title: Implementing password digest for ws-security UsernameToken in Java
body: <p>I am trying to make a call to a ws-security secured webservice from a server which unfortunately does not support this natively. The approach I have taken is to implement a .jsp which acts as reverse proxy to the actual end point URL, in the process adding the  element with ws-security elements.</p>
  
  <p>This seems to be working quite well and I am confident I've constructed the XML correctly with the correct namespaces etc. I've verified this by comparing the XML with XML produced by SOAP-UI.</p>
  
  <p>The problem is in implementing the password digest generator. I don't get the same result as what SOAP-UI does using the same inputs for NOnce, xsd:dateTime and password, and the following code.</p>
  
  <pre><code>StringBuffer passwordDigestStr_ = new StringBuffer();
  
  // First append the NOnce from the SOAP header
  passwordDigestStr_.append(Base64.decode("PzlbwtWRpmFWjG0JRIRn7A=="));
  
  // Then append the xsd:dateTime in UTC timezone
  passwordDigestStr_.append("2012-06-09T18:41:03.640Z");
  
  // Finally append the password/secret
  passwordDigestStr_.append("password");
  
  System.out.println("Generated password digest: " + new String(com.bea.xbean.util.Base64.encode(org.apache.commons.codec.digest.DigestUtils.sha(passwordDigestStr_.toString())), "UTF-8"));
  </code></pre>
  
  <p>I think the problem is with implementing the hashing of the first two elements as explained by <a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0.pdf" rel="nofollow">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0.pdf</a></p>
  
  <blockquote>
    <p>Note that the nonce is hashed using the octet sequence of its decoded value while the timestamp is hashed using the octet sequence of its UTF8 encoding as specified in the contents of the element.</p>
  </blockquote>
  
  <p>If anyone could help me solve this problem that would be great because it's beginning to drive me crazy! It would be ideal if you could provide source code.</p>