Support for EncryptedKey in RequestedProofToken (WS-SecureConversation SCT)

Hello,
in WS-SecureConversation scenario, when the web
service provider issues an EncryptedKey element for
RequestedProofToken in the RSTR/SCT response. Metro (2.0) fails to
validate it and I realized by looking at the
com.sun.xml.ws.security.secconv.WSSCClientContract class (getKey()
method) that this may not be supported yet:

[BEGIN EXCERPT FROM THE SOURCE]
...
private byte[] getKey(final RequestSecurityTokenResponse rstr, final
RequestedProofToken proofToken, final RequestSecurityToken rst) throws
UnsupportedOperationException, WSSecureConversationException,
WSSecureConversationException, UnsupportedOperationException {
byte[] key = null;
if (proofToken != null){
final String proofTokenType = proofToken.getProofTokenType();
if (RequestedProofToken.COMPUTED_KEY_TYPE.equals(proofTokenType))

{ key = computeKey(rstr, proofToken, rst); }

else if
(RequestedProofToken.TOKEN_REF_TYPE.equals(proofTokenType))

{ //ToDo throw new UnsupportedOperationException("To Do"); } else if
(RequestedProofToken.ENCRYPTED_KEY_TYPE.equals(proofTokenType)){ //ToDo throw new UnsupportedOperationException("To Do"); }

else if
(RequestedProofToken.BINARY_SECRET_TYPE.equals(proofTokenType))

{ final BinarySecret binarySecret = proofToken.getBinarySecret(); key = binarySecret.getRawValue(); }

else

{ log.log(Level.SEVERE, LogStringsMessages.WSSC_0003_INVALID_PROOFTOKEN(proofTokenType)); throw new WSSecureConversationException(LogStringsMessages.WSSC_0003_INVALID_PROOFTOKEN(proofTokenType)); }

}
return key;
}
...
[END EXCERPT FROM THE SOURCE]

I thought this was implemented somewhere in the code, since in the
Netbeans WSIT plugin, you can enable "Encrypt Issued Key" in the STS
configuration. So logically, I thought this would be supported on the
client side as well.

I have an example of STS product that uses this.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[2.0]

Source: [https://github.com/javaee/metro-wsit/issues/1398](https://github.com/javaee/metro-wsit/issues/1398)
Author: glassfishrobot

Start in com.sun.xml.ws.security.secconv.WSSCClientContract, specifically getKey(), and trace how RequestedProofToken values are handled in the RSTR/SCT response. Compare the existing proof-token branches with the EncryptedKey case and verify completion against the Metro 2.0 scenario where an issued EncryptedKey must be validated by the client.

Written by the indexing model from the issue text.