[CXF-4759] No security headers created for policy with no Binding assertion

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Incomplete
• Affects Version/s: 2.7
• Fix Version/s: NeedMoreInfo
• Component/s: WS-* Components
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Paton Wong
• Created: 17/Jan/13 01:45
• Updated: 09/Apr/13 15:19
• Resolved: 25/Feb/13 22:44

Description

For instance if a SOAP service has a policy with a supporting token of UsernameToken without a TransportBinding, SymmetricBinding or AsymmetricBinding then CXF will not send any security header.

In PolicyBasedWSS4JOutInterceptorInternal.handleMessage, there is an attempt to create a dummy TransportBinding, when the policy itself had not specified a binding. However, without a TransportToken, the TransportBindingHandler will ignore any supporting tokens.