modules/rampart-policy/src/test/resources/policy/kerberos-keyref-12.xml

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
   xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:EndorsingSupportingTokens>
                <wsp:Policy>
                    <sp:KerberosToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Once">
                        <wsp:Policy>
                            <sp:WssKerberosV5ApReqToken11 />
                            <sp:RequireKeyIdentifierReference />
                        </wsp:Policy>
                    </sp:KerberosToken>
                </wsp:Policy>
            </sp:EndorsingSupportingTokens>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>