UsernameToken: web service requires plain text password, but also requires nonce and Created

Hi all, I've spent numerous hours trying to find a workaround for this and am getting desperate. Using PHP, I'm trying to build a client to interface with the Department of Homeland Security's E-Verify web service. I think I'm in the same boat as this guy:

wso2.org/mailarchive/wsf-php-user/2007-August/000086.html

That is, the web service's specification states (from their specification document): "The password is the 8-14 character password associated with the CPS logon ID transmitted in plain-text. The https must be used to make the Web Service call secure."

When I set the passwordType to be plain text, of course, the Nonce and Created elements of the token are not created by WSF. Here is what the header looks like (scrubbing the user/pw):


  <soapenv:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" soapenv:mustUnderstand="1">
      <wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsu:Created>2009-05-04T19:34:21.568Z</wsu:Created>
        <wsu:Expires>2009-05-04T19:39:21.568Z</wsu:Expires>
      </wsu:Timestamp>
      <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsse:Username>user_here</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">plaintext_pw_here</wsse:Password>
      </wsse:UsernameToken>
    </wsse:Security>
  </soapenv:Header>


And here is their response:

<soap:Fault>
<faultcode xmlns:code="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">code:InvalidSecurityToken</faultcode>
<faultstring>Microsoft.Web.Services2.Security.SecurityFault: An invalid security token was provided ---&gt; System.Exception: WSE567: The incoming Username token must contain both a nonce and a creation time for the replay detection feature.
at Microsoft.Web.Services2.Security.Tokens.UsernameTokenManager.DetectReplay(UsernameToken token)
at Microsoft.Web.Services2.Security.Tokens.UsernameTokenManager.LoadTokenFromXml(XmlElement element)
at Microsoft.Web.Services2.Security.Tokens.SecurityTokenManager.LoadXmlSecurityToken(XmlElement element)
--- End of inner exception stack trace ---
at Microsoft.Web.Services2.Security.Tokens.SecurityTokenManager.LoadXmlSecurityToken(XmlElement element)
at Microsoft.Web.Services2.Security.Tokens.SecurityTokenManager.GetTokenFromXml(XmlElement element)
at Microsoft.Web.Services2.Security.Security.LoadToken(XmlElement element, SecurityConfiguration configuration, Int32&amp; tokenCount)
at Microsoft.Web.Services2.Security.Security.LoadXml(XmlElement element)
at Microsoft.Web.Services2.Security.SecurityInputFilter.ProcessMessage(SoapEnvelope envelope)
at Microsoft.Web.Services2.Pipeline.ProcessInputMessage(SoapEnvelope envelope)
at Microsoft.Web.Services2.WebServicesExtension.BeforeDeserializeServer(SoapServerMessage message)</faultstring>
</soap:Fault>
 
Of course, I understand that this is a logic issue in their understanding of how UsernameToken should work.  That said, they've said they're not going to fix it, so I have to find a way to work around it.  My problem is I have no idea how to do it.

I've tried various WSHeader machinations, but cannot get them to work.  Another alternative might be if I could find a way to load the outgoing XML into the DOM, do an XPATH to find the Password element and then do a manual substitution with the plain text password.  I'd even be willing to build the XML from scratch in SimpleXML or DOMXML if I could figure out how to successfully build and post it.  There are likely other alternatives I don't know.  What I do know is that I'm completely stuck and am open to anything that would work.

First, is there a way to force Nonce and Created elements to be created even if PlainText is specified in my WSSecurityToken passwordType?

Second, if not, how should I work around this?  I've tried using PHP built-in SOAP class, but cannot get that to work either (additional namespaces are required).

Thanks ahead of time!