}
// The default behaviour is that password verification will fail
WSSConfig wssConfig = WSSConfig.getNewInstance();
try {
verify(signedDoc, wssConfig, new UsernamePasswordCallbackHandler(), null);
fail("Failure expected on a bad password text");
} catch (WSSecurityException ex) {
assertTrue(ex.getErrorCode() == WSSecurityException.FAILED_AUTHENTICATION);
// expected
}
// Now switch out the default UsernameToken validator
wssConfig.setValidator(WSSecurityEngine.USERNAME_TOKEN, NoOpValidator.class);
verify(signedDoc, wssConfig, new UsernamePasswordCallbackHandler(), null);
}