I haev successfully gotten PKI+XACML protected web services to work,
and now I would like to wrap my XACML requests in SAML. Looking over
the code based, it appears my choices are using the STS token server or
I do not think the servlet is the approach I want to take since I already have
a web service that I want to access. That leaves me with the STS token server.
However it looks like the WSTrustClient requires a username/password for
obtaining a token. There does not appear to be a method for sending keys instead
of a password.
Am I stuck writing my own? Thanks for any pointers.
UserName/Cred can be (NULL, Cert) correct? It is left to the token providers to figure out the details?
WSTrustClient is just a utility class for users. You are free to use the JAX-WS direct api.
Since this is a open source project, I do strongly recommend that you add a method to WSTrustClient for keys or generic objects and contribute it back.