<handler type="java:org.apache.ws.axis.security.WSDoAllSender">
<parameter name="action" value="UsernameToken"/>
...

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);

Usually the handler serializes the processed SOAP message into a string and sets it into the Axis message context as new current message. To supress this action, define this action. In this case the handler stores the processed SOAP message as Document in the Axis message context with the property name SND_SECURITY.

A chained handler can retrieve the SOAP message and process it. The last handler in the chain must set the processed SOAP message as current message in Axis message context. 

If this parameter is omitted, the actor name is not set. Please refer to org.apache.axis.Constants#ATTR_ACTOR and org.apache.axis.Constants#ATTR_ROLE about the parameter names. They are set to "actor" and "role" respectively.

The value of the actor or role has to match the receiver's setting or may contain standard values.

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ACTOR, "ActorName");

Also see:

org.apache.axis.Constants#URI_SOAP11_NEXT_ACTOR
org.apache.axis.Constants#URI_SOAP12_NEXT_ROLE

If the parameter has the value 1 or true the mustUnderstand is set. The values 0 or false supress the flag.

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.MUST_UNDERSTAND, "false");

The default setting is true

Please refer to org.apache.axis.Constants#ATTR_MUST_UNDERSTAND about the parameter name ("mustUnderstand"). 

• The UsernameToken function sets this name in the UsernameToken.
• The Signing function uses this name as the alias name in the keystore to get user's certificate and private key to perform signing.
• The encryption functions uses this parameter as fallback if #ENCRYPTION_USER is not used.

...
call.setUsername("name");
call.setPassword("WSS4Java");
...

If the security functions uses the username from the message context, it clears the username from the message context after they copied it. This prevents sending of the username in the HTTP header.

In this case the HTTP authentication mechansisms do not work anymore. User authentication shall be done via the username token or the certificate verification of the signature certificate. 

• A class that implements a callback interface (see below). The handler loads this class and calls the callback method. This class must have a public default constructor with not parameters.
• The application (or a preceeding handler) sets a reference to an object that implements the callback interface
• The application sets the password directly using the setPassword function of the Call.

The handler first checks if it can get a the password via a callback class. If that fails it checks if it can get the password from the object reference, if that also fails the handler tries the password property.

The following parameter defines a class that implements a callback handler interface. The handler loads the class and calls the callback handler method to get the password. The callback class needs to implement the javax.security.auth.callback.CallbackHandler interface.

The callback function javax.security.auth.callback.CallbackHandler#handle(javax.security.auth.callback.Callback[]) gets an array of org.apache.ws.security.WSPasswordCallback objects. Only the first entry of the array is used. This object contains the username/keyname as identifier. The callback handler must set the password or key associated with this identifier before it returns.

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.PW_CALLBACK_CLASS, "PWCallbackClass");

Refer also to comment in #USER about HTTP authentication functions. 

call.setProperty(WSHandlerConstants.PW_CALLBACK_REF, anPWCallbackObject);

Note: every handler that preceeds this handler in the chain can set this property too. This may be useful on the server side. 

The encryption functions uses the public key of this user's certificate to encrypt the generated symmetric key.

If this parameter is not set, then the encryption function falls back to the #USER parameter to get the certificate.

If only encryption of the SOAP body data is requested, it is recommended to use this parameter to define the username. The application can then use the standard user and password functions (see example at #USER to enable HTTP authentication functions.

Encryption only does not authenticate a user / sender, therefore it does not need a password.

Placing the username of the encryption certficate in the WSDD is not a security risk, because the public key of that certificate is used only.

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ENCYRPTION_USER, "encryptionuser");

The handler uses the public key of the sender's certificate. Using this way to define an encryption key simplifies certificate management to a large extend. 

The classloader loads this file. Therefore it must be accessible via the classpath.

To locate the implementation of the Crypto interface implementation the property file must contain the property org.apache.ws.security.crypto.provider. The value of this property is the classname of the implementation class.

The following line defines the standard implementation:

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin

The property file of the standard implementation org.apache.ws.security.components.crypto.Merlin uses the following properties:

org.apache.ws.security.crypto.provider
org.apache.ws.security.crypto.merlin.file
org.apache.ws.security.crypto.merlin.keystore.type
org.apache.ws.security.crypto.merlin.keystore.provider
org.apache.ws.security.crypto.merlin.keystore.password
org.apache.ws.security.crypto.merlin.keystore.alias
org.apache.ws.security.crypto.merlin.cert.provider

• org.apache.ws.security.crypto.provider see description above
• org.apache.ws.security.crypto.merlin.file The path to the keystore file. At first the classloader tries to load this file, if this fails the implementations performs a file system lookup.
• org.apache.ws.security.crypto.merlin.keystore.type The keystore type, for example JKS for the Java key store. Other keystore type, such as pkcs12 are also possible but depend on the actual Crypto implementation.
• org.apache.ws.security.crypto.merlin.keystore.password The password to read the keystore. If this property is not set, then the pwcallbackproperty must be defined.

call.setProperty(WSHandlerConstants.SIG_PROP_FILE, "myCrypto.properties");

If a property file is not set and a signature is requested, the handler throws an AxisFault. 

The vector contains WSDoAllReceiverResult objects for each chained WSDoAllReceiver handler. 

Refer to documentation of #SIG_PROP_FILE .

Refer to #SIG_PROP_FILE for a detail description about the format and how to use this property file.

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.DEC_PROP_FILE, "myCrypto.properties");

If this parameter is not used, but the signature crypto property file is defined (combined Encryption/Signature action), then the encryption function uses that file. Otherwise the handler throws an AxisFault. 

The parameter can be set to either WSConstants#PW_DIGEST or to WSConstants#PW_TEXT .

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);

The default setting is PW_DIGEST. 

The value of this parameter is a list of element names that are added to the UsernameToken. The names of the list a separated by spaces.

The list may containe the names nonce and created only. Use this option if the password type is passwordText and the handler shall add the Nonce and/or Created elements. 

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.SIG_KEY_ID, "DirectReference");

The application may set this parameter using the following method:

call.setProperty(
WSHandlerConstants.SIG_ALGO,
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
);

The application may set this parameter using the following method:

call.setProperty(
WSHandlerConstants.SIG_DIGEST_ALGO, "http://www.w3.org/2001/04/xmlenc#sha256"
);

Refer to #ENCRYPTION_PARTS for a detailed description of the format of the value string.

If this parameter is not specified the handler signs the SOAP Body by default.

The WS Security specifications define several formats to transfer the signature tokens (certificates) or references to these tokens. Thus, the plain element name Token signs the token and takes care of the different format.

To sign the SOAP body and the signature token the value of this parameter must contain:

<parameter name="signatureParts"
value="{}{http://schemas.xmlsoap.org/soap/envelope/}Body; Token" />

If there is no other element in the request with a local name of Body then the SOAP namespace identifier can be empty ({}). 

Refer to documentation of #SIG_PROP_FILE .

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ENC_PROP_FILE, "myCrypto.properties");

If this parameter is not used, but the signature crypto property file is defined (combined Encryption/Signature action), then the encryption function uses signature property file. Otherwise the handler throws an AxisFault. 

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ENC_KEY_ID, "X509KeyIdentifier");

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ENC_SYM_ALGO, WSConstants.AES_256);

The application may set this parameter using the following method:

call.setProperty(WSHandlerConstants.ENC_KEY_TRANSPORT, "RSA15");

The value of this parameter is a list of semi-colon separated element names that identify the elements to encrypt. An encryption mode specifier and a namespace identification, each inside a pair of curly brackets, may preceed each element name.

The encryption mode specifier is either {Content} or {Element}. Please refer to the W3C XML Encryption specification about the differences between Element and Content encryption. The encryption mode defaults to Content if it is omitted. Example of a list:

<parameter name="encryptionParts"
value="{Content}{http://example.org/paymentv2}CreditCard;
{Element}{}UserName" />

The encryption modifier and the namespace identifier can be ommited. In this case the encryption mode defaults to Content and the namespace is set to the SOAP namespace.

An empty encryption mode defaults to Content, an empty namespace identifier defaults to the SOAP namespace. The second line of the example defines Element as encryption mode for an UserName element in the SOAP namespace.

To specify an element without a namespace use the string Null as the namespace name (this is a case sensitive string)

If no list is specified, the handler encrypts the SOAP Body in Content mode by default. 

If this parameter is not defined, contains a value less or equal zero, or an illegal format the handlers use a default TTL of 300 seconds (5 minutes). 

• DirectReference for WSConstants#BST_DIRECT_REFERENCE
• IssuerSerial for WSConstants#ISSUER_SERIAL
• X509KeyIdentifier for WSConstants#X509_KEY_IDENTIFIER
• SKIKeyIdentifier for WSConstants#SKI_KEY_IDENTIFIER
• EmbeddedKeyName for WSConstants#EMBEDDED_KEYNAME
• Thumbprint for WSConstants#THUMBPRINT