[CXF-6951] Support using the initiator token's public key for response encryption by recipient

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.6
• Fix Version/s: 3.1.7
• Component/s: WS-* Components
• Labels: easyfix features security
• Estimated Complexity: Advanced
• Assignee: Colm O hEigeartaigh
• Reporter: Andreas Vallen
• Created: 23/Jun/16 22:51
• Updated: 14/Oct/16 14:22
• Resolved: 24/Jun/16 12:31

Description

Using CXF 3.1.6 and WSS4j 2.1.5, uncommenting some already prepared code unlocked this feature for me

It is two locations in AsymmetricBindingHandler both commented with:

TODO when WSS4J 2.1.5 is released

Now the encryption username and the crypto configuration may be left unconfigured and encryption will still work properly.

Note that previously it seems that setting the ws-security.encryption.username property to "useReqSigCert" seems to have been the way to achieve the same (as hinted to variously in forums or e.g. in CXF-4274). Looking through the code this however does not seem to be supported anymore for SOAP at least. This has led me down the wrong path for a while.