apache CXF @Policy not including in WSDL

Question

I'm writing a code-first web service using Jboss EAP 7 and need to implement WS-Security for username token validation... For this I'm using Apache CXF policies, I managed to make everything work on a contract-first perspective and right now the only thing I need to make it work as a code-first perspective is to include the policy into the generated wsdl... For that I'm using the @org.apache.cxf.annotations.Policy but the code snippet for the policy is not added into the final generated wsdl from Jboss.

here is my code:

...
    @WebService(serviceName = "ExampleService", portName = "ExampleService",
        endpointInterface = "com.company.webservice.ExampleService",
        targetNamespace = "https://service.company.com/company-ws/ExampleService")
    @EndpointConfig(configFile = "WEB-INF/jaxws-endpoint-config.xml",
        configName = "Custom WS-Security Endpoint")
    @Policy(uri = "WEB-INF/company-username-token-policy.xml")
    public class ExampleServiceImpl implements ExampleService { ...

here is the WEB-INF/company-username-token-policy.xml

<?xml version="1.0" encoding="UTF-8" ?>
<wsp:Policy wsu:Id="UsernameTokenPolicy" xmlns:wsp="http://www.w3.org/ns/ws-policy"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:SupportingTokens
                xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
                <wsp:Policy>
                    <sp:UsernameToken
                        sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                            <sp:WssUsernameToken11 />
                        </wsp:Policy>
                    </sp:UsernameToken>
                </wsp:Policy>
            </sp:SupportingTokens>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

my jboss-deployment-structure.xml has these entries already:

<module name="org.apache.ws.security" export="true" />
<module name="org.apache.cxf" export="true" />
<module name="org.apache.cxf.impl" export="true" />

What am I missing here?

score 2 · Answer 1 · answered Jun 22 '17 at 09:41

Figured out the problem...

First: you need to put the policy xml file into the resources folder not the WEB-INF.

Second: you need to add placement = Policy.Placement.BINDING into your @Policy annotation...

@Policy(uri = "company-username-token-policy.xml", placement = Policy.Placement.BINDING)

score -1 · Answer 2 · answered May 10 '19 at 15:04

caution, in out setup the @Policy gets silently ignored for some bindings, e.g. Placement.SERVICE worked, and BINDING too. but any _INCOMING bindings do not apply the Policy during runtime; which causes the service to consume the request without processing/validating the WS sec header part

apache CXF @Policy not including in WSDL

2 Answers2