Element child = DOMUtils.getFirstElement(el);
while (child != null) {
if (SPConstants.USERNAME_TOKEN.equals(child.getLocalName())
&& WSConstants.WSSE_NS.equals(child.getNamespaceURI())) {
try {
final UsernameTokenPrincipal princ = getPrincipal(child, message);
if (princ != null) {
List<WSSecurityEngineResult>v = new ArrayList<WSSecurityEngineResult>();
int action = WSConstants.UT;
if (princ.getPassword() == null) {
action = WSConstants.UT_NOPASSWORD;
}
v.add(0, new WSSecurityEngineResult(action, princ, null, null, null));
List<WSHandlerResult> results = CastUtils.cast((List<?>)message
.get(WSHandlerConstants.RECV_RESULTS));
if (results == null) {
results = new ArrayList<WSHandlerResult>();
message.put(WSHandlerConstants.RECV_RESULTS, results);
}
WSHandlerResult rResult = new WSHandlerResult(null, v);
results.add(0, rResult);
assertTokens(message, princ, false);
message.put(WSS4JInInterceptor.PRINCIPAL_RESULT, princ);
SecurityContext sc = message.get(SecurityContext.class);
if (sc == null || sc.getUserPrincipal() == null) {
String nonce = null;
if (princ.getNonce() != null) {
nonce = Base64.encode(princ.getNonce());
}
Subject subject = createSubject(princ.getName(), princ.getPassword(),
princ.isPasswordDigest(), nonce, princ.getCreatedTime());
message.put(SecurityContext.class,
createSecurityContext(princ, subject));
}
}