);
+        Document document = getDocument((SoapMessage) messageContext.getRequest());
+        assertXpathEvaluatesTo("Decryption error", "Hello", "/SOAP-ENV:Envelope/SOAP-ENV:Body/echo:echoRequest/text()",
+                document);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+    }
+
+    public void testEncryptResponse() throws Exception {
+        SoapMessage message = loadMessage("empty-soap.xml");
+        MessageContext messageContext = getMessageContext(message);
+        interceptor.setSecurementEncryptionUser("rsakey");
+        interceptor.secureMessage(message, messageContext);
+        Document document = getDocument(message);
+        assertXpathExists("Encryption error", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey",
+                document);
+        //TODO see why the clear message appears in the unit test
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorHeaderTestCase.java

@@ -0,0 +1,55 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Iterator;
+import java.util.Properties;
+import javax.xml.namespace.QName;
+
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapHeaderElement;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.SimpleCallbackHandler;
+
+public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCase {
+
+    private Wss4jSecurityInterceptor interceptor;
+
+    protected void onSetup() throws Exception {
+        Properties users = new Properties();
+        users.setProperty("Bert", "Ernie");
+        interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setValidateRequest(true);
+        interceptor.setSecureResponse(true);
+        interceptor.setValidationActions("UsernameToken");
+        SimpleCallbackHandler callbackHandler = new SimpleCallbackHandler();
+        callbackHandler.setUsers(users);
+        interceptor.setValidationCallbackHandler(callbackHandler);
+        interceptor.afterPropertiesSet();
+    }
+
+    public void testValidateUsernameTokenPlainText() throws Exception {
+        SoapMessage message = loadMessage("usernameTokenPlainTextWithHeaders-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, messageContext);
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+
+        for (Iterator i = message.getEnvelope().getHeader()
+                .examineAllHeaderElements(); i.hasNext();) {
+            SoapHeaderElement element = (SoapHeaderElement) i.next();
+            QName name = element.getName();
+            if (name
+                    .getNamespaceURI()
+                    .equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
+                fail("Security Header not removed");
+            }
+
+        }
+
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+        assertXpathExists("header1 not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/header1", getDocument(message));
+        assertXpathExists("header2 not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/header2", getDocument(message));
+
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorSignTestCase.java

@@ -0,0 +1,88 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Properties;
+
+import org.apache.ws.security.components.crypto.Crypto;
+import org.w3c.dom.Document;
+
+import org.springframework.ws.WebServiceMessage;
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.SimpleCallbackHandler;
+import org.springframework.ws.soap.security.wss4j.support.CryptoFactoryBean;
+
+public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase {
+
+    protected Wss4jSecurityInterceptor interceptor;
+
+    protected void onSetup() throws Exception {
+        interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setValidationActions("Signature");
+        SimpleCallbackHandler callbackHandler = new SimpleCallbackHandler();
+        interceptor.setValidationCallbackHandler(callbackHandler);
+
+        CryptoFactoryBean cryptoFactoryBean = new CryptoFactoryBean();
+        Properties cryptoFactoryBeanConfig = new Properties();
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.provider",
+                "org.apache.ws.security.components.crypto.Merlin");
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.keystore.type", "jceks");
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.keystore.password", "123456");
+
+        // from the class path
+        cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.file", "private.jks");
+        cryptoFactoryBean.setConfiguration(cryptoFactoryBeanConfig);
+        cryptoFactoryBean.afterPropertiesSet();
+        interceptor.setValidationSignatureCrypto((Crypto) cryptoFactoryBean
+                .getObject());
+        interceptor.setSecurementSignatureCrypto((Crypto) cryptoFactoryBean
+                .getObject());
+        interceptor.afterPropertiesSet();
+
+    }
+
+    public void testValidateCertificate() throws Exception {
+        SoapMessage message = loadMessage("signed-soap.xml");
+
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, messageContext);
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+    }
+
+    public void testValidateCertificateWithSignatureConfirmation() throws Exception {
+        SoapMessage message = loadMessage("signed-soap.xml");
+        MessageContext messageContext = getMessageContext(message);
+        interceptor.setEnableSignatureConfirmation(true);
+        interceptor.validateMessage(message, messageContext);
+        WebServiceMessage response = messageContext.getResponse();
+        interceptor.secureMessage(message, messageContext);
+        assertNotNull("No result returned", response);
+        Document document = getDocument((SoapMessage) response);
+        message.writeTo(System.out);
+        assertXpathExists("Absent SignatureConfirmation element",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse11:SignatureConfirmation", document);
+    }
+
+    public void testSignResponse() throws Exception {
+        interceptor.setSecurementActions("Signature");
+        interceptor.setEnableSignatureConfirmation(false);
+        interceptor.setSecurementPassword("123456");
+        interceptor.setSecurementUsername("rsaKey");
+        SoapMessage message = loadMessage("empty-soap.xml");
+        MessageContext messageContext = getMessageContext(message);
+
+        // interceptor.setSecurementSignatureKeyIdentifier("IssuerSerial");
+
+        interceptor.secureMessage(message, messageContext);
+
+        Document document = getDocument(message);
+        assertXpathExists("Absent SignatureConfirmation element",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/ds:Signature", document);
+
+
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorTimestampTestCase.java

@@ -0,0 +1,78 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.lang.reflect.Field;
+
+import org.w3c.dom.Document;
+
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+
+public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTestCase {
+
+    public void testAddTimestamp() throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setSecurementActions("Timestamp");
+        interceptor.afterPropertiesSet();
+        SoapMessage message = loadMessage("empty-soap.xml");
+        MessageContext context = getMessageContext(message);
+        interceptor.secureMessage(message, context);
+        Document document = getDocument(message);
+        assertXpathExists("timestamp header not found",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp", document);
+    }
+
+    public void testValidateTimestamp() throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setValidationActions("Timestamp");
+        interceptor.afterPropertiesSet();
+        SoapMessage message = getMessageWithTimestamp();
+
+        MessageContext context = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, context);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+    }
+
+    public void testValidateTimestampWithTtl() throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor() {
+            public void setTimeToLive(int t) {
+                try {
+                    Field ttl = Wss4jSecurityInterceptor.class
+                            .getDeclaredField("timeToLive");
+                    ttl.setAccessible(true);
+                    ttl.set(this, new Integer(t));
+
+                }
+                catch (Exception e) {
+                    throw new RuntimeException(e);
+                }
+            }
+        };
+        interceptor.setValidationActions("Timestamp");
+        interceptor.setTimeToLive(-10);
+        interceptor.setTimestampStrict(true);
+        interceptor.afterPropertiesSet();
+        SoapMessage message = getMessageWithTimestamp();
+        MessageContext context = new DefaultMessageContext(message, getMessageFactory());
+
+        try {
+            interceptor.validateMessage(message, context);
+        }
+        catch (Wss4jSecurityValidationException ex) {
+            // expected
+            return;
+        }
+        fail("Time to live validation failed");
+    }
+
+    private SoapMessage getMessageWithTimestamp() throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setSecurementActions("Timestamp");
+        interceptor.afterPropertiesSet();
+        SoapMessage message = loadMessage("empty-soap.xml");
+        MessageContext context = getMessageContext(message);
+        interceptor.secureMessage(message, context);
+        return message;
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenSignatureTestCase.java

@@ -0,0 +1,27 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import org.w3c.dom.Document;
+
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+
+public abstract class Wss4jMessageInterceptorUsernameTokenSignatureTestCase extends Wss4jTestCase {
+
+    public void testAddUsernameTokenSignature() throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        interceptor.setSecurementActions("UsernameTokenSignature");
+        interceptor.setSecurementUsername("Bert");
+        interceptor.setSecurementPassword("Ernie");
+        interceptor.afterPropertiesSet();
+        SoapMessage message = loadMessage("empty-soap.xml");
+        MessageContext context = getMessageContext(message);
+        interceptor.secureMessage(message, context);
+
+        Document doc = getDocument(message);
+        assertXpathEvaluatesTo("Invalid Username", "Bert",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", doc);
+        assertXpathExists("Invalid Password",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest']/text()",
+                doc);
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java

@@ -0,0 +1,115 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Properties;
+
+import org.apache.ws.security.WSConstants;
+import org.w3c.dom.Document;
+
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.SimpleCallbackHandler;
+
+public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4jTestCase {
+
+    private Properties users = new Properties();
+
+    protected void onSetup() throws Exception {
+        users.setProperty("Bert", "Ernie");
+    }
+
+    public void testValidateUsernameTokenPlainText() throws Exception {
+        Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
+        SoapMessage message = loadMessage("usernameTokenPlainText-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, messageContext);
+        assertValidateUsernameToken(message);
+    }
+
+    public void testValidateUsernameTokenDigest() throws Exception {
+        Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, true);
+        SoapMessage message = loadMessage("usernameTokenDigest-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.validateMessage(message, messageContext);
+        assertValidateUsernameToken(message);
+    }
+
+    public void testAddUsernameTokenPlainText() throws Exception {
+        Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false);
+        interceptor.setSecurementUsername("Bert");
+        interceptor.setSecurementPassword("Ernie");
+        SoapMessage message = loadMessage("empty-soap.xml");
+
+        MessageContext messageContext = getMessageContext(message);
+
+        interceptor.secureMessage(message, messageContext);
+        assertAddUsernameTokenPlainText(message);
+    }
+
+    public void testAddUsernameTokenDigest() throws Exception {
+        Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, true);
+        interceptor.setSecurementUsername("Bert");
+        interceptor.setSecurementPassword("Ernie");
+        SoapMessage message = loadMessage("empty-soap.xml");
+
+        MessageContext messageContext = getMessageContext(message);
+        interceptor.secureMessage(message, messageContext);
+        assertAddUsernameTokenDigest(message);
+    }
+
+    protected void assertValidateUsernameToken(SoapMessage message) throws Exception {
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+    }
+
+    protected void assertAddUsernameTokenPlainText(SoapMessage message) throws Exception {
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+        Document doc = getDocument(message);
+        assertXpathEvaluatesTo("Invalid Username", "Bert",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", doc);
+        assertXpathEvaluatesTo("Invalid Password", "Ernie",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText']/text()",
+                doc);
+    }
+
+    protected void assertAddUsernameTokenDigest(SoapMessage message) throws Exception {
+        Object result = getMessage(message);
+        Document doc = getDocument(message);
+        assertNotNull("No result returned", result);
+        assertXpathEvaluatesTo("Invalid Username", "Bert",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", doc);
+        assertXpathExists("Password does not exist",
+                "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest']",
+                doc);
+
+    }
+
+    protected Wss4jSecurityInterceptor prepareInterceptor(String actions, boolean validating, boolean digest)
+            throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        if (validating) {
+            interceptor.setValidationActions(actions);
+        }
+        else {
+            interceptor.setSecurementActions(actions);
+        }
+        SimpleCallbackHandler callbackHandler = new SimpleCallbackHandler();
+        callbackHandler.setUsers(users);
+        if (digest) {
+            callbackHandler.setPasswordDigestRequired(true);
+            callbackHandler.setPasswordPlainTextRequired(false);
+            interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
+        }
+        else {
+            callbackHandler.setPasswordDigestRequired(false);
+            callbackHandler.setPasswordPlainTextRequired(true);
+            interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
+        }
+        interceptor.setValidationCallbackHandler(callbackHandler);
+        interceptor.afterPropertiesSet();
+        return interceptor;
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jTestCase.java

@@ -0,0 +1,200 @@
+/*
+ * Copyright 2006 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.ws.soap.security.wss4j;
+
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+import javax.xml.soap.MessageFactory;
+import javax.xml.soap.MimeHeaders;
+import javax.xml.soap.SOAPMessage;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamReader;
+
+import junit.framework.TestCase;
+import org.apache.axiom.soap.impl.builder.StAXSOAPModelBuilder;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.ws.WebServiceMessage;
+import org.springframework.ws.WebServiceMessageFactory;
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.axiom.AxiomSoapMessage;
+import org.springframework.ws.soap.axiom.AxiomSoapMessageFactory;
+import org.springframework.ws.soap.axiom.support.AxiomUtils;
+import org.springframework.ws.soap.saaj.SaajSoapMessage;
+import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
+import org.springframework.xml.xpath.XPathExpression;
+import org.springframework.xml.xpath.XPathExpressionFactory;
+
+public abstract class Wss4jTestCase extends TestCase {
+
+    protected MessageFactory messageFactory;
+
+    protected final boolean axiomTest = this.getClass().getSimpleName()
+            .startsWith("Axiom");
+
+    protected final boolean saajTest = this.getClass().getSimpleName()
+            .startsWith("Saaj");
+
+    protected Map namespaces;
+
+    protected final void setUp() throws Exception {
+        if (!axiomTest && !saajTest) {
+            throw new IllegalArgumentException("test class name must statrt with either Axiom or Saaj");
+        }
+        messageFactory = MessageFactory.newInstance();
+        namespaces = new HashMap();
+        namespaces.put("SOAP-ENV", "http://schemas.xmlsoap.org/soap/envelope/");
+        namespaces.put("wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
+        namespaces.put("ds", "http://www.w3.org/2000/09/xmldsig#");
+        namespaces.put("xenc", "http://www.w3.org/2001/04/xmlenc#");
+//        namespaces.put("wsse11", "http://docs.oasis-open.org/wss/2005/xx/oasis-2005xx-wss-wssecurity-secext-1.1.xsd");
+        namespaces.put("wsse11", "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd");
+        namespaces.put("echo", "http://www.springframework.org/spring-ws/samples/echo");
+        namespaces.put("wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
+        onSetup();
+    }
+
+    protected void assertXpathEvaluatesTo(String message,
+                                          String expectedValue,
+                                          String xpathExpression,
+                                          Document document) {
+        XPathExpression expression = XPathExpressionFactory
+                .createXPathExpression(xpathExpression, namespaces);
+        String actualValue = expression.evaluateAsString(document);
+        assertEquals(message, expectedValue, actualValue);
+    }
+
+    protected void assertXpathExists(String message, String xpathExpression, Document document) {
+        XPathExpression expression = XPathExpressionFactory
+                .createXPathExpression(xpathExpression, namespaces);
+        Node node = expression.evaluateAsNode(document);
+        assertNotNull(message, node);
+    }
+
+    protected void assertXpathNotExists(String message, String xpathExpression, Document document) {
+        XPathExpression expression = XPathExpressionFactory
+                .createXPathExpression(xpathExpression, namespaces);
+        Node node = expression.evaluateAsNode(document);
+        assertNull(message, node);
+    }
+
+    protected SaajSoapMessage loadSaajMessage(String fileName) throws Exception {
+        MimeHeaders mimeHeaders = new MimeHeaders();
+        mimeHeaders.addHeader("Content-Type", "text/xml");
+        Resource resource = new ClassPathResource(fileName, getClass());
+        InputStream is = resource.getInputStream();
+        try {
+            assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
+            is = resource.getInputStream();
+            return new SaajSoapMessage(messageFactory.createMessage(mimeHeaders, is));
+        }
+        finally {
+            is.close();
+        }
+    }
+
+    protected AxiomSoapMessage loadAxiomMessage(String fileName) throws Exception {
+        Resource resource = new ClassPathResource(fileName, getClass());
+        InputStream is = resource.getInputStream();
+        try {
+            assertTrue("Could not load Axiom message [" + resource + "]", resource.exists());
+            is = resource.getInputStream();
+
+            XMLStreamReader parser = XMLInputFactory.newInstance()
+                    .createXMLStreamReader(is);
+            StAXSOAPModelBuilder builder = new StAXSOAPModelBuilder(parser, null);
+            org.apache.axiom.soap.SOAPMessage soapMessage = builder
+                    .getSoapMessage();
+            return new AxiomSoapMessage(soapMessage, "", true);
+        }
+        finally {
+            is.close();
+        }
+    }
+
+    protected Object getMessage(SoapMessage soapMessage) {
+        if (soapMessage instanceof SaajSoapMessage) {
+            return ((SaajSoapMessage) soapMessage).getSaajMessage();
+        }
+        if (soapMessage instanceof AxiomSoapMessage) {
+            return ((AxiomSoapMessage) soapMessage).getAxiomMessage();
+
+        }
+        throw new IllegalArgumentException("Illegal message: " + soapMessage);
+    }
+
+    protected void setMessage(SoapMessage soapMessage, Object message) {
+        if (soapMessage instanceof SaajSoapMessage) {
+            ((SaajSoapMessage) soapMessage)
+                    .setSaajMessage((SOAPMessage) message);
+            return;
+        }
+        if (soapMessage instanceof AxiomSoapMessage) {
+            ((AxiomSoapMessage) soapMessage)
+                    .setAxiomMessage((org.apache.axiom.soap.SOAPMessage) message);
+            return;
+        }
+        throw new IllegalArgumentException("Illegal message: " + message);
+    }
+
+    protected void onSetup() throws Exception {
+    }
+
+    protected SoapMessage loadMessage(String fileName) throws Exception {
+        if (axiomTest) {
+            return loadAxiomMessage(fileName);
+        }
+        if (saajTest) {
+            return loadSaajMessage(fileName);
+        }
+        throw new IllegalArgumentException();
+    }
+
+    protected WebServiceMessageFactory getMessageFactory() throws Exception {
+        if (axiomTest) {
+            return new AxiomSoapMessageFactory();
+        }
+        if (saajTest) {
+            return new SaajSoapMessageFactory(messageFactory);
+        }
+        throw new IllegalArgumentException();
+    }
+
+    protected Document getDocument(SoapMessage message) throws Exception {
+        if (axiomTest) {
+            return AxiomUtils.toDocument(((AxiomSoapMessage) message).getAxiomMessage().getSOAPEnvelope());
+        }
+        if (saajTest) {
+            return ((SaajSoapMessage) message).getSaajMessage().getSOAPPart();
+        }
+        throw new IllegalArgumentException();
+    }
+
+    protected MessageContext getMessageContext(final SoapMessage response) throws Exception {
+        return new DefaultMessageContext(response, getMessageFactory()) {
+            public WebServiceMessage getResponse() {
+                return response;
+            }
+        };
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/support/CryptoFactoryBeanTest.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright ${YEAR} the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.wss4j.support;
+
+import java.util.Properties;
+
+import junit.framework.TestCase;
+import org.apache.ws.security.components.crypto.Crypto;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.support.PropertiesLoaderUtils;
+import org.springframework.util.ClassUtils;
+
+public class CryptoFactoryBeanTest extends TestCase {
+
+    private CryptoFactoryBean factoryBean;
+
+    protected void setUp() throws Exception {
+        factoryBean = new CryptoFactoryBean();
+    }
+
+    public void testMerlin() throws Exception {
+        Properties configuration =
+                PropertiesLoaderUtils.loadProperties(new ClassPathResource("merlin.properties", getClass()));
+        factoryBean.setConfiguration(configuration);
+        factoryBean.setBeanClassLoader(ClassUtils.getDefaultClassLoader());
+        factoryBean.afterPropertiesSet();
+
+        Object result = factoryBean.getObject();
+        assertNotNull("No result", result);
+        assertTrue("Not a crypto instance", result instanceof Crypto);
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/AbstractXwssMessageInterceptorKeyStoreTestCase.java

@@ -21,7 +21,7 @@ import java.security.KeyStore;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 
-public abstract class XwssMessageInterceptorKeyStoreTestCase extends XwssMessageInterceptorTestCase {
+public abstract class AbstractXwssMessageInterceptorKeyStoreTestCase extends AbstractXwssMessageInterceptorTestCase {
 
     protected X509Certificate certificate;
 

security/src/test/java/org/springframework/ws/soap/security/xwss/AbstractXwssMessageInterceptorTestCase.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2006 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.xwss;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+import javax.xml.soap.MessageFactory;
+import javax.xml.soap.MimeHeaders;
+import javax.xml.soap.SOAPException;
+import javax.xml.soap.SOAPMessage;
+
+import org.custommonkey.xmlunit.XMLTestCase;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.ws.soap.saaj.SaajSoapMessage;
+import org.springframework.xml.xpath.XPathExpression;
+import org.springframework.xml.xpath.XPathExpressionFactory;
+
+public abstract class AbstractXwssMessageInterceptorTestCase extends XMLTestCase {
+
+    protected XwsSecurityInterceptor interceptor;
+
+    private MessageFactory messageFactory;
+
+    private Map namespaces;
+
+    protected final void setUp() throws Exception {
+        interceptor = new XwsSecurityInterceptor();
+        messageFactory = MessageFactory.newInstance();
+        namespaces = new HashMap();
+        namespaces.put("SOAP-ENV", "http://schemas.xmlsoap.org/soap/envelope/");
+        namespaces.put("wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
+        namespaces.put("ds", "http://www.w3.org/2000/09/xmldsig#");
+        namespaces.put("xenc", "http://www.w3.org/2001/04/xmlenc#");
+        onSetup();
+    }
+
+    protected void assertXpathEvaluatesTo(String message,
+                                          String expectedValue,
+                                          String xpathExpression,
+                                          SOAPMessage soapMessage) {
+        XPathExpression expression = XPathExpressionFactory.createXPathExpression(xpathExpression, namespaces);
+        Document document = soapMessage.getSOAPPart();
+        String actualValue = expression.evaluateAsString(document);
+        assertEquals(message, expectedValue, actualValue);
+    }
+
+    protected void assertXpathExists(String message, String xpathExpression, SOAPMessage soapMessage) {
+        XPathExpression expression = XPathExpressionFactory.createXPathExpression(xpathExpression, namespaces);
+        Document document = soapMessage.getSOAPPart();
+        Node node = expression.evaluateAsNode(document);
+        assertNotNull(message, node);
+    }
+
+    protected void assertXpathNotExists(String message, String xpathExpression, SOAPMessage soapMessage) {
+        XPathExpression expression = XPathExpressionFactory.createXPathExpression(xpathExpression, namespaces);
+        Document document = soapMessage.getSOAPPart();
+        Node node = expression.evaluateAsNode(document);
+        assertNull(message, node);
+    }
+
+    protected SaajSoapMessage loadSaajMessage(String fileName) throws SOAPException, IOException {
+        MimeHeaders mimeHeaders = new MimeHeaders();
+        mimeHeaders.addHeader("Content-Type", "text/xml");
+        Resource resource = new ClassPathResource(fileName, getClass());
+        InputStream is = resource.getInputStream();
+        try {
+            assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
+            is = resource.getInputStream();
+            return new SaajSoapMessage(messageFactory.createMessage(mimeHeaders, is));
+        }
+        finally {
+            is.close();
+        }
+    }
+
+    protected void onSetup() throws Exception {
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptorTest.java

@@ -41,11 +41,13 @@ public class XwsSecurityInterceptorTest extends TestCase {
         final SOAPMessage validatedRequest = messageFactory.createMessage();
         XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
 
-            protected void secureMessage(SoapMessage soapMessage) throws XwsSecuritySecurementException {
+            protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws XwsSecuritySecurementException {
                 fail("secure not expected");
             }
 
-            protected void validateMessage(SoapMessage message) throws WsSecurityValidationException {
+            protected void validateMessage(SoapMessage message, MessageContext messageContext)
+                    throws WsSecurityValidationException {
                 SaajSoapMessage saajSoapMessage = (SaajSoapMessage) message;
                 assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
                 saajSoapMessage.setSaajMessage(validatedRequest);
@@ -62,12 +64,14 @@ public class XwsSecurityInterceptorTest extends TestCase {
         final SOAPMessage securedResponse = messageFactory.createMessage();
         XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
 
-            protected void secureMessage(SoapMessage message) throws XwsSecuritySecurementException {
+            protected void secureMessage(SoapMessage message, MessageContext messageContext)
+                    throws XwsSecuritySecurementException {
                 SaajSoapMessage saajSoapMessage = (SaajSoapMessage) message;
                 saajSoapMessage.setSaajMessage(securedResponse);
             }
 
-            protected void validateMessage(SoapMessage soapMessage) throws WsSecurityValidationException {
+            protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecurityValidationException {
                 fail("validate not expected");
             }
 
@@ -85,13 +89,15 @@ public class XwsSecurityInterceptorTest extends TestCase {
         final SOAPMessage securedRequest = messageFactory.createMessage();
         XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
 
-            protected void secureMessage(SoapMessage soapMessage) throws XwsSecuritySecurementException {
+            protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws XwsSecuritySecurementException {
                 SaajSoapMessage saajSoapMessage = (SaajSoapMessage) soapMessage;
                 assertEquals("Invalid message", request, saajSoapMessage.getSaajMessage());
                 saajSoapMessage.setSaajMessage(securedRequest);
             }
 
-            protected void validateMessage(SoapMessage message) throws WsSecurityValidationException {
+            protected void validateMessage(SoapMessage message, MessageContext messageContext)
+                    throws WsSecurityValidationException {
                 fail("validate not expected");
             }
 
@@ -106,11 +112,13 @@ public class XwsSecurityInterceptorTest extends TestCase {
         final SOAPMessage validatedResponse = messageFactory.createMessage();
         XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
 
-            protected void secureMessage(SoapMessage message) throws XwsSecuritySecurementException {
+            protected void secureMessage(SoapMessage message, MessageContext messageContext)
+                    throws XwsSecuritySecurementException {
                 fail("secure not expected");
             }
 
-            protected void validateMessage(SoapMessage soapMessage) throws WsSecurityValidationException {
+            protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
+                    throws WsSecurityValidationException {
                 SaajSoapMessage saajSoapMessage = (SaajSoapMessage) soapMessage;
                 saajSoapMessage.setSaajMessage(validatedResponse);
             }

security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorEncryptTest.java

@@ -24,9 +24,9 @@ import com.sun.xml.wss.impl.callback.EncryptionKeyCallback;
 
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.ws.soap.saaj.SaajSoapMessage;
-import org.springframework.ws.soap.security.xwss.callback.AbstractCallbackHandler;
+import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
 
-public class XwssMessageInterceptorEncryptTest extends XwssMessageInterceptorKeyStoreTestCase {
+public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterceptorKeyStoreTestCase {
 
     public void testEncryptDefaultCertificate() throws Exception {
         interceptor.setPolicyConfiguration(new ClassPathResource("encrypt-config.xml", getClass()));
@@ -53,7 +53,7 @@ public class XwssMessageInterceptorEncryptTest extends XwssMessageInterceptorKey
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathExists("BinarySecurityToken does not exist",
@@ -87,7 +87,7 @@ public class XwssMessageInterceptorEncryptTest extends XwssMessageInterceptorKey
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathExists("BinarySecurityToken does not exist",

security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorSignTest.java

@@ -23,11 +23,12 @@ import javax.xml.soap.SOAPMessage;
 
 import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
 import com.sun.xml.wss.impl.callback.SignatureKeyCallback;
+
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.ws.soap.saaj.SaajSoapMessage;
-import org.springframework.ws.soap.security.xwss.callback.AbstractCallbackHandler;
+import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
 
-public class XwssMessageInterceptorSignTest extends XwssMessageInterceptorKeyStoreTestCase {
+public class XwssMessageInterceptorSignTest extends AbstractXwssMessageInterceptorKeyStoreTestCase {
 
     public void testSignDefaultCertificate() throws Exception {
         interceptor.setPolicyConfiguration(new ClassPathResource("sign-config.xml", getClass()));
@@ -54,7 +55,7 @@ public class XwssMessageInterceptorSignTest extends XwssMessageInterceptorKeySto
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathExists("BinarySecurityToken does not exist",
@@ -89,7 +90,7 @@ public class XwssMessageInterceptorSignTest extends XwssMessageInterceptorKeySto
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathExists("BinarySecurityToken does not exist",
@@ -120,7 +121,7 @@ public class XwssMessageInterceptorSignTest extends XwssMessageInterceptorKeySto
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("signed-soap.xml");
-        interceptor.validateMessage(message);
+        interceptor.validateMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security", result);

security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorUsernameTokenTest.java

@@ -24,11 +24,12 @@ import com.sun.xml.wss.impl.callback.PasswordCallback;
 import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
 import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
 import com.sun.xml.wss.impl.callback.UsernameCallback;
+
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.ws.soap.saaj.SaajSoapMessage;
-import org.springframework.ws.soap.security.xwss.callback.AbstractCallbackHandler;
+import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
 
-public class XwssMessageInterceptorUsernameTokenTest extends XwssMessageInterceptorTestCase {
+public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessageInterceptorTestCase {
 
     public void testAddUsernameTokenDigest() throws Exception {
         interceptor.setPolicyConfiguration(new ClassPathResource("usernameToken-digest-config.xml", getClass()));
@@ -50,7 +51,7 @@ public class XwssMessageInterceptorUsernameTokenTest extends XwssMessageIntercep
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathEvaluatesTo("Invalid Username", "Bert",
@@ -80,7 +81,7 @@ public class XwssMessageInterceptorUsernameTokenTest extends XwssMessageIntercep
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("empty-soap.xml");
-        interceptor.secureMessage(message);
+        interceptor.secureMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathEvaluatesTo("Invalid Username", "Bert",
@@ -122,7 +123,7 @@ public class XwssMessageInterceptorUsernameTokenTest extends XwssMessageIntercep
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("usernameTokenPlainText-soap.xml");
-        interceptor.validateMessage(message);
+        interceptor.validateMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security", result);
@@ -161,7 +162,7 @@ public class XwssMessageInterceptorUsernameTokenTest extends XwssMessageIntercep
         interceptor.setCallbackHandler(handler);
         interceptor.afterPropertiesSet();
         SaajSoapMessage message = loadSaajMessage("usernameTokenDigest-soap.xml");
-        interceptor.validateMessage(message);
+        interceptor.validateMessage(message, null);
         SOAPMessage result = message.getSaajMessage();
         assertNotNull("No result returned", result);
         assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security", result);

security/src/test/java/org/springframework/ws/soap/security/xwss/callback/CallbackHandlerChainTest.java

@@ -22,6 +22,8 @@ import javax.security.auth.callback.UnsupportedCallbackException;
 
 import junit.framework.TestCase;
 
+import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
+
 public class CallbackHandlerChainTest extends TestCase {
 
     private CallbackHandler supported = new CallbackHandler() {

security/src/test/resources/org/springframework/ws/soap/security/wss4j/echo-response.xml

@@ -0,0 +1,6 @@
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Header/>
+    <SOAP-ENV:Body>
+        <echoResponse xmlns="http://www.springframework.org/spring-ws/samples/echo">Hello</echoResponse>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/empty-soap.xml

@@ -0,0 +1,5 @@
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Body>
+        <tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/encrypted-soap.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
+                   xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+    <SOAP-ENV:Header>
+        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+                       SOAP-ENV:mustUnderstand="1">
+            <xenc:EncryptedKey Id="EncKeyId-25488452" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+                <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
+                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                    <wsse:SecurityTokenReference
+                            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+                        <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                            <ds:X509IssuerSerial xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                                <ds:X509IssuerName
+                                        xmlns:ds="http://www.w3.org/2000/09/xmldsig#">CN=client,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown
+                                </ds:X509IssuerName>
+                                <ds:X509SerialNumber xmlns:ds="http://www.w3.org/2000/09/xmldsig#">1196367787
+                                </ds:X509SerialNumber>
+                            </ds:X509IssuerSerial>
+                        </ds:X509Data>
+                    </wsse:SecurityTokenReference>
+                </ds:KeyInfo>
+                <xenc:CipherData>
+                    <xenc:CipherValue>CtuWCgHBFl1zHdRU70e4aPoRwpMH8GMzWKmywSxdrMz4dS+hOexUu8sY2SUl0jdO+IfL/oNYj4eic7G6utkddKeOCHM8Rj7gtr2Elol2q1ZHXc5N1DUk99t7dYs+XmMU2ULqyGh0T0rmhbABmbxZDB4NzwCBFvXxEUUFFBbN460=</xenc:CipherValue>
+                </xenc:CipherData>
+                <xenc:ReferenceList>
+                    <xenc:DataReference URI="#EncDataId-22297736"/>
+                </xenc:ReferenceList>
+            </xenc:EncryptedKey>
+        </wsse:Security>
+    </SOAP-ENV:Header>
+    <SOAP-ENV:Body>
+        <xenc:EncryptedData Id="EncDataId-22297736" Type="http://www.w3.org/2001/04/xmlenc#Content"
+                            xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+            <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"
+                                   xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
+            <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
+                <xenc:CipherValue
+                        xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">pqzkZJz0/RdUsf8y1z04PvWv48lYtrfmskeW8304PtXD2lXS2iGva5SlL7vc96aA6915zzyld4O0
+                    c+0ISwgvHnharmwatlih/kGfHNY0/LBDidzsbbjrsMWFiq3MLy3x9Sj79pHnChd2BSw9D49kgtUN
+                    W8uIAUxLlsPqdSst9hEq/RYUk0M6mx8HBy2DnE3t36ifrB/1QnY4ohQoMrBARu4HIWidCxhajFSX
+                    i1ZNX8ff4RrD3JUoAlDX6J5zj3+YfxtaaZhoMXRshxAhJwoLidKGlFKN6gsZXqorDJ8ETZ6SdCJ3
+                    O2f4c+WW1xQLUdvt
+                </xenc:CipherValue>
+            </xenc:CipherData>
+        </xenc:EncryptedData>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/signed-soap.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Header>
+        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+                       SOAP-ENV:mustUnderstand="1">
+            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-30541453">
+                <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
+                                               xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+                    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+                                        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+                    <ds:Reference URI="#id-7237831" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                        <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
+                                          xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+                        </ds:Transforms>
+                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
+                                         xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+                        <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">I6X9SMGsJ5sOBL5NUM4H3KMTpc8=
+                        </ds:DigestValue>
+                    </ds:Reference>
+                </ds:SignedInfo>
+                <ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                    DX4XwuzPSkwTXIPKTWKXXf05PWssJjkFUVxg8Joj4OmB6yqDzzTJ1GHRI/3PFZLjoUQq7dL4JqAL
+                    BjcD2lb9ka0c/EILe59QtD1USz1jM8i/zAtNDv3J38yIIHeAp+v/zdT8cNAvG+unwpJvAYMaS34j
+                    mziXbS3/NLMFkroYR3Q=
+                </ds:SignatureValue>
+                <ds:KeyInfo Id="KeyId-23710309" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                    <wsse:SecurityTokenReference
+                            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                            wsu:Id="STRId-970341"
+                            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+                        <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                            <ds:X509IssuerSerial xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                                <ds:X509IssuerName
+                                        xmlns:ds="http://www.w3.org/2000/09/xmldsig#">CN=client,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown
+                                </ds:X509IssuerName>
+                                <ds:X509SerialNumber xmlns:ds="http://www.w3.org/2000/09/xmldsig#">1196367787
+                                </ds:X509SerialNumber>
+                            </ds:X509IssuerSerial>
+                        </ds:X509Data>
+                    </wsse:SecurityTokenReference>
+                </ds:KeyInfo>
+            </ds:Signature>
+        </wsse:Security>
+    </SOAP-ENV:Header>
+    <SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                   wsu:Id="id-7237831">
+        <tns:echoRequest xmlns:tns="http://www.springframework.org/spring-ws/samples/echo">Hello</tns:echoRequest>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/support/merlin.properties

@@ -0,0 +1,6 @@
+org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
+org.apache.ws.security.crypto.merlin.keystore.type=pkcs12
+org.apache.ws.security.crypto.merlin.keystore.password=security
+org.apache.ws.security.crypto.merlin.keystore.alias=16c73ab6-b892-458f-abf5-2f875f74882e
+org.apache.ws.security.crypto.merlin.alias.password=security
+org.apache.ws.security.crypto.merlin.file=org/springframework/ws/soap/security/wss4j/support/x509.PFX.MSFT

security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenDigest-soap.xml

@@ -0,0 +1,25 @@
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Header>
+        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+                       SOAP-ENV:mustUnderstand="1">
+            <wsse:UsernameToken
+                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                    wsu:Id="XWSSGID-1149205720423-1352053129"
+                    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+                <wsse:Username>Bert</wsse:Username>
+                <wsse:Password
+                        Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">kwNstEaiFOrI7B31j7GuETYvdgk=
+                </wsse:Password>
+                <wsse:Nonce
+                        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">9mdsYDCrjjYRur0rxzYt2oD7
+                </wsse:Nonce>
+                <wsu:Created
+                        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2006-06-01T23:48:42Z
+                </wsu:Created>
+            </wsse:UsernameToken>
+        </wsse:Security>
+    </SOAP-ENV:Header>
+    <SOAP-ENV:Body>
+        <tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainText-soap.xml

@@ -0,0 +1,20 @@
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Header>
+        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+                       SOAP-ENV:mustUnderstand="1">
+            <wsse:UsernameToken
+                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                    wsu:Id="XWSSGID-1149200055993710197275"
+                    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+                <wsse:Username>Bert</wsse:Username>
+                <wsse:Password
+                        Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"
+                        >Ernie
+                </wsse:Password>
+            </wsse:UsernameToken>
+        </wsse:Security>
+    </SOAP-ENV:Header>
+    <SOAP-ENV:Body>
+        <tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>

security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextWithHeaders-soap.xml

@@ -0,0 +1,22 @@
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Header>
+        <header1>1</header1>
+        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+                       SOAP-ENV:mustUnderstand="1">
+            <wsse:UsernameToken
+                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                    wsu:Id="XWSSGID-1149200055993710197275"
+                    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+                <wsse:Username>Bert</wsse:Username>
+                <wsse:Password
+                        Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"
+                        >Ernie
+                </wsse:Password>
+            </wsse:UsernameToken>
+        </wsse:Security>
+        <header2>2</header2>
+    </SOAP-ENV:Header>
+    <SOAP-ENV:Body>
+        <tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>