This is a working example of creating a SOAP service with X509 Token profile to sign the request using digital signatures (digSig).
Spring WSS supports two implementations of WS-Security:WSS4J and XWSS, using ClientInterceptor class.
- Wss4jSecurityInterceptor.
- XwsSecurityInterceptor.
To make this sample working yet minimalist, I am using WSS4j which is more portable, additionally other details like trustsstore, Custom SAML assertions, encryption, JAXB/XJC configurations are omitted.
For customizing see; wss4j-config. Below details are implemented in ClientConfig.java.
Signature Identifier Profiles
// X509KeyIdentifier, DirectReference
securityInterceptor.setSecurementSignatureKeyIdentifier("DirectReference");
Security Actions
// Timestamp Signature SAMLTokenSigned SAMLTokenUnsigned
securityInterceptor.setSecurementActions("Timestamp Signature");
Signature Parts
securityInterceptor.setSecurementSignatureParts(
"{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;" +
"{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body"
This example will need a java key store (jks) file like which is NOT included, you will need to create it using keytool.
$ mvn clean spring-boot:run
The project has been released under the MIT License. Issues and suggestions for this sample are welcome, Tracker