WSF/PHP 1.2.0 calculates digest differently than WSS4J

I have inherited a task from another developer. I installed version 1.2.0 of WSO2 WSF/PHP from a debian package with the filename wso2-wsf-php-1.2.0-debian.deb. It appears to work well for the most part but I'm having a problem with Digest Authentication. The problem is that the server uses WSS4J to handle web services security and that software is calculating a different hash value for the password credentials I am supplying. Here is my code that creates my service:

$policy = new WSPolicy(
    array("security" => array("useUsernameToken" => TRUE,
        "includeTimeStamp" => TRUE)));
$securityToken = new WSSecurityToken(array("user" => "myusername",
    "password" => "a123456",
    "passwordType" => "Digest",
    "ttl" => 300));
$client = new WSClient(array("wsdl"=> WSDL_GATEWAY,
    "useWSA" => TRUE,
    "policy" => $policy,
    "securityToken" => $securityToken));

/* code to formulate request here */

$proxy = $client->getProxy();
$returnValue = $proxy->bulkImport(array("requests" => $requests,
    "dataSource" => "TaxGold",
    "maximumCharge" => 50));

 
This results in the following XML/SOAP request

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header><wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsu:Created>2008-07-11T21:39:16.292Z</wsu:Created>
<wsu:Expires>2008-07-11T21:44:16.292Z</wsu:Expires>
</wsu:Timestamp>
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>myusername</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">WaqaaUMq2turGpyIjAztnUF29n8=</wsse:Password>
<wsse:Nonce>AOrgd/SdlpciNTNg/cWQc4V/sdkbcPCB</wsse:Nonce>
<wsu:Created>2008-07-11T21:39:16.422Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<ns1:bulkImport xmlns:ns1="http://bulk_import.lookup.servicedomain.com/" xmlns:ns2="NULL">
<ns2:dataSource xmlns:ns2="NULL">TaxGold</ns2:dataSource>
<ns2:maximumCharge xmlns:ns3="NULL">50</ns2:maximumCharge>
</ns1:bulkImport>
</soapenv:Body>
</soapenv:Envelope>

The problem appears to be that WSO WSF/PHP ignores the nonce when calculating the password digest.  the WSS4J calculates the password digest as lQZ07lmUL/gwIOFOZq8Tn2qAa+E= instead of  WaqaaUMq2turGpyIjAztnUF29n8= which is the value supplied by WSO WSF/PHP in the xml/soap message.

If we use the empty string ("") for the nonce in the Java code instead of the nonce sent in the soap message (in other words, if we ignore the nonce altogether) then we get the matching value of WaqaaUMq2turGpyIjAztnUF29n8=

Is WSF/PHP ignoring the nonce when calculating the password digest?  Do I need to set some other flag in my code?

Here is the guilty Java function with some comments:

    public WSUsernameTokenPrincipal handleUsernameToken(Element token, CallbackHandler cb) throws WSSecurityException {
        UsernameToken ut = new UsernameToken(token);
        String user = ut.getName();	// myusername
        String password = ut.getPassword();	// WaqaaUMq2turGpyIjAztnUF29n8=
        String nonce = ut.getNonce();	// AOrgd/SdlpciNTNg/cWQc4V/sdkbcPCB
        String createdTime = ut.getCreated();	// 2008-07-11T21:39:16.422Z
        String pwType = ut.getPasswordType();	// http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest
        if (log.isDebugEnabled()) {
            log.debug("UsernameToken user " + user);
            log.debug("UsernameToken password " + password);
        }

        Callback[] callbacks = new Callback[1];
        if (ut.isHashed()) {
            if (cb == null) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noCallback");
            }

            WSPasswordCallback pwCb = new WSPasswordCallback(user, WSPasswordCallback.USERNAME_TOKEN);
            callbacks[0] = pwCb;
            try {
                cb.handle(callbacks);
            } catch (IOException e) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noPassword",
                        new Object[]{user}, e);
            } catch (UnsupportedCallbackException e) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noPassword",
                        new Object[]{user}, e);
            }
            String origPassword = pwCb.getPassword();	// a123456
            if (log.isDebugEnabled()) {
                log.debug("UsernameToken callback password " + origPassword);
            }
            if (origPassword == null) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noPassword", new Object[]{user});
            }
            if (nonce != null && createdTime != null) {
                String passDigest = UsernameToken.doPasswordDigest(nonce, createdTime, origPassword);	// passDigest is lQZ07lmUL/gwIOFOZq8Tn2qAa+E=. Interestingly, if I use "" for nonce I get WaqaaUMq2turGpyIjAztnUF29n8=, which is the password getting sent.
                if (!passDigest.equals(password)) {
                    throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION);
                }
            }
        } else if (cb != null) {
            WSPasswordCallback pwCb = new WSPasswordCallback(user, password,
                    pwType, WSPasswordCallback.USERNAME_TOKEN_UNKNOWN);
            callbacks[0] = pwCb;
            try {
                cb.handle(callbacks);
            } catch (IOException e) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noPassword", new Object[]{user});
            } catch (UnsupportedCallbackException e) {
                throw new WSSecurityException(WSSecurityException.FAILURE,
                        "noPassword", new Object[]{user});
            }
        }

        WSUsernameTokenPrincipal principal = new WSUsernameTokenPrincipal(user, ut.isHashed());
        principal.setNonce(nonce);
        principal.setPassword(password);
        principal.setCreatedTime(createdTime);
        principal.setPasswordType(pwType);

        return principal;
    }