title: WSSecurityException - An error was discovered processing the <wsse:Security> header
body: <p>I built a <strong>CXF</strong> based soap web service and i was trying to add some security aspects using the WS-Security by following the steps of this tutorial.</p>
  
  <p>I got the <strong>An error was discovered processing the  header</strong></p>
  
  <p>Here are the important classes that add the security aspects to the soap <strong>ws</strong></p>
  
  <p><strong>ServerPasswordCallback.java</strong></p>
  
  <pre><code>    import java.io.IOException;
      import java.util.ResourceBundle;
      import javax.security.auth.callback.Callback;
      import javax.security.auth.callback.CallbackHandler;
      import javax.security.auth.callback.UnsupportedCallbackException;
      import org.apache.wss4j.common.ext.WSPasswordCallback;
  
      public class ServerPasswordCallback implements CallbackHandler {
          private static final String BUNDLE_LOCATION = "auth";
          private static final String PASSWORD_PROPERTY_NAME = "auth.manager.password";
  
          private static String password;
  
          static {
              final ResourceBundle bundle = ResourceBundle.getBundle(BUNDLE_LOCATION);
              password = bundle.getString(PASSWORD_PROPERTY_NAME);
          }
  
          @Override
          public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
              WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
              pc.setPassword(password);
          }
      }
  </code></pre>
  
  <p><strong>ClientPasswordCallback.java</strong></p>
  
  <pre><code>    import java.io.IOException;
      import java.util.ResourceBundle;
      import javax.security.auth.callback.Callback;
      import javax.security.auth.callback.CallbackHandler;
      import javax.security.auth.callback.UnsupportedCallbackException;
      import org.apache.wss4j.common.ext.WSPasswordCallback;
  
  
      public class ClientPasswordCallback implements CallbackHandler {
  
          private static final String BUNDLE_LOCATION = "auth";
          private static final String PASSWORD_PROPERTY_NAME = "auth.manager.password";
          private static String password;
  
          static {
              final ResourceBundle bundle = ResourceBundle.getBundle(BUNDLE_LOCATION);
              password = bundle.getString(PASSWORD_PROPERTY_NAME);
          }
  
          @Override
          public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
              WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
              pc.setPassword(password);
          }
      }
  </code></pre>
  
  <p><strong>AuthServiceFactory.java</strong></p>
  
  <pre><code>    public final class AuthServiceFactory {
  
          private static final ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext(new String[] {
                      "com/company/auth/service/cxfClient.xml"
                  });
  
          public AuthServiceFactory() {
          }
  
          public AuthService getService() {
              return (AuthService) context.getBean("client");
          }
      }
  </code></pre>
  
  <p><strong>auth_fr_FR</strong></p>
  
  <blockquote>
    <p>auth.manager.password=*****</p>
  </blockquote>
  
  <p><strong>cxfClient.xml</strong></p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws"
          xmlns:jaxrs="http://cxf.apache.org/jaxrs"
          xsi:schemaLocation="http://cxf.apache.org/jaxws 
                              http://cxf.apache.org/schemas/jaxws.xsd
                              http://www.springframework.org/schema/beans 
                              http://www.springframework.org/schema/beans/spring-beans.xsd
                              http://cxf.apache.org/jaxrs 
                              http://cxf.apache.org/schemas/jaxrs.xsd"&gt;
  
          &lt;bean id="proxyFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"&gt;
              &lt;property name="serviceClass" value="com.company.auth.service.AuthService" /&gt;
              &lt;property name="address"
                  value="http://localhost:8080/CXFSOAP-WebService/corporateAuth" /&gt;
              &lt;property name="inInterceptors"&gt;
                  &lt;list&gt;
                      &lt;ref bean="logIn" /&gt;
                  &lt;/list&gt;
              &lt;/property&gt;
              &lt;property name="outInterceptors"&gt;
                  &lt;list&gt;
                      &lt;ref bean="logOut" /&gt;
                      &lt;ref bean="saajOut" /&gt;
                      &lt;ref bean="wss4jOut" /&gt;
                  &lt;/list&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
  
          &lt;bean id="client" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"
              factory-bean="proxyFactory" factory-method="create" /&gt;
  
          &lt;bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor" /&gt;
          &lt;bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor" /&gt;
          &lt;bean id="saajOut" class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" /&gt;
          &lt;bean id="wss4jOut" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor"&gt;
              &lt;constructor-arg&gt;
                  &lt;map&gt;
                      &lt;entry key="action" value="UsernameToken" /&gt;
                      &lt;entry key="user" value="ws-client" /&gt;
                      &lt;entry key="passwordType" value="PasswordText" /&gt;
                      &lt;entry key="passwordCallbackClass" value="com.company.auth.service.ClientPasswordCallback" /&gt;
                  &lt;/map&gt;
              &lt;/constructor-arg&gt;
          &lt;/bean&gt;
      &lt;/beans&gt;
  </code></pre>
  
  <p>This file is for the client configuration</p>
  
  <p><strong>beans.xml</strong></p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws"
          xmlns:jaxrs="http://cxf.apache.org/jaxrs"
          xsi:schemaLocation="http://cxf.apache.org/jaxws 
                              http://cxf.apache.org/schemas/jaxws.xsd
                              http://www.springframework.org/schema/beans 
                              http://www.springframework.org/schema/beans/spring-beans.xsd
                              http://cxf.apache.org/jaxrs 
                              http://cxf.apache.org/schemas/jaxrs.xsd"&gt;
  
          &lt;jaxws:endpoint id="bookShelfService"
              implementor="com.company.auth.service.AuthServiceImpl" address="/corporateAuth"&gt;
              &lt;jaxws:inInterceptors&gt;
                  &lt;bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"&gt;&lt;/bean&gt;
                  &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                      &lt;constructor-arg&gt;
                          &lt;map&gt;
                              &lt;entry key="action" value="UsernameToken" /&gt;
                              &lt;entry key="passwordType" value="PasswordText" /&gt;
                              &lt;entry key="passwordCallbackClass" value="com.company.auth.service.ServerPasswordCallback"&gt;&lt;/entry&gt;
                          &lt;/map&gt;
                      &lt;/constructor-arg&gt;
                  &lt;/bean&gt;
              &lt;/jaxws:inInterceptors&gt;
          &lt;/jaxws:endpoint&gt;
  
      &lt;/beans&gt;
  </code></pre>
  
  <p>This file is for the server configuration</p>
  
  <p><strong>Client.java</strong></p>
  
  <pre><code>    import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
      import com.company.auth.bean.Employee;
      import com.company.auth.service.AuthService;
  
      public class Client {
  
          public Client() {
              super();
          }
  
          public static void main(String[] args) {
              JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean();
              factory.setServiceClass(AuthService.class);
              factory.setAddress("http://localhost:8080/CXFSOAP-WebService/corporateAuth");
              AuthService client = (AuthService) factory.create();
              Employee employee = client.getEmployee("22222");
              System.out.println("Server said: "+employee.getLastName()+" "+employee.getFirstName());
              System.exit(0);
          }
      }
  </code></pre>
  
  <p>This is the client code that consumes the soap web service.</p>
  
  <p>before adding the security configuration, the server was up and running and the client consumed the function of the soap api successfully but after the security modification, when the client attempts to use the web service function i get this error</p>
  
  <pre><code>    org.apache.cxf.binding.soap.SoapFault: A security error was encountered when verifying the message
      at org.apache.cxf.ws.security.wss4j.WSS4JUtils.createSoapFault(WSS4JUtils.java:216)
      at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:329)
      at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:184)
      at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:93)
      at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
      at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Thread.java:745)
  </code></pre>
  
  <blockquote>
    <p><strong>Caused by: org.apache.wss4j.common.ext.WSSecurityException: An
    error was discovered processing the  header</strong></p>
  </blockquote>
  
  <pre><code>    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.checkActions(WSS4JInInterceptor.java:370)
      at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:313)
      ... 34 more
  </code></pre>
  
  <p>I tried to manually add some wsse headers in the soap envelope but it didn't work.</p>