Interoperability issue with .NET WCF service and Java client while using transaction flow and

Hi everyone, I have a problem invoking WCF .NET 3.5 WSHttpBinding web service method, where the binding TransactionFlow and the security bu using 509 Certificate with anonymous client is enabled but the transaction is not mandatory (only support), from a Metro 2.2.1u1 standalone client. If the TransactionFlow is disabled on the .NET web service, everything works just fine. Also, works by enabling TransactionFlow and disabling the security with 509 Certificates.

It doesn't with with both features enabled.

This is the error reported:

com.sun.xml.wss.impl.PolicyViolationException: com.sun.xml.wss.XWSSecurityException:

Encryption Policy verification error: Looking for an Encryption Element in Security header, but found
com.sun.xml.wss.impl.policy.mls.SignaturePolicy

at com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:151)

I don't have an application server so I'm trying to disable transactional support by passing the TransactionalFeature to the client as follow:

TransactionalFeature feature = new TransactionalFeature(false);
feature .setFlowType(TransactionFlowType.NEVER);
feature .setVersion(Version.WSAT10);
.
IService port = (IService)service.getPort(new QName(URL, BINDING), IService.class, feature);
.
I think that the problem could be the protection order (EncryptBeforeSign instead of SignBeforeEncrypt) or an issue with empty SOAP header fields because the WSDL, when transaction flow is enabled, includes this elements:

.
that are not present when the transaction flow is disabled. In fact, there is no sp:EncryptedParts element.

Could anyone help me with this problem?
Does anybody know how to programmatically change the client protection order?
#### Affected Versions
[2.2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1660](https://github.com/javaee/metro-wsit/issues/1660)
Author: glassfishrobot

Start with the Metro 2.2.1u1 standalone client setup and the TransactionalFeature configuration shown in the report, then compare the generated policy when transaction flow and 509-certificate security are enabled. Investigate the MessagePolicyVerifier failure involving EncryptedParts and SignaturePolicy; done means reproducing the interoperability failure and documenting or validating a compatible policy/protection-order fix.

Written by the indexing model from the issue text.