WSSecurityException - An error was discovered processing the <wsse:Security> header
<p>I built a <strong>CXF</strong> based soap web service and i was trying to add some security aspects using the WS-Security by following the steps of this tutorial.</p>

<p>I got the <strong>An error was discovered processing the  header</strong></p>

<p>Here are the important classes that add the security aspects to the soap <strong>ws</strong></p>

<p><strong>ServerPasswordCallback.java</strong></p>

<pre><code>    import java.io.IOException;
    import java.util.ResourceBundle;
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.callback.UnsupportedCallbackException;
    import org.apache.wss4j.common.ext.WSPasswordCallback;

    public class ServerPasswordCallback implements CallbackHandler {
        private static final String BUNDLE_LOCATION = "auth";
        private static final String PASSWORD_PROPERTY_NAME = "auth.manager.password";

        private static String password;

        static {
            final ResourceBundle bundle = ResourceBundle.getBundle(BUNDLE_LOCATION);
            password = bundle.getString(PASSWORD_PROPERTY_NAME);
        }

        @Override
        public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
            WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
            pc.setPassword(password);
        }
    }
</code></pre>

<p><strong>ClientPasswordCallback.java</strong></p>

<pre><code>    import java.io.IOException;
    import java.util.ResourceBundle;
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.callback.UnsupportedCallbackException;
    import org.apache.wss4j.common.ext.WSPasswordCallback;


    public class ClientPasswordCallback implements CallbackHandler {

        private static final String BUNDLE_LOCATION = "auth";
        private static final String PASSWORD_PROPERTY_NAME = "auth.manager.password";
        private static String password;

        static {
            final ResourceBundle bundle = ResourceBundle.getBundle(BUNDLE_LOCATION);
            password = bundle.getString(PASSWORD_PROPERTY_NAME);
        }

        @Override
        public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
            WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
            pc.setPassword(password);
        }
    }
</code></pre>

<p><strong>AuthServiceFactory.java</strong></p>

<pre><code>    public final class AuthServiceFactory {

        private static final ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext(new String[] {
                    "com/company/auth/service/cxfClient.xml"
                });

        public AuthServiceFactory() {
        }

        public AuthService getService() {
            return (AuthService) context.getBean("client");
        }
    }
</code></pre>

<p><strong>auth_fr_FR</strong></p>

<blockquote>
  <p>auth.manager.password=*****</p>
</blockquote>

<p><strong>cxfClient.xml</strong></p>

<pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
    &lt;beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws"
        xmlns:jaxrs="http://cxf.apache.org/jaxrs"
        xsi:schemaLocation="http://cxf.apache.org/jaxws 
                            http://cxf.apache.org/schemas/jaxws.xsd
                            http://www.springframework.org/schema/beans 
                            http://www.springframework.org/schema/beans/spring-beans.xsd
                            http://cxf.apache.org/jaxrs 
                            http://cxf.apache.org/schemas/jaxrs.xsd"&gt;

        &lt;bean id="proxyFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"&gt;
            &lt;property name="serviceClass" value="com.company.auth.service.AuthService" /&gt;
            &lt;property name="address"
                value="http://localhost:8080/CXFSOAP-WebService/corporateAuth" /&gt;
            &lt;property name="inInterceptors"&gt;
                &lt;list&gt;
                    &lt;ref bean="logIn" /&gt;
                &lt;/list&gt;
            &lt;/property&gt;
            &lt;property name="outInterceptors"&gt;
                &lt;list&gt;
                    &lt;ref bean="logOut" /&gt;
                    &lt;ref bean="saajOut" /&gt;
                    &lt;ref bean="wss4jOut" /&gt;
                &lt;/list&gt;
            &lt;/property&gt;
        &lt;/bean&gt;

        &lt;bean id="client" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"
            factory-bean="proxyFactory" factory-method="create" /&gt;

        &lt;bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor" /&gt;
        &lt;bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor" /&gt;
        &lt;bean id="saajOut" class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" /&gt;
        &lt;bean id="wss4jOut" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor"&gt;
            &lt;constructor-arg&gt;
                &lt;map&gt;
                    &lt;entry key="action" value="UsernameToken" /&gt;
                    &lt;entry key="user" value="ws-client" /&gt;
                    &lt;entry key="passwordType" value="PasswordText" /&gt;
                    &lt;entry key="passwordCallbackClass" value="com.company.auth.service.ClientPasswordCallback" /&gt;
                &lt;/map&gt;
            &lt;/constructor-arg&gt;
        &lt;/bean&gt;
    &lt;/beans&gt;
</code></pre>

<p>This file is for the client configuration</p>

<p><strong>beans.xml</strong></p>

<pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
    &lt;beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws"
        xmlns:jaxrs="http://cxf.apache.org/jaxrs"
        xsi:schemaLocation="http://cxf.apache.org/jaxws 
                            http://cxf.apache.org/schemas/jaxws.xsd
                            http://www.springframework.org/schema/beans 
                            http://www.springframework.org/schema/beans/spring-beans.xsd
                            http://cxf.apache.org/jaxrs 
                            http://cxf.apache.org/schemas/jaxrs.xsd"&gt;

        &lt;jaxws:endpoint id="bookShelfService"
            implementor="com.company.auth.service.AuthServiceImpl" address="/corporateAuth"&gt;
            &lt;jaxws:inInterceptors&gt;
                &lt;bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"&gt;&lt;/bean&gt;
                &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                    &lt;constructor-arg&gt;
                        &lt;map&gt;
                            &lt;entry key="action" value="UsernameToken" /&gt;
                            &lt;entry key="passwordType" value="PasswordText" /&gt;
                            &lt;entry key="passwordCallbackClass" value="com.company.auth.service.ServerPasswordCallback"&gt;&lt;/entry&gt;
                        &lt;/map&gt;
                    &lt;/constructor-arg&gt;
                &lt;/bean&gt;
            &lt;/jaxws:inInterceptors&gt;
        &lt;/jaxws:endpoint&gt;

    &lt;/beans&gt;
</code></pre>

<p>This file is for the server configuration</p>

<p><strong>Client.java</strong></p>

<pre><code>    import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
    import com.company.auth.bean.Employee;
    import com.company.auth.service.AuthService;

    public class Client {

        public Client() {
            super();
        }

        public static void main(String[] args) {
            JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean();
            factory.setServiceClass(AuthService.class);
            factory.setAddress("http://localhost:8080/CXFSOAP-WebService/corporateAuth");
            AuthService client = (AuthService) factory.create();
            Employee employee = client.getEmployee("22222");
            System.out.println("Server said: "+employee.getLastName()+" "+employee.getFirstName());
            System.exit(0);
        }
    }
</code></pre>

<p>This is the client code that consumes the soap web service.</p>

<p>before adding the security configuration, the server was up and running and the client consumed the function of the soap api successfully but after the security modification, when the client attempts to use the web service function i get this error</p>

<pre><code>    org.apache.cxf.binding.soap.SoapFault: A security error was encountered when verifying the message
    at org.apache.cxf.ws.security.wss4j.WSS4JUtils.createSoapFault(WSS4JUtils.java:216)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:329)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:184)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:93)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)
</code></pre>

<blockquote>
  <p><strong>Caused by: org.apache.wss4j.common.ext.WSSecurityException: An
  error was discovered processing the  header</strong></p>
</blockquote>

<pre><code>    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.checkActions(WSS4JInInterceptor.java:370)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:313)
    ... 34 more
</code></pre>

<p>I tried to manually add some wsse headers in the soap envelope but it didn't work.</p>