Spring WS-Security with WSS4J

This is a working example of creating a SOAP service with X509 Token profile to sign the request using digital signatures (digSig).

Spring WSS supports two implementations of WS-Security:WSS4J and XWSS, using ClientInterceptor class.

• Wss4jSecurityInterceptor.
• XwsSecurityInterceptor.

To make this sample working yet minimalist, I am using WSS4j which is more portable, additionally other details like trustsstore, Custom SAML assertions, encryption, JAXB/XJC configurations are omitted.

For customizing see; wss4j-config. Below details are implemented in ClientConfig.java.

Signature Identifier Profiles

// X509KeyIdentifier, DirectReference
securityInterceptor.setSecurementSignatureKeyIdentifier("DirectReference");

Security Actions

// Timestamp Signature SAMLTokenSigned SAMLTokenUnsigned
securityInterceptor.setSecurementActions("Timestamp Signature");

Signature Parts

securityInterceptor.setSecurementSignatureParts(
    "{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;" +
        "{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body"

Sample WSS Outgoing Header

Creating keystore

This example will need a java key store (jks) file like which is NOT included, you will need to create it using keytool.

Running this sample

$ mvn clean spring-boot:run

Output-Image

License

The project has been released under the MIT License. Issues and suggestions for this sample are welcome, Tracker