How to supply username and password to a WS-Security 1.0 web service using the JAX-WS RI

UsernamePasswordAdder.java

import java.util.Set;

import javax.xml.namespace.QName;
import javax.xml.soap.SOAPEnvelope;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPHeaderElement;
import javax.xml.soap.SOAPMessage;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;

public class UsernamePasswordAdder implements SOAPHandler<SOAPMessageContext> {

    private static final String NS = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
    private final String password;
    private final String username;

    public UsernamePasswordAdder(String username, String password) {
        this.username = username;
        this.password = password;
    }

    @Override
    public boolean handleMessage(SOAPMessageContext context) {
        try {
            // don't add to responses
            if (!(Boolean) context
                .get(MessageContext.MESSAGE_OUTBOUND_PROPERTY)) {
                return true;
            }

            SOAPMessage message = context.getMessage();
            SOAPHeader header = message.getSOAPHeader();
            SOAPEnvelope envelope = message.getSOAPPart().getEnvelope();
            if (header == null) {
                header = envelope.addHeader();
            }

            SOAPHeaderElement securityHeader = header
                .addHeaderElement(new QName(NS, "Security"));
            SOAPHeaderElement userCredentials = header
                .addHeaderElement(new QName(NS, "UsernameToken"));

            SOAPHeaderElement usernameHeader = header
                .addHeaderElement(new QName(NS, "Username"));
            usernameHeader.addTextNode(username);
            SOAPHeaderElement passwordHeader = header
                .addHeaderElement(new QName(NS, "Password"));
            passwordHeader.addTextNode(password);

            userCredentials.addChildElement(usernameHeader);
            userCredentials.addChildElement(passwordHeader);
            securityHeader.addChildElement(userCredentials);

            message.saveChanges();
        } catch (SOAPException e) {
            e.printStackTrace();
        }
        return true;
    }

    @Override
    public boolean handleFault(SOAPMessageContext context) {
        return true;
    }

    @Override
    public void close(MessageContext context) {
    }

    @Override
    public Set<QName> getHeaders() {
        return null;
    }

}

Then, add this to your port's binding interface:

        @SuppressWarnings("rawtypes")
        List<Handler> handlers = binding.getBinding().getHandlerChain();
        handlers.add(new UsernamePasswordAdder(adminUserName, adminPassword));
        binding.getBinding().setHandlerChain(handlers);