SOAPEnvelope unsignedEnvelope = message.getSOAPEnvelope();
Document doc = unsignedEnvelope.getAsDocument();
WSSecHeader secHeader = new WSSecHeader();
secHeader.insertSecurityHeader(doc);
WSSecSecurityContextToken sctBuilder = new WSSecSecurityContextToken();
sctBuilder.prepare(doc, crypto);
SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
byte[] tempSecret = new byte[16];
random.nextBytes(tempSecret);
// Store the secret
this.secrets.put(sctBuilder.getIdentifier(), tempSecret);
String tokenId = sctBuilder.getSctId();
// Derived key encryption
WSSecDKEncrypt encrBuilder = new WSSecDKEncrypt();
encrBuilder.setSymmetricEncAlgorithm(WSConstants.AES_128);
encrBuilder.setExternalKey(tempSecret, tokenId);
encrBuilder.build(doc, crypto, secHeader);
// Derived key signature
WSSecDKSign sigBuilder = new WSSecDKSign();
sigBuilder.setExternalKey(tempSecret, tokenId);
sigBuilder.setSignatureAlgorithm(XMLSignature.ALGO_ID_MAC_HMAC_SHA1);
sigBuilder.build(doc, crypto, secHeader);
sctBuilder.prependSCTElementToHeader(doc, secHeader);
// String out = org.apache.ws.security.util.XMLUtils
// .PrettyDocumentToString(doc);
// System.out.println(out);