title: Writing a standalone Java client to access a secured WCF webservice using SAML2 token
body: <p>I am trying to access a secured Windows Common Foundation (WCF) web service written on a .NET platform by using a plain Java client and Metro Web service API (webservices-rt-2.2.0-1)</p>
  
  <p>Using the WSDL of the WCF web service with  ant targets, I was able to generate the web service artifacts.</p>
  
  <p>In order to access the WCF web service, I need to insert a SAML2 token into the SOAP request. This SAML2 token is retrieved by accessing a REST service, whose response contains the SAML2 assertion. At the moment I have the token with me as a String object (the entire Assertion XML)</p>
  
  <pre><code>My client code looks something like this:
   MyService service = new MyService(new URL(wsdlLocation), new QName("http://tempuri.org/",
          "MyService"));
  
  IMyService port = service.getCustomBindingIMyService();
  
  port.callMyServiceApi();
  </code></pre>
  
  <p>This code was throwing the following error:
  WST0029:STS location could not be obtained from either IssuedToken or from client</p>
  
  <p>Due to this I modified my code to the following:</p>
  
  <pre><code>MyService service = new MyService(new URL(wsdlLocation), new QName("http://tempuri.org/",
          "MyService"));
  
  DefaultSTSIssuedTokenConfiguration config = new DefaultSTSIssuedTokenConfiguration(stsEndpointAddress, wsdl, "MyService","CustomBinding_IMyService","http://tempuri.org/");
  
  STSIssuedTokenFeature feature = new STSIssuedTokenFeature(config);
  IMyService  port = service.getCustomBindingIMyService(new WebServiceFeature[]{feature});
  
  port.getApiVersion();
  </code></pre>
  
  <p>With the above, the STS location error went away, but the following error was seen.
  Exception in thread "main" javax.xml.ws.WebServiceException: java.lang.NullPointerException
          at com.sun.xml.wss.jaxws.impl.SecurityClientTube.processRequest(SecurityClientTube.java:250)
          at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:961)
          at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:910)
          at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:873)
          at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:775)
          at com.sun.xml.ws.client.Stub.process(Stub.java:429)
          at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:168)
          at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:119)
          at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:102)
          at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:151)
          at $Proxy44.getApiVersion(Unknown Source)
          at TnTActionsClient.callTnT(TnTActionsClient.java:426)
          at TnTActionsClient.main(TnTActionsClient.java:447)
  Caused by: java.lang.NullPointerException
          at com.sun.xml.ws.security.trust.impl.WSTrustClientContractImpl.setLifetime(WSTrustClientContractImpl.java:215)
          at com.sun.xml.ws.security.trust.impl.WSTrustClientContractImpl.handleRSTR(WSTrustClientContractImpl.java:145)
          at com.sun.xml.ws.security.trust.impl.TrustPluginImpl.process(TrustPluginImpl.java:177)
          at com.sun.xml.ws.security.trust.impl.client.STSIssuedTokenProviderImpl.getIssuedTokenContext(STSIssuedTokenProviderImpl.java:144)
          at com.sun.xml.ws.security.trust.impl.client.STSIssuedTokenProviderImpl.issue(STSIssuedTokenProviderImpl.java:74)
          at com.sun.xml.ws.api.security.trust.client.IssuedTokenManager.getIssuedToken(IssuedTokenManager.java:83)
          at com.sun.xml.wss.jaxws.impl.SecurityClientTube.invokeTrustPlugin(SecurityClientTube.java:685)
          at com.sun.xml.wss.jaxws.impl.SecurityClientTube.processClientRequestPacket(SecurityClientTube.java:281)
          at com.sun.xml.wss.jaxws.impl.SecurityClientTube.processRequest(SecurityClientTube.java:247)
          ... 12 more</p>
  
  <p>I have turned on logging of the SOAP messages and on checking of the request I see that no security related info is going into the request.
  A Failure response is being returned from the Web service endpoint indicating that Invalid Security is present in the request.</p>
  
  <p>I am wondering:
  1. Am I on the right track with my client so far?
  2. What is the best way to call my REST service and parse the response for the SAML2 token?
  3. How do I set the SAML2 token from step 2 into my web service all?</p>
  
  <p>As per the implementers of the WCF web service, they are using WS-Security and not Federated security.
  The SAML2 token received looks something like this:</p>
  
  <pre><code>&lt;wsse:Security soap:mustUnderstand="true"
          xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
          &lt;Assertion ID="_909088b3-d972-4b6f-84b1-26301c1c3b69"
                  IssueInstant="2012-10-16T12:32:44.293Z" Version="2.0"
                  xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
                  &lt;Issuer&gt;xyz:appl:identity&lt;/Issuer&gt;
                  &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
                          &lt;ds:SignedInfo&gt;
                                  &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
                                  &lt;ds:Reference URI="#_909088b3-d972-4b6f-84b1-26301c1c3b69"&gt;
                                          &lt;ds:Transforms&gt;
                                                  &lt;ds:Transform
                                                          Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                                                  &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                                          &lt;/ds:Transforms&gt;
                                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                                          &lt;ds:DigestValue&gt;some_value_here&lt;/ds:DigestValue&gt;
                                  &lt;/ds:Reference&gt;
                          &lt;/ds:SignedInfo&gt;
                          &lt;ds:SignatureValue&gt;sig_here&lt;/ds:SignatureValue&gt;
                          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                                  &lt;X509Data&gt;
                                          &lt;X509Certificate&gt;certHere&lt;/X509Certificate&gt;
                                  &lt;/X509Data&gt;
                          &lt;/KeyInfo&gt;
                  &lt;/ds:Signature&gt;
                  &lt;Subject&gt;
                          &lt;NameID
                                  Format="http://schemas.xyz.com/2009/09/Identity/Format/Idm/InsightUserName"&gt;user222&lt;/NameID&gt;
                          &lt;SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /&gt;
                  &lt;/Subject&gt;
                  &lt;Conditions NotBefore="2012-10-16T12:32:44.293Z"
                          NotOnOrAfter="2022-01-01T12:00:00.000Z"&gt;
                          &lt;AudienceRestriction&gt;
                                  &lt;Audience&gt;uri:samlclient.xyzbadal.com&lt;/Audience&gt;
                          &lt;/AudienceRestriction&gt;
                  &lt;/Conditions&gt;
                  &lt;AttributeStatement&gt;
                          &lt;Attribute
                                  Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"&gt;
                                  &lt;AttributeValue&gt;user222&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"&gt;
                                  &lt;AttributeValue&gt;user222&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"&gt;
                                  &lt;AttributeValue&gt;support@abc.com&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/CustomerId"&gt;
                                  &lt;AttributeValue&gt;11209&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/InsightUserId"&gt;
                                  &lt;AttributeValue&gt;1&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/NameIdFormat"&gt;
                                  &lt;AttributeValue&gt;http://schemas.xyz.com/2009/09/Identity/Format/Idm/InsightUserName&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/HasProfile"&gt;
                                  &lt;AttributeValue&gt;True&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/Password"&gt;
                                  &lt;AttributeValue&gt;test1&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/HasPassword"&gt;
                                  &lt;AttributeValue&gt;True&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/LocaleName"&gt;
                                  &lt;AttributeValue&gt;en-US&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/HasCredential"&gt;
                                  &lt;AttributeValue&gt;false&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/InternalReferenceId"&gt;
                                  &lt;AttributeValue&gt;user222&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"&gt;
                                  &lt;AttributeValue&gt;CustomiseUI&lt;/AttributeValue&gt;
                                  &lt;AttributeValue&gt;EditConfiguration&lt;/AttributeValue&gt;
                                  ...
                          &lt;/Attribute&gt;
                          &lt;Attribute
                                  Name="http://schemas.xyz.com/2009/09/Identity/Claims/ProfileUrl"&gt;
                                  &lt;AttributeValue&gt;https://identity.com/able/&lt;/AttributeValue&gt;
                          &lt;/Attribute&gt;
                  &lt;/AttributeStatement&gt;
                  &lt;AuthnStatement AuthnInstant="2012-10-16T12:32:44.000Z"
                          SessionNotOnOrAfter="2022-01-01T12:00:00.000Z"&gt;
                          &lt;AuthnContext&gt;
                                  &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/AuthnContextClassRef&gt;
                          &lt;/AuthnContext&gt;
                  &lt;/AuthnStatement&gt;
          &lt;/Assertion&gt;
  &lt;/wsse:Security&gt;
  </code></pre>
  
  <p>I have been given a couple of WSDL files. Snippets are pasted below:
  WSDL 1:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;wsdl:definitions targetNamespace="http://schemas.xyz.com/TrackMe/2010/06/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:wsa10="http://www.w3.org/2005/08/addressing" xmlns:tns="http://schemas.xyz.com/TrackMe/2010/06/" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"&gt;
    &lt;wsdl:types&gt;
      &lt;xsd:schema targetNamespace="http://schemas.xyz.com/TrackMe/2010/06/Imports"&gt;
        &lt;xsd:import schemaLocation="TrackMe.xsd" namespace="http://schemas.xyz.com/TrackMe/2010/06/"/&gt;
        &lt;xsd:import schemaLocation="TrackMe_1_2_3_4.xsd" namespace="http://schemas.xyz.com/shs/api"/&gt;
        &lt;xsd:import schemaLocation="TrackMe_1_2.xsd" namespace="http://schemas.microsoft.com/2003/10/Serialization/"/&gt;
        &lt;xsd:import schemaLocation="TrackMe_1.xsd" namespace="http://schemas.xyz.com/TrackMe/2010/06/Data"/&gt;
        &lt;xsd:import schemaLocation="TrackMe_1_2_3_4_5.xsd" namespace="http://schemas.datacontract.org/2004/07/xyz.Validation"/&gt;
        &lt;xsd:import schemaLocation="TrackMe_1_2_3.xsd" namespace="http://schemas.datacontract.org/2004/07/xyz.TrackMe.PublicApiService.Contract"/&gt;
      &lt;/xsd:schema&gt;
    &lt;/wsdl:types&gt;
    &lt;wsdl:message name="IMyService_GetApiVersion_InputMessage"&gt;
      &lt;wsdl:part name="parameters" element="tns:GetApiVersion"/&gt;
    &lt;/wsdl:message&gt;
    &lt;wsdl:message name="IMyService_GetApiVersion_OutputMessage"&gt;
      &lt;wsdl:part name="parameters" element="tns:GetApiVersionResponse"/&gt;
    &lt;/wsdl:message&gt;
    &lt;wsdl:message name="IMyService_GetApiVersion_FaultDetailFault_FaultMessage"&gt;
      &lt;wsdl:part name="detail" element="q2:Fault" xmlns:q2="http://schemas.xyz.com/shs/api"/&gt;
    &lt;/wsdl:message&gt;
    ....
   &lt;wsdl:operation name="GetApiVersion"&gt;
        &lt;wsdl:input wsaw:Action="http://schemas.xyz.com/TrackMe/2010/06/IMyService/GetApiVersion" message="tns:IMyService_GetApiVersion_InputMessage"/&gt;
        &lt;wsdl:output wsaw:Action="http://schemas.xyz.com/TrackMe/2010/06/IMyService/GetApiVersionResponse" message="tns:IMyService_GetApiVersion_OutputMessage"/&gt;
        &lt;wsdl:fault wsaw:Action="http://schemas.xyz.com/TrackMe/2010/06/IMyService/GetApiVersionFaultDetailFault" name="FaultDetailFault" message="tns:IMyService_GetApiVersion_FaultDetailFault_FaultMessage"/&gt;
      &lt;/wsdl:operation&gt;
      ...
    &lt;/wsdl:portType&gt;
  &lt;/wsdl:definitions&gt;
  </code></pre>
  
  <p>WSDL 2:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;wsdl:definitions name="MyService" targetNamespace="http://tempuri.org/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:wsa10="http://www.w3.org/2005/08/addressing" xmlns:tns="http://tempuri.org/" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:i0="http://schemas.xyz.com/TrackMe/2010/06/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"&gt;
    &lt;wsp:Policy wsu:Id="CustomBinding_IMyService_policy"&gt;
      &lt;wsp:ExactlyOne&gt;
        &lt;wsp:All&gt;
          &lt;sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:TransportToken&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:HttpsToken/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:TransportToken&gt;
              &lt;sp:AlgorithmSuite&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:Basic256/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:AlgorithmSuite&gt;
              &lt;sp:Layout&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:Strict/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:Layout&gt;
              &lt;sp:IncludeTimestamp/&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:TransportBinding&gt;
          &lt;sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
                &lt;sp:RequestSecurityTokenTemplate&gt;
                  &lt;trust:TokenType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0&lt;/trust:TokenType&gt;
                  &lt;trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer&lt;/trust:KeyType&gt;
                &lt;/sp:RequestSecurityTokenTemplate&gt;
                &lt;wsp:Policy&gt;
                  &lt;sp:RequireInternalReference/&gt;
                &lt;/wsp:Policy&gt;
              &lt;/sp:IssuedToken&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:SignedSupportingTokens&gt;
          &lt;sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
            &lt;wsp:Policy/&gt;
          &lt;/sp:Wss11&gt;
          &lt;sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
            &lt;wsp:Policy&gt;
              &lt;sp:MustSupportIssuedTokens/&gt;
              &lt;sp:RequireClientEntropy/&gt;
              &lt;sp:RequireServerEntropy/&gt;
            &lt;/wsp:Policy&gt;
          &lt;/sp:Trust13&gt;
          &lt;wsaw:UsingAddressing/&gt;
        &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
    &lt;/wsp:Policy&gt;
    &lt;wsdl:import namespace="http://schemas.xyz.com/TrackMe/2010/06/" location="TrackMe.wsdl"/&gt;
    &lt;wsdl:types/&gt;
    &lt;wsdl:binding name="CustomBinding_IMyService" type="i0:IMyService"&gt;
      &lt;wsp:PolicyReference URI="#CustomBinding_IMyService_policy"/&gt;
      &lt;soap12:binding transport="http://schemas.xmlsoap.org/soap/http"/&gt;
      ...
       &lt;wsdl:operation name="GetApiVersion"&gt;
        &lt;soap12:operation soapAction="http://schemas.xyz.com/TrackMe/2010/06/IMyService/GetApiVersion" style="document"/&gt;
        &lt;wsdl:input&gt;
          &lt;soap12:body use="literal"/&gt;
        &lt;/wsdl:input&gt;
        &lt;wsdl:output&gt;
          &lt;soap12:body use="literal"/&gt;
        &lt;/wsdl:output&gt;
        &lt;wsdl:fault name="FaultDetailFault"&gt;
          &lt;soap12:fault name="FaultDetailFault" use="literal"/&gt;
        &lt;/wsdl:fault&gt;
      &lt;/wsdl:operation&gt;
      ....
       &lt;/wsdl:binding&gt;
    &lt;wsdl:service name="MyService"&gt;
      &lt;wsdl:port name="CustomBinding_IMyService" binding="tns:CustomBinding_IMyService"&gt;
        &lt;soap12:address location="https://apidev2.devel.abc.com/tnt/public_api/TrackMe.svc"/&gt;
        &lt;wsa10:EndpointReference&gt;
          &lt;wsa10:Address&gt;https://apidev2.devel.abc.com/tnt/public_api/TrackMe.svc&lt;/wsa10:Address&gt;
        &lt;/wsa10:EndpointReference&gt;
      &lt;/wsdl:port&gt;
    &lt;/wsdl:service&gt;
  &lt;/wsdl:definitions&gt;
  </code></pre>
  
  <p>If you require any more information, do let me know.
  Would appreciate any help on this.
  Thanks in Advance!
  Carl.</p>