Colin's Notes

Deltek's Costpoint Web Integration Service requires a security header in the SOAP request. This document explains how I identified the required header elements and coded the Java code to add them to my Lotus Notes Java agent.

We need to send new hire employee data from a hiring web site (Lotus Notes application) to Deltek's Costpoint Web server. The Costpoint Integration Tool allows you to generate a Web Service that supports data integration to the Oracle back-end. The integration tool is built on Oracle BEA Weblogic. I used Stubby to generate the Java classes from the WSDL and then used soapUI to do a simple test of the Web Service (named EmployeeWS).

"No Security header in message but required by policy."
When testing with soapUI, I received this error message. However, the classes did not include anything to support the required security header. Being a long time LotusScript coder, but rather new to Java and Web services I was stumped. Studying the WSDL I found this section:

Figure 1. Part of the WSDL file for the EmployeeWS service.

So I read the PDF file located at the URL referenced after "TokenType=" and found that I would need to add this security information to my SOAP Header.
Using soapUI again I tested with this header:

Figure 2. Part of the SOAP Envelope showing the correct Header.

This eliminated the "No security header..." error! But how do I add this to the SOAP Header in my Java agent?

Julian Robichaux's post explaining how to do this (Stubby - Adding SOAP Header Information to a Request) got me headed in the right direction but I still had some problems because of the two node levels. After some trial and error I came up with this java code to get the headers right - see the block marked in Red:

Figure 3. This java code produces the same SOAP header as shown in Figure 2 above.

Additional References

Using Security Assertion Markup Language (SAML) Tokens For Identity
http://e-docs.bea.com/wls/docs92/webserv/security.html#wp218056

Web Services Security UsernameToken Profile 1.0
OASIS Standard 200401, March 2004
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0.pdf