CXF With UsernameToken (Interceptor)

CXF With UsernameToken (Interceptor) explains about step by step details of securing a Web service using UsernameToken Interceptor

CXF gives two different techniques for adding UsernameToken

1) WS-SecurityPolicy -> In WS-SecurityPolicy, we are applying on WSDL 
level, Here we are defining WS-SecurityPolicy elements on WSDL and 
implement the security mechanism. This could be the best approach 
because client can able to understand which security mechanism is 
implemented and client can able to proceed accordingly.

2) Using CXF interceptors -> Here we are manually adding security 
mechanism to CXF interceptors,the problem on this approach client 
cant able to understand which security mechanism is implemented 
because it is not available on wsdl

If you are interested to add WS-Security on WSDL level using WS-SecurityPolicy, you can use following article

CXF With UsernameToken (WS-Security Policy)

Required Libraries

You need to download

  1. JDK 6
  2. Eclipse 3.7
  3. CXF-2.7.3
  4. Tomcat 7

Following jar must be in ClassPath

  1. commons-logging-1.1.1.jar
  2. cxf-2.7.3.jar
  3. httpasyncclient-4.0-beta3.jar
  4. httpclient-4.2.1.jar
  5. httpcore-4.2.2.jar
  6. httpcore-nio-4.2.2.jar
  7. jaxb-api-2.2.6.jar
  8. jaxb-impl-2.2.6.jar
  9. neethi-3.0.2.jar
  10. spring-aop-3.0.7.RELEASE.jar
  11. spring-asm-3.0.7.RELEASE.jar
  12. spring-beans-3.0.7.RELEASE.jar
  13. spring-context-3.0.7.RELEASE.jar
  14. spring-core-3.0.7.RELEASE.jar
  15. spring-expression-3.0.7.RELEASE.jar
  16. spring-web-3.0.7.RELEASE.jar
  17. wsdl4j-1.6.2.jar
  18. wss4j-1.6.9.jar
  19. xmlschema-core-2.0.3.jar
  20. xmlsec-1.5.3.jar

CXF With UsernameToken (Interceptor) Tutorial

I am creating a sample web service project that pass Student object and return with some changes on that object. The service is using simple POJO (Plain Old Java Object) bean.

Firstly create a Dynamic Web Project (File->New->Dynamic Web Project) named "CXFTutorial" according to following screenshot

CXF With UsernameToken (Interceptor) CXF With UsernameToken (Interceptor)

Create a Student Object

package com.student;

public class Student {
private String name;
public String getName() {
return name;
public void setName(String name) { = name;

Create a Service Interface

This service interface will defines which methods of web service, to be invoked by the client

package com.student;

import javax.jws.WebService;

public interface ChangeStudentDetails {
Student changeName(Student student);

Implement the Service Interface

Here we implement the service interface created on the previous step

package com.student;

import javax.jws.WebService;

@WebService(endpointInterface = "com.student.ChangeStudentDetails")
public class ChangeStudentDetailsImpl implements ChangeStudentDetails {
public Student changeName(Student student) {
student.setName("Hello "+student.getName());
return student;

Create ServerPasswordCallback

package service;


public class ServerPasswordCallback implements CallbackHandler {

public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];

if ("joe".equals(pc.getIdentifier())) {
System.out.println("pc.getPassword() " + pc.getPassword());

Create a cxf.xml

Here we are adding

<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="passwordCallbackRef">
	<ref bean="myPasswordCallback" />

created myPasswordCallback bean in order to check the username token credentials

<beans xmlns="" xmlns:cxf=""
	xmlns:jaxws="" xmlns:soap=""
	xmlns:wsa="" xmlns:xsi=""
	<bean class="org.apache.cxf.interceptor.LoggingInInterceptor" id="loggingInInterceptor" />
	<bean class="org.apache.cxf.interceptor.LoggingOutInterceptor" id="logOutInterceptor" />
			<ref bean="loggingInInterceptor" />
			<ref bean="logOutInterceptor" />
	<jaxws:endpoint address="/ChangeStudent" id="changeStudent"
			<entry key="ws-security.callback-handler" value-ref="myPasswordCallback" />
		<!--Added interceptor below -->
			<bean class="">
						<entry key="action" value="UsernameToken" />
						<entry key="passwordType" value="PasswordText" />
						<entry key="passwordCallbackRef">
							<ref bean="myPasswordCallback" />
	<!--Added callback for checking the usernametoken credential -->
	<bean class="com.student.ServerPasswordCallback" id="myPasswordCallback" />


Change the web.xml file to find CXF servlet and cxf.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi=""
    xmlns="" xmlns:web=""
    id="WebApp_ID" version="3.0">




Publishing CXF Web Service

CXF UsernameToken Interceptor structure


You can Find all the deployed JAX-WS/JAX-RS services you need to append 'services' at the end of the URL so URL will become following


Deployed CXF Web Service

Deployed CXF With UsernameToken (Interceptor)

Now we are using soapUI for testing CXF UsernameToken example

Create soapUI Project and add WSDL

New soapUI Project CXF With UsernameToken (Interceptor) soapUI


On following screenshot, you can see the blue lines, which is specifying username as "joe", password as "joespassword" and WSS-Password Type as "PasswordText"

soapUI With UsernameToken


You can also use wsimport tool for testing this service. Only thing need to change is modify the Main class according to below class

package com.client;

import java.util.Map;

import com.student.ChangeStudentDetails;
import com.student.ChangeStudentDetailsImplService;
import com.student.Student;
//CXF With UsernameToken (Interceptor)
public class Main {
public static void main(String[] args) {
ChangeStudentDetailsImplService service = new ChangeStudentDetailsImplService();
    ChangeStudentDetails changeStudentDetailsImplPort = service.getChangeStudentDetailsImplPort

    Map ctx =
((BindingProvider) changeStudentDetailsImplPort).getRequestContext();
("ws-security.username", "joe");
("ws-security.password", "joespassword");

    Student student =
new Student();
    student = changeStudentDetailsImplPort.changeName


Hello Rockey


4 Responses to "CXF With UsernameToken (Interceptor)"
  1. Kumar 2012-08-17 09:57:29.0
  1. admin 2012-08-18 09:57:29.0
  1. Sunil Gulabani 2012-08-19 09:57:29.0
  1. admin 2012-08-20 09:57:29.0

Your email address will not be published. Required fields are marked *