title: Specification of SOAP wsdl for UsernameToken
body: <p>I'm writing a client to connect to a SOAP webservice using a WSDL first approach. For implementation I am using Apache CXF version 3.1.4</p>
  
  <p>When testing I get the following exception:</p>
  
  <p><code>12:35:15.492 [main] WARN  o.a.c.w.p.a.w.Wsdl11AttachmentPolicyProvider - Failed to build the policy 'UsernameToken':sp:UsernameToken must have an inner wsp:Policy element
  Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: sp:UsernameToken must have an inner wsp:Policy element
      at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:160)
      at com.sun.proxy.$Proxy36.getPing(Unknown Source)
      ...
  Caused by: java.lang.IllegalArgumentException: sp:UsernameToken must have an inner wsp:Policy element
      at org.apache.wss4j.policy.builders.UsernameTokenBuilder.build(UsernameTokenBuilder.java:52)
      at org.apache.wss4j.policy.builders.UsernameTokenBuilder.build(UsernameTokenBuilder.java:34)
      at org.apache.neethi.AssertionBuilderFactoryImpl.invokeBuilder(AssertionBuilderFactoryImpl.java:138)</code></p>
  
  <p>The relevant part of the WSDL file looks like this:</p>
  
  <p><code>&lt;wsp:Policy wsu:Id="UsernameToken"&gt;
      &lt;wsp:ExactlyOne&gt;
        &lt;wsp:All&gt;
          &lt;sp:SupportingTokens&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"/&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:SupportingTokens&gt;
        &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
    &lt;/wsp:Policy&gt;</code></p>
  
  <p>The error message indicates that CXF expects a policy tag under UsernameToken. And indeed, while researching I came across a <a href="https://issues.apache.org/jira/browse/CXF-5132?focusedCommentId=13709887&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-13709887" rel="nofollow">comment from CXF bug tracker</a>:</p>
  
  <p><em><code>Yes... Per spec, the &lt;sp:UsernameToken&gt; element MUST contain an internal wsp:Policy element. It should look like:
  &lt;sp:UsernameToken
      sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
      &lt;wsp:Policy&gt;
          &lt;sp:WssUsernameToken11 /&gt;
      &lt;/wsp:Policy&gt;
  &lt;/sp:UsernameToken&gt;</code></em></p>
  
  <p>But, <a href="http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf" rel="nofollow">the specification says</a>: </p>
  
  <p><code>/sp:UsernameToken/wsp:Policy
  This optional element identifies additional requirements for use of the
  sp:UsernameToken assertion.</code></p>
  
  <p>Note: Optional.</p>
  
  <p>So which one is it? It seems that CXf requires a policy while the specification says it is optional. Is there another specification I need to look at?</p>