One element to sign or verify, referenced from a secure/signature's references list, or a validate/signature's requiredReferences list. Selects the target either by a well-known name (BODY, HEADER, TIMESTAMP, BST) or by an XPath expression (set xpath; by is then inferred and must be omitted). {@link #setId(String)} only applies when signing; it's unused when verifying.
Syntax
wsSecurity-signature-reference: by: body id: <string> xpath: <string>
wsSecurity-signature-reference:
by: body
id: <string>
xpath: <string>
Attributes
Name
Required
Default
Description
Examples
by
false
BODY
Which element to sign or verify. BODY/HEADER select the SOAP body/header. TIMESTAMP selects an existing wsu:Timestamp inside wsse:Security. USERNAME_TOKEN selects the wsse:UsernameToken there — required for the common signed-UsernameToken policy, where the signature is what binds the credential to this message instead of leaving it replayable on its own. BST selects the wsse:BinarySecurityToken created for the securityTokenReference KeyInfo mode, so it is itself covered by the signature; only valid when securityTokenReference is configured on the enclosing signature. Must be omitted when {@link #setXpath(String)} is set — in that case the reference is always resolved by XPath.
-
id
false
-
The wsu:Id to assign to the referenced element. If omitted, an existing wsu:Id/Id attribute on the element is reused, otherwise one is generated. Not allowed when an XPATH reference matches more than one element, since a single id can't apply to all of them.
-
xpath
false
-
XPath expression selecting the element(s) to sign or verify. Must match at least one element; when it matches more than one, each matched element is signed/verified individually. Setting xpath implies {@link #setBy(By)} is XPATH; by must then be omitted. The soap, wsse, and wsu prefixes are always available; additional prefixes can be declared on the enclosing wsSecurity element's xmlConfig.