It seems that we use the standard jaxrpc/jaxws properties as WSSE username token
if (opConfig.getUsername() != null)
{
Object user = ctx.get(Stub.USERNAME_PROPERTY);
Object pass = ctx.get(Stub.PASSWORD_PROPERTY);
if (user == null && pass == null)
{
user = ctx.get(BindingProvider.USERNAME_PROPERTY);
pass = ctx.get(BindingProvider.PASSWORD_PROPERTY);
}
if (user != null && pass != null)
{
operations.add(new OperationDescription<EncodingOperation>(SendUsernameOperation.class, null, user.toString(), pass.toString(), null));
ctx.put(StubExt.PROPERTY_AUTH_TYPE, StubExt.PROPERTY_AUTH_TYPE_WSSE);
}
}
The side effect is that the wsse username token will always be sent via BASIC auth.
Is this by design? I thought the wsse username token is independent of transport security.
