SignedSupportingTokens wssecurity policy cxf client

Question

I'm trying to put together a small CXF client for a soap service which is having SignedSupportingTokens ws-security policy in its wsdl. I have configured CXF client as follows

<jaxws:client id="secretService" name="{http:/mySecretServiceEndpoint//}Service" createdFromAPI="true">
        <jaxws:properties>
            <entry key="ws-security.signature.properties" value="keystore/secret.properties" />
            <entry key="ws-security.encryption.properties" value="keystore/secret.properties" />
            <entry key="ws-security.timestamp.timeToLive" value="600" />
        </jaxws:properties>
    </jaxws:client>

Unfortunately it fails to send out messages with following error.

Caused by: org.apache.cxf.ws.policy.PolicyException: None of the policy alternatives can be satisfied.
    at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(EffectivePolicyImpl.java:199)
    at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(EffectivePolicyImpl.java:192)
    at org.apache.cxf.ws.policy.EffectivePolicyImpl.initialise(EffectivePolicyImpl.java:96)
    at org.apache.cxf.ws.policy.PolicyEngineImpl.getEffectiveClientRequestPolicy(PolicyEngineImpl.java:205)
    at org.apache.cxf.ws.policy.PolicyOutInterceptor.handle(PolicyOutInterceptor.java:98)
    at org.apache.cxf.ws.policy.AbstractPolicyInterceptor.handleMessage(AbstractPolicyInterceptor.java:44)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:326)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:279)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:138)

I was wondering if CXF supports SignedSupportingTokens policy by default? Do I need to register some handlers or am I missing something else? I don't have much experience with WS-Security and WS-SecurityPolicy, any response will be highly appreciated.

Answer 1

Answering my own question as it might help somebody someday! CXF does supports SignedSupportingTokens and a lot more, In my case, service WSDL was having a different namespace for SignedSupportingTokens which CXF client dint understand (couldn't match up).

I was able to fix the issue by using ws-security interceptors to configure the client.