Major Description
The XKMS Crypto provider tries to get a Certificate for the value configured for "ws-security.encryption.username". WSS4J treats this as an "alias", and the XKMS Crypto Provider first tries to get the Certificate from a local keystore using this, before going off to the XKMS Server. However, if the encryption username is in the form of a Subject DN it will fail to retrieve the certificate locally, and always call out to the XKMS Server.