Spring WS-Security visible in WSDL

Question

I've implemented authentication through WS-Security on my webservice as described at http://static.springframework.org/spring-ws/sites/1.5/reference/html/security.html, like so:

<bean id="callbackHandler" class="org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler">
    <property name="users">
        <props>
            <prop key="bart">arnie</prop>
        </props>
    </property>
</bean>

<bean id="annotationMapping" class="org.springframework.ws.server.endpoint.mapping.PayloadRootAnnotationMethodEndpointMapping">
 <property name="interceptors">
  <list>
   <bean class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
    <property name="validationActions" value="UsernameToken" />
    <property name="securementActions" value="NoSecurity" />
    <property name="validationCallbackHandler" ref="callbackHandler" />
   </bean> ...

However, clients (like SoapUI) don't know that they should use security, because it's not mentioned in the WSDL. How can I get it to be? This is how I generate it:

<bean id="qwertyService" class="org.springframework.ws.wsdl.wsdl11.DefaultWsdl11Definition">
 <property name="schemaCollection" ref="schemaCollection" />
 <property name="portTypeName" value="QwertyService" />
 <property name="locationUri" value="/QwertyService/" />
 <property name="targetNamespace" value="http://www.ead2.nl/demo/wsdl" />
</bean>

Answer 1

It is entirely possible to convey ws-security information in a wsdl!!!!!

Look at ws-policy and specifically ws-securitypolicy (the two go together)

However, i am unable to specifcally help you with the implementation.

hope this helps

Answer 2

WS-Security by itself is not placed in the WSDL. WS-Policy builds upon WS-Security, it may be possible to use these more sophisticated standards to add it to the WSDL but it doesn't sound like that is what you want.

In SOAPUI the security information is built as settings to the project. If you double click the project there is a security tab. Keys-stores can be added if you are using a PKI based scheme and you can define outgoing and incoming configurations. A pair of configurations can be applied to each message depending on what in the message you would like to secure. It seems a little clunky and buggy.

See: http://www.soapui.org/userguide/projects/wss.html