WS Policy with Apache CXF 3.0
<p>Trying to implement <code>WS-Policy</code> within <code>WSDL</code>. </p>

<p><strong>There is my configurations:</strong></p>

<p><code>WS-Policy</code> within <code>WSDL</code>:</p>

<pre><code>

    &lt;wsp:Policy wsu:Id=&quot;Signature&quot;&gt;
        &lt;wsp:ExactlyOne&gt;
            &lt;wsp:All&gt;
                &lt;sp:AsymmetricBinding&gt;
                    &lt;wsp:Policy&gt;
                        &lt;sp:InitiatorToken&gt;
                            &lt;wsp:Policy&gt;
                                &lt;sp:X509Token sp:IncludeToken=
                                                      &quot;http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient&quot;&gt;
                                    &lt;wsp:Policy&gt;
                                        &lt;sp:WssX509V3Token10 /&gt;
                                    &lt;/wsp:Policy&gt;
                                &lt;/sp:X509Token&gt;
                            &lt;/wsp:Policy&gt;
                        &lt;/sp:InitiatorToken&gt;
                        &lt;sp:RecipientToken&gt;
                            &lt;wsp:Policy&gt;
                                &lt;sp:X509Token sp:IncludeToken=
                                                      &quot;http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never&quot;&gt;
                                    &lt;wsp:Policy&gt;
                                        &lt;sp:WssX509V3Token10 /&gt;
                                    &lt;/wsp:Policy&gt;
                                &lt;/sp:X509Token&gt;
                            &lt;/wsp:Policy&gt;
                        &lt;/sp:RecipientToken&gt;
                        &lt;sp:AlgorithmSuite&gt;
                            &lt;wsp:Policy&gt;
                                &lt;sp:TripleDesRsa15/&gt;
                            &lt;/wsp:Policy&gt;
                        &lt;/sp:AlgorithmSuite&gt;
                        &lt;sp:Layout&gt;
                            &lt;wsp:Policy&gt;
                                &lt;sp:LaxTsFirst /&gt;
                            &lt;/wsp:Policy&gt;
                        &lt;/sp:Layout&gt;
                        &lt;sp:IncludeTimestamp /&gt;
                        &lt;sp:OnlySignEntireHeadersAndBody /&gt;
                    &lt;/wsp:Policy&gt;
                &lt;/sp:AsymmetricBinding&gt;
                &lt;sp:SignedParts&gt;
                    &lt;sp:Body /&gt;
                &lt;/sp:SignedParts&gt;
            &lt;/wsp:All&gt;
        &lt;/wsp:ExactlyOne&gt;
    &lt;/wsp:Policy&gt;

</code></pre>

<p><code>CXF</code> configuration:</p>

<pre><code>

    EndpointImpl endpoint = new EndpointImpl(bus, service);
    endpoint.setWsdlLocation(&quot;classpath:/wsdl/ws.wsdl&quot;);
    endpoint.setProperties(new HashMap&lt;String, Object&gt;() {
        {
            put(&quot;ws-security.signature.validator&quot;, customSignatureValidator);
            put(&quot;ws-security.signature.properties&quot;, new Properties() {{
                put(&quot;org.apache.ws.security.crypto.provider&quot;, &quot;org.apache.ws.security.components.crypto.Merlin&quot;);
                put(&quot;org.apache.ws.security.crypto.merlin.keystore.type&quot;, &quot;jks&quot;);
                put(&quot;org.apache.ws.security.crypto.merlin.keystore.password&quot;, keystorePassword);
                put(&quot;org.apache.ws.security.crypto.merlin.file&quot;, keystorePath);
            }});
            put(&quot;ws-security.signature.username&quot;, privateKeyName);
            put(&quot;ws-security.callback-handler&quot;, (CallbackHandler) callbacks -&gt; {
                WSPasswordCallback passwordCallback = (WSPasswordCallback) callbacks[0];

                passwordCallback.setPassword(privateKeyPassword);
            });
        }
    });
    endpoint.publish(&quot;/ws&quot;);

</code></pre>

<p><strong>Problem:</strong></p>

<p>After sending <code>SOAP</code> request with timestamp, signature key information etc. I'm getting <code>SOAP</code> fault message:</p>

<pre>
    These policy alternatives can not be satisfied: 
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}AsymmetricBinding: Received Timestamp does not match the requirements
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}InitiatorToken
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}RecipientToken
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}IncludeTimestamp
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}OnlySignEntireHeadersAndBody
</pre>

<p>Error appears even if I'm not sending timestamp. According logs (<code>CXF</code>) I see that signature is correct.</p>