Ws-Security headers using Metro

Question

I have a web service which implements WS-Security but does not define a policy in the WSDL. I am able to consume this web service successfully using Axis 2 as client.

I am trying to consume the same web service using Metro 2 but the wsse:security headers are not going. It works only if the service defines the security policy which is not under my control. I tested this by creating a sample web service and unless I define the policy my metro client never sends the wsse:security headers.

Is there anything I am missing using Metro?

EDIT------------------------------------------------------------------------------------------

I created a local copy of the wsdl and in that defined the policy. I created the web service client using this wsdl but still the security headers are not going. The wsit-client.xml file looks fine. I even compared all the configurations with the client of a webservice which defines policy and the configurations are same but still it doesn't work. As of now my conclusion is that the metro client needs the actual web service defines a policy.

EDIT----------------------------------------------------------------------------------------

Content of wsit-client.xml

<?xml version="1.0" encoding="UTF-8"?> 
<definitions 
xmlns="http://schemas.xmlsoap.org/wsdl/" 
xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" name="mainclientconfig"
>
<import location="NewWebService.xml" namespace="http://test.com/"/>

The NewWebService.xml is located along with wsit-client.xml and contains following policy information

<wsp:Policy wsu:Id="NewWebServicePortBindingPolicy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sc:CallbackHandlerConfiguration wspp:visibility="private">
                    <sc:CallbackHandler default="dsfsd" name="usernameHandler"/>
                    <sc:CallbackHandler default="sdfsdfds" name="passwordHandler"/>
                </sc:CallbackHandlerConfiguration>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>

which is referred in the binding like this -

<binding name="NewWebServicePortBinding" type="tns:NewWebService">
    <wsp:PolicyReference URI="#NewWebServicePortBindingPolicy"/>

The changed wsdl contains this policy -

<wsp:Policy xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" wsu:Id="NewWebServicePortBindingPolicy"> 
    <sp:SignedEncryptedSupportingTokens> 
        <wsp:Policy> 
            <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"> 
                <wsp:Policy> 
                    <sp:WssUsernameToken10 /> 
                </wsp:Policy> 
            </sp:UsernameToken> 
        </wsp:Policy> 
    </sp:SignedEncryptedSupportingTokens> 
    <sp:TransportBinding> 
        <wsp:Policy> 
            <sp:AlgorithmSuite> 
                <wsp:Policy> 
                    <sp:Basic128 /> 
                </wsp:Policy> 
            </sp:AlgorithmSuite> 
            <sp:IncludeTimestamp /> 
            <sp:Layout> 
                <wsp:Policy> 
                    <sp:Lax /> 
                </wsp:Policy> 
            </sp:Layout> 
            <sp:TransportToken> 
                <wsp:Policy> 
                    <sp:HttpsToken RequireClientCertificate="false" /> 
                </wsp:Policy> 
            </sp:TransportToken> 
        </wsp:Policy> 
    </sp:TransportBinding> 
    <sp:Wss10 /> 
    <wsam:Addressing wsp:Optional="true" /> 
</wsp:Policy> 

Answer 1

You'll need to add the ws:Policy to a local copy of the WSDL and to your wsit-client.xml. This thread (and this answer in particular) might help you to setup the whole thing.

Answer 2

Try taking a look my a question I wrote here on a very similar situation - Calling a .NET web service (WSE 3.0, WS-Security) from JAXWS-RI. I'm still(!) trying to work through it b/c I'm getting an error from the server side now, but I updated the question with some detail on the process I've gone through trying to get this working. There's a link there to a post I put on the Metro java.net forums that was helpful to me. I was able to get the wsse headers generating for me, though.

In short, I think that including the ws:Policy section in your local copy of the WSDL (and sending that WSDL as a param when you create the Service). Here's a code snippet where I create my client objects - had to be simplistic here, 'cause I"m using Spring factories to inject the client reference into another service, anyway, here's the jist:

String wsdlDocumentLocation = "localVersion.wsdl";
QName serviceName = new QName("mynamespace", "myServiceName");
Service service = Service.create(wsdlDocumentLocation, serviceName);
//send the port the fully qualified name of the Metro generated
//client interface
Object port = service.getPort("my.client.package.ClientServiceInterface");

That, along with your wsit-client.xml should work. Where are you putting your wsit-client.xml file? If it's on the classpath (mine is in WEB-INF/classes), you should see a log statement in the console that says that it's being read. Here's the message I see in my console:

[13:12:06.779] WSP5018: Loaded WSIT configuration from file: file:/C:/projects/target/my-webapp/WEB-INF/classes/wsit-client.xml.