I have a use case where I need to set custom interceptor before PolicyBasedWSS4JOutInterceptorInternal interceptor in the chain. Use case is custom compression.
The problem is that this inner class is accesible only from package and for external application is not possible to get the class name directly. It is necessary either hard code the name or instantiate the class using createEndingInterceptor() method. Both possibilities are not perfect.
I see two ways to fix it:
1) declare inner PolicyBasedWSS4JOutInterceptorInternal class as public
2) extract PolicyBasedWSS4JOutInterceptorInternal as separate class. Rename the interceptors:
PolicyBasedWSS4JOutInterceptor -> PolicyBasedWSS4JOutPrepareInterceptor
PolicyBasedWSS4JOutInterceptorInternal -> PolicyBasedWSS4JOutInterceptor
Actually PolicyBasedWSS4JOutInterceptor just prepares SaajOutInterceptor to convert message to SOAP and PolicyBasedWSS4JOutInterceptorInternal really does the job regarding security policy. Probably these names refract the class jobs better.
Patch for (1) is attached.
If (2) is better in overall security design, I am going to provide patch for (2) as well.