I am fairly familiar with how custom UsernameTokenManager works. It's all fine if a username & password is provided by the client in the SOAP request. If the client explicitly excludes the password (<wsse:Password> tag), I would expect the framework to throw a corresponding exception. Unfortunately the webservice call proceeds as usual. When debugging, I can see that my custom UsernameTokenManager is being invoked (method AuthenticateToken) and it returns the correct password; but something is not working after that. Any clues?

0

There are 0 best solutions below