Передача идентификационной информации пользователя в реализации Web-сервисов

                
<wsse:Security soapenv:mustUnderstand="1" 
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/
                                         oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:UsernameToken>
        <wsse:Username>alice</wsse:Username>
        <wsse:Password 
            Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-
            profile-1.0#PasswordText">alicealice</wsse:Password>
    </wsse:UsernameToken>
</wsse:Security>
      

                
<wsse:Security soapenv:mustUnderstand="1" 
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/
                                        oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:BinarySecurityToken ValueType="wsst:LTPA" 
         xmlns:wsst="http://www.ibm.com/websphere/appserver/tokentype/5.0.2">
                hPKZK+HIjr0+vMVFldf7VcF9e4jAnUF1bbqC5+GlbjLQpZJUXyh4SQwJKPhHYwYf6bJZP7I5s
                XcE8B4Wsowt81bdNCxXVVMGWFs1JbQ5CbLMOkXwgTyWw3Xbrl9iInNrM+ta/gUm7bcDPs4wjD
                86FZilEZIv80DbewgZcPelpfA3kvyEp/X20/4RfE1fmEe816kQfQ1HWouFXlws6vI3pLJ+Nmk
                U0a/9xYH6ERbPx7qjXu5YnvbaQHI9HCfLdOZZdNanjnC+OJaN9VnYw1rfzEYDqIBntB6mn4qN
                9/X88l+amsYZA808SAqOdO8ie9i1V7IsztBJJM7kQ+cqb07Dtg==
    </wsse:BinarySecurityToken>
</wsse:Security>
      

                
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions targetNamespace="http://services.cna.com" 
           xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
           xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
           xmlns:wsdlsoap="http://schemas.xmlsoap.org/wsdl/soap/" 
           xmlns:intf="http://services.cna.com" 
           xmlns:impl="http://services.cna.com" 
           xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity
                                                                        -secext-1.0.xsd">
    <wsdl:types>
        <schema elementFormDefault="qualified" 
           targetNamespace="http://services.cna.com" 
           xmlns="http://www.w3.org/2001/XMLSchema" 
           xmlns:impl="http://services.cna.com" xmlns:intf="http://services.cna.com" 
           xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
           xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <element name="echo">
            <complexType>
                <sequence>
                    <element name="request" nillable="true" type="xsd:string"/>
                </sequence>
            </complexType>
        </element>
        <element name="echoResponse">
            <complexType>
                <sequence>
                    <element name="echoReturn" nillable="true" type="xsd:string"/>
                </sequence>
            </complexType>
        </element>
        </schema>
        <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema">
            <xsd:import namespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401
                         -wss-wssecurity-secext-1.0.xsd" schemaLocation="security.xsd"/>
        </xsd:schema>
    </wsdl:types>
    <wsdl:message name="echoRequest">
        <wsdl:part name="loginHeader" element="wsse:Security"/>
        <wsdl:part name="parameters" element="intf:echo"/>
    </wsdl:message>
    <wsdl:message name="echoResponse">
        <wsdl:part name="parameters" element="intf:echoResponse"/>
    </wsdl:message>
    <wsdl:portType name="EchoService">
        <wsdl:operation name="echo">
            <wsdl:input name="echoRequest" message="intf:echoRequest"/>
            <wsdl:output name="echoResponse" message="intf:echoResponse"/>
        </wsdl:operation>
    </wsdl:portType>
    <wsdl:binding name="EchoServiceSoapBinding" type="intf:EchoService">
        <wsdlsoap:binding style="document" 
                          transport="http://schemas.xmlsoap.org/soap/http"/>
         <wsdl:operation name="echo">
             <wsdlsoap:operation soapAction=""/>
             <wsdl:input name="echoRequest">
                 <wsdlsoap:header message="intf:echoRequest" part="loginHeader" 
                                          use="literal" encodingStyle="literal">
                 </wsdlsoap:header>
                 <wsdlsoap:body parts="parameters" use="literal"/>
             </wsdl:input>
             <wsdl:output name="echoResponse">
                 <wsdlsoap:body use="literal"/>
             </wsdl:output>
         </wsdl:operation>
    </wsdl:binding>
    <wsdl:service name="EchoServiceService">
        <wsdl:port name="EchoService" binding="intf:EchoServiceSoapBinding">
            <wsdlsoap:address 
                   location="http://localhost:9080/echoService/services/EchoService"/>
        </wsdl:port>
    </wsdl:service>
</wsdl:definitions>
      

                
package com.cna.services;

import javax.xml.rpc.handler.MessageContext;
import javax.xml.rpc.handler.soap.SOAPMessageContext;
import javax.xml.rpc.server.ServiceLifecycle;
import javax.xml.rpc.server.ServletEndpointContext;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPMessage;
import com.cna.service.header.securityCredentials;
import com.cna.service.header.securityHeader;

public class EchoServiceSoapBindingImpl implements EchoService, ServiceLifecycle{
	
    public void init(Object ctx){

        System.out.println("Inside Service init method, context is " + ctx);
        ServletEndpointContext sC = (ServletEndpointContext)ctx;
        securityCredentials.printServletCredentials(sC);
        MessageContext context = sC.getMessageContext();
        try{
            SOAPMessageContext smc = (SOAPMessageContext)context;
            SOAPMessage sMessage = smc.getMessage();
            System.out.println("SOAP message is ");
            sMessage.writeTo(System.out);
            System.out.println("\n");
        }
        catch(Exception e){}
    }	
	
    public EchoResponse echo(SOAPElement loginHeader, Echo parameters) 
                                           throws java.rmi.RemoteException {
        String request = parameters.getRequest();
        System.out.println("Inside echo service " + request);

        // Сбросить идентификационную информацию пользователя в исходное состояние
        securityHeader.processHeader(loginHeader);
        securityCredentials.printCredentials();		

        // Возврат
        EchoResponse responce = new EchoResponse();
        responce.setEchoReturn("return ");
        return responce;
    }

    public void destroy(){
	
        System.out.println("Inside Service destroy method");
    }
}
      

                
package com.cna.service.header;
import java.security.Principal;
import java.util.Set;
import javax.security.auth.Subject;
import javax.xml.rpc.server.ServletEndpointContext;
import com.ibm.websphere.security.auth.WSSubject;
import com.ibm.websphere.security.cred.WSCredential;

public class securityCredentials {

    public static void printServletCredentials(ServletEndpointContext ctx){
		
        String tName = Thread.currentThread().getName();
        System.out.println("Executing on the thread " + tName);
        Principal userPrinciple = ctx. getUserPrincipal();
        System.out.println("user is " + userPrinciple);
    }

    public static void printCredentials(){
        String tName = Thread.currentThread().getName();
        System.out.println("Executing on the thread " + tName);
        try{
            Subject caller_security = WSSubject.getCallerSubject();
            Subject run_security = WSSubject.getRunAsSubject();
            if (caller_security != null){
            
                // Получить все полномочия из субъекта системы защиты 
                Set security_credentials = 
                         caller_security.getPublicCredentials(WSCredential.class);
                // Получить первые полномочия  
                WSCredential security_credential = 
                         (WSCredential)security_credentials.iterator().next();
                String user = (String) security_credential.getSecurityName();
                System.out.println("Caller Identity " + user);
            }
            if (run_security != null){
				
                // Получить все полномочия из субъекта системы защиты 
                Set security_credentials = 
                           run_security.getPublicCredentials(WSCredential.class);
                // Получить первые полномочия 
                WSCredential security_credential = 
                             (WSCredential)security_credentials.iterator().next();
                String user = (String) security_credential.getSecurityName();
                System.out.println("Execution Identity " + user);
            }
        }
        catch (Exception e){
            System.out.println("Error obtaining credentials");
            e.printStackTrace();
        }
    }
}
      

                
package com.cna.service.header;

import java.util.Iterator;
import java.util.Set;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import javax.xml.soap.Name;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPFactory;
import org.apache.xml.serialize.OutputFormat;
import org.apache.xml.serialize.XMLSerializer;
import com.ibm.websphere.security.WSSecurityException;
import com.ibm.websphere.security.auth.WSSubject;
import com.ibm.websphere.security.auth.callback.WSCallbackHandlerImpl;
import com.ibm.websphere.security.cred.WSCredential;
import com.ibm.ws.webservices.engine.encoding.Base64;

public class securityHeader {

    private static String LTPAns = "wsst";
    private static String LTPAid = ":LTPA";
    private static String LTPAURL = 
                       "http://www.ibm.com/websphere/appserver/tokentype/5.0.2";
    private static String passwordType = 
        "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-
        profile-1.0#PasswordText";
    private static String SecurityURL = 
    "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
    private static String SOAPEncURL = "htp://schemas.xmlsoap.org/soap/encoding/";
    private static String SOAPEnvURL = "http://schemas.xmlsoap.org/soap/envelope/";
    private static String XMLSchemaURL = "http://www.w3.org/2001/XMLSchema";
    private static String XMLSchemaInsURL = "http://www.w3.org/2001/XMLSchema-instance";

    // Создать заголовок LTPA-маркера
    public static SOAPElement createLTPAHeader(){
		
        // Сначала попробовать получить сам маркер
        byte[] token = getSecurityToken();
        if(token == null)
            return null;
			
        // Теперь попробовать создать заголовок 
        SOAPElement header = null;
        try{
			
            // Создать Element заголовка 
            SOAPFactory sFactory = SOAPFactory.newInstance();
            Name headerName = sFactory.createName("Security","wsse",SecurityURL);
            header = sFactory.createElement(headerName);
            header.addNamespaceDeclaration("soapenc",SOAPEncURL);
            header.addNamespaceDeclaration("xsd",XMLSchemaURL);
            header.addNamespaceDeclaration("xsi",XMLSchemaInsURL);
            Name mustName = sFactory.createName("mustUnderstand","soapenv",SOAPEnvURL);
            header.addAttribute(mustName,"1");
			
            // Создать и добавить Element двоичного маркера
            Name binaryTokenName = sFactory.createName("BinarySecurityToken","wsse",
                                                                         SecurityURL);
            SOAPElement binaryToken = sFactory.createElement(binaryTokenName);
            header.addChildElement(binaryToken);
			
            // Заполнить маркер
            binaryToken.addNamespaceDeclaration(LTPAns,LTPAURL);
            Name attrName = sFactory.createName("ValueType");
            binaryToken.addAttribute(attrName,LTPAns+LTPAid);
            String stoken = Base64.encode(token);
            binaryToken.addTextNode(stoken);	

        }
        catch(Exception e){
            System.out.println("Error building LTPA security header");
            e.printStackTrace();
        }
        return header;
    }
	
    // Создать заголовок BasicAuth 
    public static SOAPElement createBasicAuth(String user, String password){

        // Проверить наличие полномочий
        if((user == null) || (password == null)){
            return null;
        }

        // Теперь попробовать создать заголовок 
        SOAPElement header = null;
        try{
			
            // Создать Element заголовка 
            SOAPFactory sFactory = SOAPFactory.newInstance();
            Name headerName = sFactory.createName("Security","wsse",SecurityURL);
            header = sFactory.createElement(headerName);
            header.addNamespaceDeclaration("soapenc",SOAPEncURL);
            header.addNamespaceDeclaration("xsd",XMLSchemaURL); 
            header.addNamespaceDeclaration("xsi",XMLSchemaInsURL); 
            Name mustName = sFactory.createName("mustUnderstand","soapenv",SOAPEnvURL);
            header.addAttribute(mustName,"1");

            // Создать и добавить Element маркера userName 
            Name userTokenName = sFactory.createName("UsernameToken","wsse",SecurityURL);
            SOAPElement userToken = sFactory.createElement(userTokenName);
            header.addChildElement(userToken);

            // Заполнить маркер 
            Name userElementName =	sFactory.createName("Username","wsse",SecurityURL);
            Name passwordElementName =	sFactory.createName("Password","wsse",
                                                                          SecurityURL);		
            SOAPElement userElement = sFactory.createElement(userElementName);
            userElement.addTextNode(user);
            SOAPElement passwordElement = sFactory.createElement(passwordElementName);
            Name attrName = sFactory.createName("Type");
            passwordElement.addAttribute(attrName,passwordType);
            passwordElement.addTextNode(password);
			
            userToken.addChildElement(userElement);
            userToken.addChildElement(passwordElement);
        }
        catch(Exception e){
            System.out.println("Error building Basic Auth security header");
            e.printStackTrace();
        }
        return header;
    }

    // Обработать заголовок системы защиты
    public static void processHeader(SOAPElement header){

        try{
			
            //Сначала вывести его
            try{
                OutputFormat ouf = new OutputFormat();
                ouf.setIndenting(true);
                XMLSerializer serializer = new XMLSerializer(System.out,ouf);
                serializer.serialize(header);
                System.out.println(" ");
            }
            catch(Exception e){
                e.printStackTrace();
            }
			
            // Проверить тип маркера
            SOAPFactory sFactory = SOAPFactory.newInstance();
            Name binaryTokenName = sFactory.createName("BinarySecurityToken","wsse",
                                                                         SecurityURL);
            Name userTokenName = sFactory.createName("UsernameToken","wsse",SecurityURL);

            // Это двоичный маркер?
            Iterator tokens = header.getChildElements(binaryTokenName);
            if(tokens != null){ 
                while(tokens.hasNext()){
                    SOAPElement binaryToken = (SOAPElement)tokens.next();
                    
                    // Убедиться, что это LTPA
                    String tType = binaryToken.getAttribute("ValueType");
                    if((tType == null) || !tType.endsWith(LTPAid))
                        continue;
                    String stoken = binaryToken.getValue();
                    byte[] token = Base64.decode(stoken);
                    setSecurityContext(token);
                    return;
                }
            }
            
            // Это маркер Basic Auth?
            tokens = header.getChildElements(userTokenName);
            if((tokens != null) && (tokens.hasNext())){
				
                // Обработать маркер Basic Auth 
                SOAPElement userToken = (SOAPElement)tokens.next();
								
                // Получить имя и пароль
                Name userElementName =	sFactory.createName("Username","wsse",
                                                                    SecurityURL);		
                Name passwordElementName =	sFactory.createName("Password","wsse",
                                                                    SecurityURL);		
                Iterator users = userToken.getChildElements(userElementName);
                Iterator passwords = userToken.getChildElements(passwordElementName);
                if((users != null) && (users.hasNext()) && 
                                  (passwords != null) && (passwords.hasNext())){
                    String user = ((SOAPElement)users.next()).getValue();
                    String password = ((SOAPElement)passwords.next()).getValue();
                    setSecurityContext(user,password);
                }
                return;
            }
			
            // Неизвестный маркер, игнорировать
        }
        catch(Exception e){
            System.out.println("Error processing security header");
            e.printStackTrace();
        }
    }

    // Получить маркер системы защиты
    private static byte[] getSecurityToken(){
	
        byte[] token = null;
        try{
            // Получить текущий субъект защиты
            Subject security_subject = WSSubject.getRunAsSubject();
            if (security_subject != null){
                // Получить все полномочия из субъекта защиты
                Set security_credentials = 
                        security_subject.getPublicCredentials(WSCredential.class);
                // Получить первые полномочия  
                WSCredential security_credential = 
                        (WSCredential)security_credentials.iterator().next();
                String user = (String) security_credential.getSecurityName();
                // Получить маркер системы защиты  
                token = security_credential.getCredentialToken();
                System.out.println("My data from the Caller credential is:  " + 
                                                      user + " security token is: ");
                System.out.println(token);
                System.out.println("\n");
            }
        }
        catch (Exception e){
            System.out.println("Error obtaining token");
            e.printStackTrace();
        }
        return token;
    }
	
    private static void setSecurityContext(byte[] token){
	
        if(token == null){
            System.out.println("Cannot create LoginContext. No token");
            return;
        }
        LoginContext lc = null;
            
        // Создать новый контекст для регистрации
        try {
            lc = new LoginContext("WSLogin",new WSCallbackHandlerImpl(token));
        } 
        catch (LoginException le) {
            System.out.println("Cannot create LoginContext. " + le.getMessage());
            return;
        } 
        catch(SecurityException se) {
            System.out.println("Cannot create LoginContext." + se.getMessage());
            return;
        }

        // Зарегистрироваться с новым контекстом
        try{
            lc.login(); 
        } 
        catch(LoginException le){
            System.out.println("Fails to Login. " + le.getMessage());
            return;
        }

        // Получить субъект защиты
        Subject security_subject = lc.getSubject();
		
        // Установить субъект защиты
        try{
            WSSubject.setRunAsSubject(security_subject);
        }
        catch (WSSecurityException e){
            System.out.println("Error Setting security credentials. " + e.getMessage());
        }
        catch (Exception e){
            System.out.println("Error Setting security credentials. " + e.getMessage());
        }
    }

    private static void setSecurityContext(String user, String password){
	
        if((user == null) || (password == null)){
            System.out.println("Cannot create LoginContext. No token");
            return;
        }
        LoginContext lc = null;
            
        // Создать новый контекст для регистрации
        try {
            lc = new LoginContext("WSLogin",new WSCallbackHandlerImpl(user, password));
        } 
        catch (LoginException le) {
            System.out.println("Cannot create LoginContext. " + le.getMessage());
            return;
        } 
        catch(SecurityException se) {
            System.out.println("Cannot create LoginContext." + se.getMessage());
            return;
        }

        // Зарегистрироваться с новым контекстом
        try{
            lc.login(); 
        } 
        catch(LoginException le){
            System.out.println("Fails to Login. " + le.getMessage());
            return;
        }

        // Получить субъект защиты
        Subject security_subject = lc.getSubject();
		
        // Установить субъект защиты
        try{
            WSSubject.setRunAsSubject(security_subject);
        }
        catch (WSSecurityException e){
            System.out.println("Error Setting security credentials. " + e.getMessage());
        }
        catch (Exception e){
            System.out.println("Error Setting security credentials. " + e.getMessage());
        }
    }
} 
      

                
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
        xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
                    http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <display-name>SecureServiceProvider</display-name>
    <servlet>
        <servlet-name>com_cna_services_EchoServiceSoapBindingImpl</servlet-name>
        <servlet-class>com.cna.services.EchoServiceSoapBindingImpl</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <security-constraint>
        <display-name>resourceAccess</display-name>
        <web-resource-collection>
            <web-resource-name>AllResources</web-resource-name>
            <url-pattern>\*</url-pattern>
            <http-method>GET</http-method>
            <http-method>PUT</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description></description>
            <role-name>ApplicationUsers</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>ApplicationUsers</role-name>
    </security-role>
</web-app>
      

                
package com.cna.services.tester;

import javax.xml.rpc.Stub;
import javax.xml.soap.SOAPElement;
import com.cna.service.header.loginSecurityHeader;
import com.cna.services.Echo;
import com.cna.services.EchoService;
import com.cna.services.EchoServiceProxy;

public class serviceTester {
	
    public void testServices(){
    
        SOAPElement loginHeader = loginSecurityHeader.createLTPAHeader();
        Echo request = new Echo();
        request.setRequest("my echo");
        EchoServiceProxy portProxy = new EchoServiceProxy();
        EchoService port = portProxy.getEchoService();
        Stub stub = (Stub)port;
        stub._setProperty(Stub.USERNAME_PROPERTY,"bob");
        stub._setProperty(Stub.PASSWORD_PROPERTY,"bobbob");
        String reply = null;
        try{
            reply = port.echo(loginHeader,request).getEchoReturn();
        }
        catch(Exception e){
            System.out.println("Error invoking service");
            e.printStackTrace();
        }

        System.out.println("Done invoking service " + reply);	
    }
}
      

                
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<HTML>
<HEAD>
<%@ page 
language="java"
contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"
%>
<jsp:useBean id="serviceTester" scope="session" 
                        class="com.cna.services.tester.serviceTester" />
<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<META name="GENERATOR" content="IBM WebSphere Studio">
<TITLE>serviceTester.jsp</TITLE>
</HEAD>
<BODY>
<P>Testing Service ... </P>
<% serviceTester.testServices(); %>
<P>Done </P>
</BODY>
</HTML>
      

                
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" 
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
            id="WebApp_ID" version="2.4" 
            xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
            http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <display-name>SecureServiceConsumer</display-name>
    <servlet>
        <description></description>
        <display-name>serviceTester</display-name>
        <servlet-name>serviceTester</servlet-name>
        <jsp-file>/service/tester/serviceTester.jsp</jsp-file></servlet>
    <servlet-mapping>
        <servlet-name>serviceTester</servlet-name>
        <url-pattern>/serviceTester</url-pattern>
    </servlet-mapping>
    <security-constraint>
        <display-name>Everything</display-name>
        <web-resource-collection>
            <web-resource-name>ALL_Resources</web-resource-name>
            <url-pattern>/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>PUT</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description></description>
            <role-name>RegisteredUsers</role-name>
         </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>RegisteredUsers</role-name>
    </security-role>
    <service-ref>
        <description>WSDL Service EchoServiceService</description>
        <service-ref-name>service/EchoServiceService</service-ref-name>
        <service-interface>com.cna.services.EchoServiceService
                                                         </service-interface>
        <wsdl-file>WEB-INF/wsdl/EchoServiceSecurity.wsdl</wsdl-file>
        <jaxrpc-mapping-file>WEB-INF/EchoServiceSecurity_mapping.xml
                                                         </jaxrpc-mapping-file>
        <service-qname xmlns:pfx="http://services.cna.com">
						pfx:EchoServiceService</service-qname>
        <port-component-ref>
            <service-endpoint-interface>com.cna.services.EchoService
                                                     </service-endpoint-interface>
        </port-component-ref>
    </service-ref>
</web-app>
      

                
Caller credential is:  boris 
Inside Service init method 
Executing on the thread WebContainer : 1 
user is bob
SOAP message is 
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" 
        xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" 
        xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <soapenv:Header>
        <wsse:Security soapenv:mustUnderstand="1" 
                xmlns:soapenc="htp://schemas.xmlsoap.org/soap/encoding/" 
                xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
                                                         wss-wssecurity-secext-1.0.xsd" 
                xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
            <wsse:BinarySecurityToken ValueType="wsst:LTPA" 
                xmlns:wsst="http://www.ibm.com/websphere/appserver/tokentype/5.0.2">
                hPKZK+HIjr3R3oQgnfKX26/EBzZl2H+vfsxbZCMj4NO9Crsuy4Dx73wwavEdkBN6iE2Y5I1B6
                /0IgMKvI42PVtPEzwTUBmI3SfEsVm4zLi4NxgYY/8aRT7k3sRG+1sFGikbruwxXJqQhhQ6Owu
                YOxVfqWfODHvSVnlGuV/TPUGqY6V48LIEVGu7I2GtZ9iR1RJhfEPAOi+dADp9FGVa+fy0opYUF
                M19i++czim6cBKFD+ttqp3LjLBqLG25Zst2FJ3GwAEy21EW5kU+oG5th390CIJGss+phWZFXxS
                +RfHnvJ8HsBY1yz0reRvBZ9Y3KkSc2SvMFEfNBjc+rs3cvgw==
            </wsse:BinarySecurityToken>
        </wsse:Security>
    </soapenv:Header>
    <soapenv:Body>
        <p61:echo xmlns:p61="http://services.cna.com">
            <p61:request>my echo</p61:request>
        </p61:echo>
    </soapenv:Body>
</soapenv:Envelope> 
Inside echo service my echo
Caller Identity bob
Execution Identity boris
Inside Service destroy method
Done invoking service return my echo
      

                
using System;
using System.Net;
using Microsoft.Web.Services2.Security.Tokens;
using secureClient.EchoService;

namespace secureClient
{
    class secureClient{
    
        static void Main(string[] args){
            string request = "my echo request";
            EchoServiceServiceWse service = new EchoServiceServiceWse();
            service.Url = 
                    "http://localhost:9080/SecureServiceProvider/services/EchoService";

            // Установить сетевые полномочия
            NetworkCredential credentials = new NetworkCredential("bob","bobbob");
            service.Credentials = credentials;

            // Создать и установить маркер userName 
            UsernameToken token = new UsernameToken( "alice", "alicealice", 
                                                       PasswordOption.SendPlainText);
            service.RequestSoapContext.Security.Tokens.Add(token);
            string reply = service.echo(request);
        }
    }
}
      

                
<wsse:Security soap:mustUnderstand="1"
    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
    xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
    xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing"
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-
                                                                        secext-1.0.xsd"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-
                                                                        utility-1.0.xsd"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <wsu:Timestamp wsu:Id="Timestamp-7ffcec19-5e0b-497b-a1d6-130270590788">
        <wsu:Created>2006-10-01T02:39:24Z</wsu:Created>
        <wsu:Expires>2006-10-01T02:44:24Z</wsu:Expires>
    </wsu:Timestamp>
    <wsse:UsernameToken
        wsu:Id="SecurityToken-287911b6-1343-4ab1-b28b-1897de103b93" 
        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
                                                           wssecurity-utility-1.0.xsd">
        <wsse:Username>alice</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
            wss-username-token-profile-1.0#PasswordText">alicealice</wsse:Password>
        <wsse:Nonce>5UlY0kemIcMYfVB6v5kPtw==</wsse:Nonce>
        <wsu:Created>2006-10-01T02:39:25Z</wsu:Created>
    </wsse:UsernameToken>
</wsse:Security>
      

                
Inside Service init method 
user is bob
SOAP message is 
<soap:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" 
            xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" 
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
            xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
            xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" 
            xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
                                                              wssecurity-secext-1.0.xsd" 
            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
                                                            wssecurity-utility-1.0.xsd">
    <soap:Header>
        <wsa:Action/>
        <wsa:MessageID>uuid:e4eaa82a-9984-458a-9a8e-a9f0534ebed5</wsa:MessageID>
        <wsa:ReplyTo>
            <wsa:Address>http://schemas.xmlsoap.org/ws/2004/03/addressing/
                                                          role/anonymous</wsa:Address>
        </wsa:ReplyTo>
        <wsa:To>http://localhost:9080/SecureServiceProvider/services/EchoService</wsa:To>
        <wsse:Security soap:mustUnderstand="1">
            <wsu:Timestamp wsu:Id="Timestamp-7ffcec19-5e0b-497b-a1d6-130270590788">
                <wsu:Created>2006-10-01T02:39:24Z</wsu:Created>
                <wsu:Expires>2006-10-01T02:44:24Z</wsu:Expires>
            </wsu:Timestamp>
            <wsse:UsernameToken 
                wsu:Id="SecurityToken-287911b6-1343-4ab1-b28b-1897de103b93" 
                         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
                                                        wss-wssecurity-utility-1.0.xsd">
                <wsse:Username>alice</wsse:Username>
                <wsse:Password 
                    Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
                    username-token-profile-1.0#PasswordText">alicealice</wsse:Password>
                <wsse:Nonce>5UlY0kemIcMYfVB6v5kPtw==</wsse:Nonce>
                <wsu:Created>2006-10-01T02:39:25Z</wsu:Created>
            </wsse:UsernameToken>
        </wsse:Security>
    </soap:Header>
    <soap:Body>
        <echo xmlns="http://services.cna.com">
            <request>my echo request</request>
		</echo>
    </soap:Body>
</soap:Envelope>
Inside echo service my echo request
Caller Identity bob
Execution Identity alice
Inside Service destroy method