if (validator != null) {
// Hook to allow the user to validate the SecurityContextToken
Credential credential = new Credential();
credential.setSecurityContextToken(sct);
Credential returnedCredential = validator.validate(credential, data);
result.put(WSSecurityEngineResult.TAG_VALIDATED_TOKEN, Boolean.TRUE);
result.put(WSSecurityEngineResult.TAG_ID, sct.getID());
result.put(WSSecurityEngineResult.TAG_SECRET, returnedCredential.getSecretKey());
} else {
byte[] secret = getSecret(data.getCallbackHandler(), sct);