title: Java EE 6 and JAXRPCSecurity
body: <p>I'am trying convert my Java EE 5 (GlassFish v2, Metro 2.1.1) application to Java EE 6 (GlassFish 3.1.2, Metro 2.2.1-1). I have problem with webservice client, which security is based on JAXRPCSecuirty. JAXRPCSecurity configuration:</p>
  
  <pre><code>private final static String SECURITY_CONFIG =
      "&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt; "+
      "&lt;xwss:JAXRPCSecurity xmlns:xwss=\"http://java.sun.com/xml/ns/xwss/config\"&gt;                " +
      "   &lt;xwss:Service&gt;                                                                          " +
      "       &lt;xwss:SecurityConfiguration dumpMessages=\"true\"&gt;                      " +
      "           &lt;xwss:Sign includeTimestamp=\"false\"&gt;                                          " +
      "               &lt;xwss:X509Token certificateAlias=\"certificate_alias\" /&gt;                       " +
      "               &lt;xwss:CanonicalizationMethod disableInclusivePrefix=\"true\" /&gt;             " + 
      "               &lt;xwss:SignatureTarget type=\"xpath\" value=\"//SOAP-ENV:Body\"&gt;             " +
      "                 &lt;xwss:Transform algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"     " +
      "                                 disableInclusivePrefix=\"true\" /&gt;                        " +
      "               &lt;/xwss:SignatureTarget&gt;                                                     " +
      "           &lt;/xwss:Sign&gt;                                                                    " +
      "       &lt;/xwss:SecurityConfiguration&gt;                                                       " +
      "   &lt;/xwss:Service&gt;                                                                         " +
      "   &lt;xwss:SecurityEnvironmentHandler&gt;                                                       " +
      "      SecurityCallbackHandler                                                              " +
      "   &lt;/xwss:SecurityEnvironmentHandler&gt;                                                      " +
      "&lt;/xwss:JAXRPCSecurity&gt;";
  </code></pre>
  
  <p>And how I set this configuration to webservice client:</p>
  
  <pre><code>public void configureSecurity() throws SITAWebServiceException {        
      String JAXRPCSecurityXML = completeJAXRPCSecurityXML(alias, keyStore, callbackHandler, dumpMessage);
  
      byte[] JAXRPCSecurityXMLBytes = convertJAXRPSecurityXMLToBytes(JAXRPCSecurityXML);
  
      XWSSecurityConfiguration sc = createXWSSecurityConfiguration(JAXRPCSecurityXMLBytes);
  
      ((BindingProvider) port).getRequestContext().put(XWSSecurityConfiguration.MESSAGE_SECURITY_CONFIGURATION, sc);      
  }
  
  private XWSSecurityConfiguration createXWSSecurityConfiguration(final byte[] JAXRPCSecurityXML) throws SITAWebServiceException {
      InputStream is = new ByteArrayInputStream(JAXRPCSecurityXML);
      try {
          return new SecurityConfiguration(is);
      } catch (XWSSecurityException e) {
          throw new SITAWebServiceException("XWSSecurityConfiguration problem.", e);
      } finally {
          closeInputStream(is);
      }
  }
  </code></pre>
  
  <p>With GlassFish v2 and Metro 2.1.1, everything works fine. But GlassFish 3 uses OSGi based Metro (webservices-api-osgi and webservice-osgi) and classes from package <em>com.sun.xml.xwss</em> are no longer visible (isn't exproted) so I constantly get this Exception:</p>
  
  <pre><code>java.lang.NoClassDefFoundError: com/sun/xml/xwss/XWSSecurityConfiguration
  </code></pre>
  
  <p>Is there some solution how export package <em>com.sun.xml.xwss</em> or way how to change JAXRPCSecurity to something other/better?</p>
  
  <p>Thanks.</p>