interface SignatureTool {
    /**
     * @return Result of signer signing content.
     */
    public SOAPElement getSignature(String signersName,
                                    SOAPElement content) throws SOAPException;

    /**
     * @return true if content was signed, unchanged, by signer of signature.
     * This is only true if the content is the same content signed originally
     * by a signer, resulting in signature.
     */
    public boolean isSignatureValid(SOAPElement signature,
                                    SOAPElement content) throws SOAPException;
}

                
abstract class SignHandler implements Handler
{
    . . .
    /**
     * Name of required property, in HandlerInfo handler configuration,
     * that specifies who signs outgoing messages.
     */
    public  static String SIGNERS_NAME_PROPERTY;
    private SignatureTool  signatureTool;
    private HandlerInfo    info;

    /**
     * Obtain signer's name from handler configuration (HandlerInfo),
     * and sign message.
     * @throws SignException if SIGNERS_NAME_PROPERTY is not available
     *                       in the handler config.
     */
    public void signOutgoing(SOAPMessageContext mc) throws SignException {
         // SIGNERS_NAME_PROPERTY is required to be on the configuration.
        Map config = info.getHandlerConfig();
        Object nameObj = config.get(SIGNERS_NAME_PROPERTY);
        String name = (String)nameObj;
        try {
            // Dig down into message, locate or create header block.
            SOAPMessage msg = mc.getMessage();
            SOAPPart part = msg.getSOAPPart();
            SOAPEnvelope envelope = part.getEnvelope();
            SOAPHeader header = envelope.getHeader();
            /**
             * Create new header element.
             * We don't specify a role on this header element,
             * meaning the target role is the "ultimate destination".
             */
            SOAPHeaderElement headerElement
                = (SOAPHeaderElement)header.addChildElement(SIGN_ELEMENT,
                                                            SIGN_PREFIX,
                                                            SIGN_NS_URI);
            // Locate portion of message content that is to be signed.
            SOAPElement content = getContent(part);
            /**
             * Create new element representing signature,
             * and add as child to new header element.
             */
            SOAPElement element = signatureTool.getSignature(name, content);
            headerElement.addChildElement(element);
        } catch (SOAPException e) {
            e.printStackTrace();
            throw new SignException("Unable to sign message", e);
        }
    }
    . . .
    // See resources for full sample code.
}

                
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <!-- original header content -->

    <!-- New header element, inserted by handler -->
    <sign:sign xmlns:sign="uri://org.example.webservices.signature.Sign">
      <!-- output of SignatureTool.getSignature() -->
    </sign:sign>

  </soap:Header>
  <soap:Body>
    <!-- original body content -->
  </soap:Body>
</soap:Envelope>

                
abstract class SignHandler implements Handler
{
    . . .
    /**
     * Name of required property, in HandlerInfo handler configuration,
     * that specifies who signs outgoing messages.
     */
    public  static String SIGNERS_NAME_PROPERTY;
    private static QName   SIGN_HEADER;
    private SignatureTool  signatureTool;
    private HandlerInfo    info;

    /**
     * Look for signature on incoming message.
     * If signature not found, then continue message processing.
     * If signature is found, then verify that it is "correct".
     * If correct, then continue message processing.
     * If not correct, then throw SignException.
     */
    public void checkIncoming(SOAPMessageContext mc) throws SignException {
        try {
            SOAPMessage msg = mc.getMessage();
            SOAPPart part = msg.getSOAPPart();
            SOAPEnvelope envelope = part.getEnvelope();
            /**
             * Locate portion of message content that is to be signed.
             */
            SOAPElement content = getContent(part);

            /**
             * Dig down through SOAP headers looking for matches to
             * SIGN_HEADER, that are also targeted for this SOAP Node.
             */
            SOAPHeader header = envelope.getHeader();
            if (header != null) {
                /**
                 * The roles the node acts in are specified by the
                 * MessageContext.getRoles() method.
                 * If roles not found, default to "ultimate destination".
                 */
                String[] roles = mc.getRoles();
                if (roles == null  ||  roles.length == 0) {
                    roles = new String[] { "" };
                }
                for (int ridx = 0; ridx < roles.length; ridx++) {
                    String role = roles[ridx];
                    /**
                     * Examine headers bound to each role this node acts in.
                     * Headers are determined to be targeted for a SOAP Node by
                     * matching the node's roles with the header's actor role.
                     *
                     * So now go through list of headers associated with
                     * the role we are currently working on.
                     */
                    Iterator headerElementIter
                        = header.examineHeaderElements(role);
    while (headerElementIter.hasNext()) {
                        SOAPHeaderElement headerElement
                            = (SOAPHeaderElement)headerElementIter.next();
    // Is header recognized by this handler?
                        Name headerElementName
                            = headerElement.getElementName();
                        if (equals(headerElementName, SIGN_HEADER)) {
                            /**
                             * Look for SOAPElement(s) in header,
                             * ignoring mixed content.
                             */
                            Iterator headerIter
                                = headerElement.getChildElements();
    while (headerIter.hasNext()) {
                                Object elementObj = headerIter.next();
    if (elementObj instanceof SOAPElement) {
                                    SOAPElement element
                                        = (SOAPElement)elementObj;
                                    signatureTool.isSignatureValid(element,
                                                                   content);
                                }
                            }
                        }
                    }
                }
            }
        } catch (SOAPException e) {
            e.printStackTrace();
            throw new SignException("Unable to verify signature", e);
        }
    }
    . . .
    // See resources for full sample code.
}

                
public class ClientSignHandler extends SignHandler
{
    public boolean handleRequest(MessageContext mc) {
        signOutgoing((SOAPMessageContext)mc);
        return true;
    }
    public boolean handleResponse(MessageContext mc) {
        checkIncoming((SOAPMessageContext)mc);
        return true;
    }
    public boolean handleFault(MessageContext mc) {
        checkIncoming((SOAPMessageContext)mc);
        return true;
    }
}

                
public class ServiceSignHandler extends SignHandler
{
    public boolean handleRequest(MessageContext mc) {
        checkIncoming((SOAPMessageContext)mc);
        return true;
    }
    public boolean handleResponse(MessageContext mc) {
        signOutgoing((SOAPMessageContext)mc);
        return true;
    }
    public boolean handleFault(MessageContext mc) {
        signOutgoing((SOAPMessageContext)mc);
        return true;
    }
}

                
        Map hConfig = new HashMap();
        hConfig.put(ClientSignHandler.SIGNERS_NAME_PROPERTY, "Linus");
        HandlerInfo hInfo = new HandlerInfo(ClientSignHandler.class,
                                            hConfig,
                                            ClientSignHandler.HEADERS);

                
       // Obtain service, for JAX-RPC 1.0 this may be implementation specific.
        StockQuoteService service = ...;
        // Must match WSDL's port QName
        QName portQName = new QName("http://stock.webservices.example.org",
                                    "StockQuote");
        service.getHandlerRegistry().getHandlerChain(portQName).add(hInfo);

                
  . . .
    <port-component>
      <port-component-name>StockQuote</port-component-name>
      <wsdl-port>
        <namespaceURI>http://stock.webservices.example.org</namespaceURI>
        <localpart>StockQuote</localpart>
      </wsdl-port>
      . . .
      <handler>
        <handler-name>Signature Handler</handler-name>
        <handler-class>org.example.webservices.signature.
        ServiceSignHandler</handler-class>
        <init-param>
          <param-name>org.example.webservices.signature.SignersName</param-name>
          <param-value>Snoopy</param-value>
        </init-param>
        <soap-header>
          <namespaceURI>uri://
          org.example.webservices.signature.Sign</namespaceURI>
          <localpart>sign</localpart>
        </soap-header>
      </handler>
    </port-component>
  . . .