CXF WSS4J interceptors vs WS-SecurityPolicy

Question

I have a question on WS-Security policy. We can implement the WS-Security using CXF WSS4J interceptors or WS-Security Policy. What will be the difference of this two approaches? I found embedding a WS-Security Policy to a wsdl is more difficult than adding the interceptors in cxf.Please make me to understand what is the different between this two? Thanks in advance

Answer 1

With WS-SecurityPolicy, the security requirements become part of the published "contract" (aka: WSDL) so consumers of the service immediately know what the requirements are. Also, because WS-SP is a lot more descriptive than the "actions" used for the WSS4JInterceptors, it can be used to describe a much much wider range of security requirements.