How manage two assertion at the same time

Question

I was wondering how part of this policy should be interpreted. First of all, Is that part of the policy valid? What happens if I send a token10, will it work? with a token11?

I'm asking this because if I use the policy with apache cxf 2.7.x or 3.x I get "invalid policy exception" BUT if I use cxf 2.x.xxx.redhat-1 It seems to be working, my doubt is if it is normal, or red hat libraries goes against the standard.

    <wsp:Policy xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" wsu:Id="SecurityServiceSignThenEncryptPolicy">
<wsp:ExactlyOne>
    <wsp:All>
        <sp:AsymmetricBinding>
            <wsp:Policy>
                <sp:InitiatorToken>
                    <wsp:Policy>
                        <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                            <wsp:Policy>
                                <sp:WssX509V3Token10/>
                                <sp:WssX509V3Token11/>
                            </wsp:Policy>
                        </sp:X509Token>
                    </wsp:Policy>
                </sp:InitiatorToken>
                <sp:RecipientToken>
                    <wsp:Policy>
                        <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Always">
                            <wsp:Policy>
                                <sp:WssX509V3Token10/>
                                <sp:WssX509V3Token11/>
                            </wsp:Policy>
                        </sp:X509Token>
                    </wsp:Policy>
                </sp:RecipientToken>
                <sp:AlgorithmSuite>
                    <wsp:Policy>
                        <sp:Basic128Rsa15/>
                        <sp:Basic256Rsa15/>
                        <sp:Basic128Sha256Rsa15/>
                        <sp:Basic256Sha256Rsa15/>
                    </wsp:Policy>
                </sp:AlgorithmSuite>
                <sp:Layout>
                    <wsp:Policy>
                        <sp:Lax/>
                    </wsp:Policy>
                </sp:Layout>
                <sp:IncludeTimestamp/>
                <sp:ProtectTokens/>
                <sp:OnlySignEntireHeadersAndBody/>
            </wsp:Policy>
        </sp:AsymmetricBinding>
        <sp:Wss10>
            <wsp:Policy>
                <sp:MustSupportRefKeyIdentifier/>
                <sp:MustSupportRefIssuerSerial/>
                <sp:MustSupportRefThumbprint/>
                <sp:MustSupportRefEncryptedKey/>
            </wsp:Policy>
        </sp:Wss10>
        <sp:Wss11>
            <wsp:Policy>
                <sp:MustSupportRefKeyIdentifier/>
                <sp:MustSupportRefIssuerSerial/>
                <sp:MustSupportRefThumbprint/>
                <sp:MustSupportRefEncryptedKey/>
                <sp:RequireSignatureConfirmation/>
            </wsp:Policy>
        </sp:Wss11>
    </wsp:All>
</wsp:ExactlyOne>
<wsp:Policy wsu:Id="InputBindingPolicy">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:EncryptedParts>
                <sp:Body/>
            </sp:EncryptedParts>
            <sp:SignedParts>
                <sp:Body/>
            </sp:SignedParts>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>
<wsp:Policy wsu:Id="OutputBindingPolicy">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:EncryptedParts>
                <sp:Body/>
            </sp:EncryptedParts>
            <sp:SignedParts>
                <sp:Body/>
            </sp:SignedParts>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

Answer 1

This policy is woking but only works (I can get the wsdl) with cxf 2.7-redhat libraries. But I found a bug, this library is not really working because when it scans the policy it detecs the first token and ignores the token 11 assertion.

I reported this to the provider I working with. And we change the policy to support only token 11.