Provide enhanced ability to suppress MEX call and/or hardcode STS for the WSC to use.

Hello, CXF has recently developed its own STS ([http://www.jroller.com/gmazza/entry/cxf_sts_tutorial](http://www.jroller.com/gmazza/entry/cxf_sts_tutorial)) and I was researching interoperability between Metro WSC and WSP's and CXF STSs, just as I had earlier with CXF WSC's and WSP's against a Metro STS ([http://www.jroller.com/gmazza/entry/cxf_stsclient_metro_sts](http://www.jroller.com/gmazza/entry/cxf_stsclient_metro_sts)).

In com.sun.xml.ws.security.trust.impl.client.DefaultSTSIssuedTokenConfiguration, method parseAssertions(IssuedToken issuedToken, PolicyAssertion localToken), the preconfiguredSTS information declared in the client-side policy wsit-client.xml, for example:

(in the DoubleIt.xml file explained here: [http://www.jroller.com/gmazza/entry/metro_sts_tutorial#MetroSTS7](http://www.jroller.com/gmazza/entry/metro_sts_tutorial#MetroSTS7))

will be **ignored** if the client finds an issuer element in the Policy file in the WSP's WSDL, for example:

...

[http://localhost:8080/DoubleItSTS/X509_SOAP12](http://localhost:8080/DoubleItSTS/X509_SOAP12)

[http://localhost:8080/DoubleItSTS/X509_SOAP12](http://localhost:8080/DoubleItSTS/X509_SOAP12)

If the Issuer element is commented out, then the PreconfiguredSTS information is used instead. Further, if the user defines the wsdlLocation, serviceName, and portName attributes within PreconfiguredSTS, **no** MEX call is made, just the simple ?wsdl query instead. (See the top of com.sun.xml.ws.security.trust.impl.client.DefaultSTSIssuedTokenConfiguration for the full range of configuration elements available.)

As MEX calls are not always compatible between different STS' (Metro is presently having problems with CXF's very new MetadataExchange support, I'm not sure where the problem is yet), I would like the option to be able to suppress the MEX call and just have the direct WSC -> STS security token request call made, without needing to comment-out the Issuer element on the WSP's WSDL (something I can't always do, esp. if the wsdl is retrieved via an HTTP call.) There are three ways I see this can be done:

1.) Giving PreconfiguredSTS precedence over the Issuer element in the WSP's WSDL – i.e., if a user goes out of his way to declare the PreconfiguredSTS, it's assumed that should take supercede any other Issuer policy element. This would allow me to declare the three aforementioned elements in my PreconfiguredSTS element to suppress the MEX call, as well as, generally, allow users to hardcode the STS to use regardless of what the WSP's policy is stating.

2.) Adding a new element to PreconfiguredSTS, hasPrecedence (or whatever you want to call it), defaulted to "false" for backwards compatibility, that if set, will cause the PreconfiguredSTS information to have precedence as explained in (1) above.

or

3.) Within PreconfiguredSTS, providing a new "suppressMEXCall" option, defaulted to "false", that if true will only make the standard ?wsdl call instead of a MEX one, either using the endpoint specified in the Issuer element (as it currently has precedence), or the information in PreconfiguredSTS (wsdlLocation, serviceName, portName) in order to make the STS token request (if no Issuer element available). If there's insufficient information for the WSC to make an STS token request under those circumstances, for the Metro WSC to halt with an error message instead.
#### Environment
Ubuntu Linux Java 6
#### Affected Versions
[2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1586](https://github.com/javaee/metro-wsit/issues/1586)
Author: glassfishrobot

Start in com.sun.xml.ws.security.trust.impl.client.DefaultSTSIssuedTokenConfiguration, especially parseAssertions(IssuedToken issuedToken, PolicyAssertion localToken), and review how PreconfiguredSTS and the WSP's Issuer are selected. Compare the three proposed precedence and MEX-suppression options, then define the configuration and error behavior needed for a direct WSC-to-STS request without MEX.

Written by the indexing model from the issue text.