title: WSS4j elements order during signing SOAP message
body: <p>I'm implementing web service client in Java which uses wss4j 1.6.8 for WS-Security (to be more precize I need to sign a SOAP message). Server side requires requests to have the following structure:</p>
  
  <pre><code>&lt;Envelope&gt;
      &lt;Header&gt;
          &lt;wsse:Security mustUnderstand="1"&gt;
              **&lt;wsu:Timestamp wsu:Id="Timestamp-913ca68e-05ed-44e1-9d6c-b2f293da5a1d"&gt;
                  &lt;wsu:Created&gt;2012-12-21T11:37:31Z&lt;/wsu:Created&gt;
                  &lt;wsu:Expires&gt;2012-12-21T11:42:31Z&lt;/wsu:Expires&gt;
              &lt;/wsu:Timestamp&gt;**
              &lt;wsse:BinarySecurityToken&gt;
                  MIID2jCCAsKg...
              &lt;/wsse:BinarySecurityToken&gt;
              &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;SignedInfo&gt;
                      &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                      &lt;Reference URI="#Timestamp-913ca68e-05ed-44e1-9d6c-b2f293da5a1d"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                          &lt;DigestValue&gt;jdVY1HaDLusqO9UcxASE/GQHxyo=&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Body-e344eef1-2d8a-42d0-8a30-361ee61a8617"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                          &lt;DigestValue&gt;L60mQelZERvXgLEgWlW50uJNqEA=&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                  &lt;/SignedInfo&gt;
                  &lt;SignatureValue&gt;
                      NmgACUqrYYc/Kp/F...
                  &lt;/SignatureValue&gt;
                  &lt;KeyInfo&gt;
                      &lt;wsse:SecurityTokenReference xmlns=""&gt;
                          &lt;wsse:Reference URI="#SecurityToken-3f054298-711c-4090-95c3-105e1093f3ba" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/KeyInfo&gt;
              &lt;/Signature&gt;
          &lt;/wsse:Security&gt;
      &lt;/S:Header&gt;
      &lt;S:Body&gt;
          Body content...
      &lt;/S:Body&gt;
  &lt;/Envelope&gt;
  </code></pre>
  
  <p>My solution signs the document (both body and timestamp elements) but for some reason wss4j puts timestamp element to the bottom of the  section, after <code>&lt;wsse:BinarySecurityToken&gt;</code> and <code>&lt;Signature&gt;</code> elements what is wrong. Please look at the sources that does signing job:</p>
  
  <pre><code> public static SOAPMessage signSoapMessage(SOAPMessage message, PrivateKey signingKey, X509Certificate signingCert, char[] passphrase) throws WSSecurityException {
  
      final String alias = "signingKey";
      final int signatureValidityTime = 3600; // 1hour in seconds
  
      WSSConfig config = new WSSConfig();
      config.setWsiBSPCompliant(false);
  
      WSSecSignature builder = new WSSecSignature(config);
  
      builder.setX509Certificate(signingCert);
      builder.setUserInfo(alias, new String(passphrase));
      builder.setUseSingleCertificate(true);
      builder.setKeyIdentifierType(WSConstants.BST_DIRECT_REFERENCE);
  
      try {
          Document document = DanskeUtils.toDocument(message);
          WSSecHeader secHeader = new WSSecHeader();
          secHeader.setMustUnderstand(true);
          secHeader.insertSecurityHeader(document);
  
          WSSecTimestamp timestamp = new WSSecTimestamp();
          timestamp.setTimeToLive(signatureValidityTime);
          document = timestamp.build(document, secHeader);
  
          List&lt;WSEncryptionPart&gt; parts = new ArrayList&lt;WSEncryptionPart&gt;();
          WSEncryptionPart timestampPart = new WSEncryptionPart("Timestamp", WSConstants.WSU_NS, "");
          WSEncryptionPart bodyPart = new WSEncryptionPart(WSConstants.ELEM_BODY, WSConstants.URI_SOAP11_ENV, "");
          parts.add(timestampPart);
          parts.add(bodyPart);
          builder.setParts(parts);
  
          Properties properties = new Properties();
          properties.setProperty("org.apache.ws.security.crypto.provider", "org.apache.ws.security.components.crypto.Merlin");
          Crypto crypto = CryptoFactory.getInstance(properties);
          KeyStore keystore = KeyStore.getInstance("JKS");
          keystore.load(null, passphrase);
          keystore.setKeyEntry(alias, signingKey, passphrase, new Certificate[]{signingCert});
          ((Merlin) crypto).setKeyStore(keystore);
          crypto.loadCertificate(new ByteArrayInputStream(signingCert.getEncoded()));
  
          document = builder.build(document, crypto, secHeader);
          return Utils.updateSoapMessage(document, message);
      } catch (Exception e) {
          throw new WSSecurityException(WSSecurityException.Reason.SIGNING_ISSUE, e);
      }
  }
  </code></pre>
  
  <p>Could you please help me to clarify how to change the order of elements before document will be sign? 
  Thank you!</p>