title: Problems connecting to WSE3 service with usernameForCertifcate policy using Metro
body: <p>I am connecting to a WSE3 service and have been battling for more than a week now using Metro 2.1.1. Part of the problem is that the wsdl did not contain the policy assertions and the guys at the other end used a turnkey usernameForCertifcate policy which I list below. The metro message looks similar to their sample, except for some different ordering and a few other cosmetic things (like metro adds xsi:type="KeyInfoType").</p>
  
  <p>The problem I get when using metro is:</p>
  
  <p><strong>"Referenced security token could not be retrieved ---> WSE590: Failed to resolve the following Key Info"</strong></p>
  
  <pre><code>&lt;faultstring&gt;
      Referenced security token could not be retrieved ---&gt; WSE590: Failed to resolve the following Key Info
      &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;wsse:Reference URI="#_4" /&gt;
          &lt;/wsse:SecurityTokenReference&gt;
      &lt;/KeyInfo&gt;
  &lt;/faultstring&gt;
  </code></pre>
  
  <p>I am able to send a sample message of their's successfully with JMeter. So I did the following as well, as a last resort hack as this project hinges on this. I take their message as a template and replace the encrypted and signed data with what is generated by metro. This manages to get past password authentication, but then fails with this:</p>
  
  <p><strong>"The signature or decryption was invalid"</strong></p>
  
  <p>That's the only detail I get and am not sure if more logging could be enabled on their side...</p>
  
  <h3>Microsoft policy:</h3>
  
  <pre><code>&lt;policy name="AspectClientPolicy"&gt;
    &lt;usernameForCertificateSecurity establishSecurityContext="false" renewExpiredSecurityContext="true" requireSignatureConfirmation="false" messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true" ttlInSeconds="300"&gt;
      &lt;serviceToken&gt;
        &lt;x509 storeLocation="LocalMachine" storeName="My" findValue="CN=AspectWS2" findType="FindBySubjectDistinguishedName" /&gt;
      &lt;/serviceToken&gt;
      &lt;protection&gt;
        &lt;request signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="true" /&gt;
        &lt;response signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="true" /&gt;
        &lt;fault signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="false" /&gt;
      &lt;/protection&gt;
    &lt;/usernameForCertificateSecurity&gt;
    &lt;requireActionHeader /&gt;
  &lt;/policy&gt;
  </code></pre>
  
  <h3>WSDL additions:</h3>
  
  <pre><code>&lt;wsp:Policy wsu:Id="ClientKeystorePolicy" 
    xmlns:sc="http://schemas.sun.com/2006/03/wss/client" 
    xmlns:wspp="http://java.sun.com/xml/ns/wsit/policy" 
    xmlns:scc="http://schemas.sun.com/ws/2006/05/sc/client" &gt;
      &lt;wsp:ExactlyOne&gt;
          &lt;wsp:All&gt;
              &lt;sunsp:DisableInclusivePrefixList xmlns:sunsp="http://schemas.sun.com/2006/03/wss/client"&gt;&lt;/sunsp:DisableInclusivePrefixList&gt; 
              &lt;sc:TrustStore wspp:visibility="private" storepass="XXX" type="JKS" location="XXX"  peeralias="XXX"/&gt;
          &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
  &lt;/wsp:Policy&gt;
  
  &lt;wsp:Policy wsu:Id="UserNameForCertificate_policy"&gt;
      &lt;wsp:ExactlyOne&gt;
          &lt;wsp:All&gt;
              &lt;sp:SymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:ProtectionToken&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never"&gt;
                                  &lt;wsp:Policy&gt;
                                      &lt;sp:RequireDerivedKeys /&gt;
                                      &lt;sp:RequireThumbprintReference /&gt;
                                      &lt;sp:WssX509V3Token10 /&gt;
                                  &lt;/wsp:Policy&gt;
                              &lt;/sp:X509Token&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:ProtectionToken&gt;
                      &lt;sp:AlgorithmSuite&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:Basic256 /&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:AlgorithmSuite&gt;
                      &lt;sp:Layout&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:Strict /&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:Layout&gt;
                      &lt;sp:IncludeTimestamp /&gt;
                      &lt;!-- Have tried with and without this following element /--&gt;
                      &lt;!-- sp:EncryptSignature /--&gt;
                      &lt;sp:SignBeforeEncrypting /&gt;
                      &lt;!-- Have tried with and without this following element /--&gt;
                      &lt;sp:OnlySignEntireHeadersAndBody /&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:SymmetricBinding&gt;
              &lt;sp:SignedEncryptedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:WssUsernameToken10 /&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:UsernameToken&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:SignedEncryptedSupportingTokens&gt;
              &lt;sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:MustSupportRefKeyIdentifier /&gt;
                      &lt;sp:MustSupportRefIssuerSerial /&gt;
                      &lt;sp:MustSupportRefThumbprint /&gt;
                      &lt;sp:MustSupportRefEncryptedKey /&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:Wss11&gt;
              &lt;sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:MustSupportIssuedTokens /&gt;
                      &lt;sp:RequireClientEntropy /&gt;
                      &lt;sp:RequireServerEntropy /&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:Trust13&gt;
                 &lt;sp:EncryptedParts&gt;
                      &lt;sp:Body /&gt;
                  &lt;/sp:EncryptedParts&gt;
                  &lt;sp:SignedParts&gt;
                      &lt;sp:Body/&gt;
                      &lt;sp:Header Namespace="http://schemas.xmlsoap.org/ws/2004/08/addressing"/&gt;
                  &lt;/sp:SignedParts&gt;
          &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
  &lt;/wsp:Policy&gt;
  </code></pre>
  
  <h3>Metro message:</h3>
  
  <pre><code>&lt;?xml version='1.0' encoding='UTF-8'?&gt;
  &lt;S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:wsc="http://schemas.xmlsoap.org/ws/2005/02/sc"
      xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
      &lt;S:Header&gt;
          &lt;To xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" wsu:Id="_5004"&gt;XXX&lt;/To&gt;
          &lt;Action xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" wsu:Id="_5005"&gt;XXX&lt;/Action&gt;
          &lt;ReplyTo xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" wsu:Id="_5006"&gt;
              &lt;Address&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/Address&gt;
          &lt;/ReplyTo&gt;
          &lt;MessageID xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" wsu:Id="_5007"&gt;uuid:145a0194-dd4e-40fe-a7f3-9785885bae37&lt;/MessageID&gt;
          &lt;wsse:Security S:mustUnderstand="1"&gt;
              &lt;wsu:Timestamp xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" wsu:Id="_5"&gt;
                  &lt;wsu:Created&gt;2011-09-08T13:08:45Z&lt;/wsu:Created&gt;
                  &lt;wsu:Expires&gt;2011-09-08T13:13:45Z&lt;/wsu:Expires&gt;
              &lt;/wsu:Timestamp&gt;
              &lt;xenc:EncryptedKey xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" Id="_5002"&gt;
                  &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /&gt;
                  &lt;ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="KeyInfoType"&gt;
                      &lt;wsse:SecurityTokenReference&gt;
                          &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;XXX
                          &lt;/wsse:KeyIdentifier&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/ds:KeyInfo&gt;
                  &lt;xenc:CipherData&gt;
                      &lt;xenc:CipherValue&gt;XXX
                      &lt;/xenc:CipherValue&gt;
                  &lt;/xenc:CipherData&gt;
              &lt;/xenc:EncryptedKey&gt;
              &lt;ns19:DerivedKeyToken xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" wsu:Id="_3"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#_5002" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
                  &lt;ns19:Offset&gt;0&lt;/ns19:Offset&gt;
                  &lt;ns19:Length&gt;24&lt;/ns19:Length&gt;
                  &lt;ns19:Nonce&gt;XXX&lt;/ns19:Nonce&gt;
              &lt;/ns19:DerivedKeyToken&gt;
              &lt;ns19:DerivedKeyToken xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" wsu:Id="_4"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#_5002" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
                  &lt;ns19:Offset&gt;0&lt;/ns19:Offset&gt;
                  &lt;ns19:Length&gt;32&lt;/ns19:Length&gt;
                  &lt;ns19:Nonce&gt;XXX&lt;/ns19:Nonce&gt;
              &lt;/ns19:DerivedKeyToken&gt;
              &lt;xenc:ReferenceList xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope"&gt;
                  &lt;xenc:DataReference URI="#_5010" /&gt;
                  &lt;xenc:DataReference URI="#_5011" /&gt;
              &lt;/xenc:ReferenceList&gt;
              &lt;xenc:EncryptedData xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" Id="_5011"
                  Type="http://www.w3.org/2001/04/xmlenc#Element"&gt;
                  &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /&gt;
                  &lt;ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="KeyInfoType"&gt;
                      &lt;wsse:SecurityTokenReference&gt;
                          &lt;wsse:Reference URI="#_4" /&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/ds:KeyInfo&gt;
                  &lt;xenc:CipherData&gt;
                      &lt;xenc:CipherValue&gt;XXX
                      &lt;/xenc:CipherValue&gt;
                  &lt;/xenc:CipherData&gt;
              &lt;/xenc:EncryptedData&gt;
              &lt;ds:Signature xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" Id="_1"&gt;
                  &lt;ds:SignedInfo&gt;
                      &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                      &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1" /&gt;
                      &lt;ds:Reference URI="#_5004"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#_5005"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#_5006"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#_5007"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#_5008"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#_5"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#uuid_cb40a9a9-d60d-474a-8d1a-0f59e167de38"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;XXX&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                  &lt;/ds:SignedInfo&gt;
                  &lt;ds:SignatureValue&gt;XXX&lt;/ds:SignatureValue&gt;
                  &lt;ds:KeyInfo&gt;
                      &lt;wsse:SecurityTokenReference wsu:Id="_5003"&gt;
                          &lt;wsse:Reference URI="#_3" /&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/ds:KeyInfo&gt;
              &lt;/ds:Signature&gt;
          &lt;/wsse:Security&gt;
      &lt;/S:Header&gt;
      &lt;S:Body wsu:Id="_5008"&gt;
          &lt;xenc:EncryptedData xmlns:ns19="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns18="http://www.w3.org/2003/05/soap-envelope" Id="_5010"
              Type="http://www.w3.org/2001/04/xmlenc#Content"&gt;
              &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /&gt;
              &lt;ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="KeyInfoType"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#_4" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
              &lt;/ds:KeyInfo&gt;
              &lt;xenc:CipherData&gt;
                  &lt;xenc:CipherValue&gt;XXX
                  &lt;/xenc:CipherValue&gt;
              &lt;/xenc:CipherData&gt;
          &lt;/xenc:EncryptedData&gt;
      &lt;/S:Body&gt;
  &lt;/S:Envelope&gt;
  </code></pre>
  
  <h3>Their message:</h3>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
      xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
      &lt;soap:Header&gt;
          &lt;wsa:Action wsu:Id="Id-d330500d-f6c7-44f1-9c41-366a8b113c8b"&gt;XXX&lt;/wsa:Action&gt;
          &lt;wsa:MessageID wsu:Id="Id-5eb5d564-1594-4f15-ab0a-6e8aec86cdc0"&gt;urn:uuid:315cae87-7f8b-4ec0-9875-2fcf81594ccb&lt;/wsa:MessageID&gt;
          &lt;wsa:ReplyTo wsu:Id="Id-1fb4bfa4-5c16-494e-8f7d-ad0370e00138"&gt;
              &lt;wsa:Address&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:Address&gt;
          &lt;/wsa:ReplyTo&gt;
          &lt;wsa:To wsu:Id="Id-70bd8ebf-580e-424a-86bb-3a64ce02d29a"&gt;XXX&lt;/wsa:To&gt;
          &lt;wsse:Security soap:mustUnderstand="1"&gt;
              &lt;wsu:Timestamp wsu:Id="Timestamp-1a34bff5-908b-4310-8d32-7dad291991ad"&gt;
                  &lt;wsu:Created&gt;2011-09-06T13:34:56Z&lt;/wsu:Created&gt;
                  &lt;wsu:Expires&gt;2011-09-06T13:39:56Z&lt;/wsu:Expires&gt;
              &lt;/wsu:Timestamp&gt;
              &lt;xenc:EncryptedKey Id="SecurityToken-047d4682-02bd-424f-9c2d-b4f75b5eb8d7" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                  &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"&gt;
                      &lt;ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                  &lt;/xenc:EncryptionMethod&gt;
                  &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                      &lt;wsse:SecurityTokenReference&gt;
                          &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;XXX&lt;/wsse:KeyIdentifier&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/KeyInfo&gt;
                  &lt;xenc:CipherData&gt;
                      &lt;xenc:CipherValue&gt;XXX
                  &lt;/xenc:CipherData&gt;
              &lt;/xenc:EncryptedKey&gt;
              &lt;wssc:DerivedKeyToken wsu:Id="SecurityToken-856faf50-7736-41c1-b636-66616a1fb84f" Algorithm="http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1" xmlns:wssc="http://schemas.xmlsoap.org/ws/2005/02/sc"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#SecurityToken-047d4682-02bd-424f-9c2d-b4f75b5eb8d7" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
                  &lt;wssc:Generation&gt;0&lt;/wssc:Generation&gt;
                  &lt;wssc:Length&gt;32&lt;/wssc:Length&gt;
                  &lt;wssc:Label&gt;WS-SecureConversationWS-SecureConversation&lt;/wssc:Label&gt;
                  &lt;wssc:Nonce&gt;XXX&lt;/wssc:Nonce&gt;
              &lt;/wssc:DerivedKeyToken&gt;
              &lt;xenc:ReferenceList xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                  &lt;xenc:DataReference URI="#Enc-519e1e55-9407-4401-a92d-ebcf737b4669" /&gt;
                  &lt;xenc:DataReference URI="#Enc-6805eb5a-4c80-4bcc-9e21-1fc63051021c" /&gt;
              &lt;/xenc:ReferenceList&gt;
              &lt;xenc:EncryptedData Id="Enc-519e1e55-9407-4401-a92d-ebcf737b4669" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                  &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /&gt;
                  &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                      &lt;wsse:SecurityTokenReference&gt;
                          &lt;wsse:Reference URI="#SecurityToken-856faf50-7736-41c1-b636-66616a1fb84f" ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/dk" /&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/KeyInfo&gt;
                  &lt;xenc:CipherData&gt;
                      &lt;xenc:CipherValue&gt;XXX&lt;/xenc:CipherValue&gt;
                  &lt;/xenc:CipherData&gt;
              &lt;/xenc:EncryptedData&gt;
              &lt;wssc:DerivedKeyToken wsu:Id="SecurityToken-97b849c3-bf59-4b9d-93af-90673b5cc8cb" Algorithm="http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1" xmlns:wssc="http://schemas.xmlsoap.org/ws/2005/02/sc"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#SecurityToken-047d4682-02bd-424f-9c2d-b4f75b5eb8d7" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
                  &lt;wssc:Generation&gt;0&lt;/wssc:Generation&gt;
                  &lt;wssc:Length&gt;24&lt;/wssc:Length&gt;
                  &lt;wssc:Label&gt;WS-SecureConversationWS-SecureConversation&lt;/wssc:Label&gt;
                  &lt;wssc:Nonce&gt;XXX&lt;/wssc:Nonce&gt;
              &lt;/wssc:DerivedKeyToken&gt;
              &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;SignedInfo&gt;
                      &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" /&gt;
                      &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1" /&gt;
                      &lt;Reference URI="#SecurityToken-940d8767-aff0-4f07-9a10-ed501106dc74"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Id-d330500d-f6c7-44f1-9c41-366a8b113c8b"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Id-5eb5d564-1594-4f15-ab0a-6e8aec86cdc0"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Id-1fb4bfa4-5c16-494e-8f7d-ad0370e00138"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Id-70bd8ebf-580e-424a-86bb-3a64ce02d29a"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Timestamp-1a34bff5-908b-4310-8d32-7dad291991ad"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                      &lt;Reference URI="#Id-93c6fa92-cc95-4d14-abd6-41c27568b004"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;DigestValue&gt;XXX&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                  &lt;/SignedInfo&gt;
                  &lt;SignatureValue&gt;XXX&lt;/SignatureValue&gt;
                  &lt;KeyInfo&gt;
                      &lt;wsse:SecurityTokenReference&gt;
                          &lt;wsse:Reference URI="#SecurityToken-97b849c3-bf59-4b9d-93af-90673b5cc8cb" ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/dk" /&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/KeyInfo&gt;
              &lt;/Signature&gt;
          &lt;/wsse:Security&gt;
      &lt;/soap:Header&gt;
      &lt;soap:Body wsu:Id="Id-93c6fa92-cc95-4d14-abd6-41c27568b004"&gt;
          &lt;xenc:EncryptedData Id="Enc-6805eb5a-4c80-4bcc-9e21-1fc63051021c" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
              &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /&gt;
              &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;wsse:SecurityTokenReference&gt;
                      &lt;wsse:Reference URI="#SecurityToken-856faf50-7736-41c1-b636-66616a1fb84f" ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/dk" /&gt;
                  &lt;/wsse:SecurityTokenReference&gt;
              &lt;/KeyInfo&gt;
              &lt;xenc:CipherData&gt;
                  &lt;xenc:CipherValue&gt;XXX&lt;/xenc:CipherValue&gt;
              &lt;/xenc:CipherData&gt;
          &lt;/xenc:EncryptedData&gt;
      &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>
  
  <p>Oh and I realize WSE3 is obsolete...</p>