new SecurityToken(assertionId, issuedAssertion, null);
Properties cryptoProps = new Properties();
URL url = ClassLoader.getSystemResource("META-INF/cxf/outsecurity.properties");
cryptoProps.load(url.openStream());
Crypto crypto = CryptoFactory.getInstance(cryptoProps);
String alias = cryptoProps.getProperty("org.apache.ws.security.crypto.merlin.keystore.alias");
issuedToken.setX509Certificate(crypto.getCertificates(alias)[0], crypto);
msg.getExchange().get(Endpoint.class).put(SecurityConstants.TOKEN_ID,
issuedToken.getId());
msg.getExchange().put(SecurityConstants.TOKEN_ID, issuedToken.getId());