You're right — implementing full WS-Security (Timestamp, UsernameToken with nonce, BinarySecurityToken, Signature + Encryption) for an enterprise SOAP 1.2 endpoint is tricky in Python because Zeep doesn’t fully handle WS-Security policies out of the box.
**Short answer:** You can absolutely do this in Python, but you'll need to combine Zeep (for SOAP/WSDL) with python-xmlsec (for signing and encryption). Zeep alone doesn’t implement the full WS-Security stack (EncryptedKey, BinarySecurityToken, etc.), so a hybrid approach is typically required.
**Recommended approach:**
1. **Use Zeep** to generate the SOAP body and handle WSDL parsing — it supports SOAP 1.2.
2. **Add WS-Security headers** (Timestamp with millisecond precision, UsernameToken with Nonce & Created) manually or via Zeep WSSE hooks.
3. **Use python-xmlsec (xmlsec)** to:
Sign the required elements (Body, Timestamp, UsernameToken) using your private key and certificate — this creates the XML Signature inside `wsse:Security`.
Encrypt the symmetric key with the server’s public key and encrypt required parts (Body and UsernameToken), producing `EncryptedData` with an `EncryptedKey` as specified in your policy.
4. **Match your policy.xml exactly** — check namespaces, transforms, canonicalization, and the placement of `KeyInfo` and `BinarySecurityToken`.
5. **Send the finalized envelope** over HTTPS.
**Libraries:**
- `zeep` (SOAP 1.2 and WSDL support)
- `lxml`
- `python-xmlsec` (requires xmlsec native library)
- `requests`
This process isn’t trivial — it requires careful comparison against a working SoapUI request. You can export the raw XML from SoapUI and diff it against your generated XML to ensure structure and signature placement match.
If you can share the relevant sections of your `policy.xml` and SoapUI raw request, I can outline a concrete Python example showing the correct `BinarySecurityToken`, `KeyInfo`, and canonicalization setup.
**TL;DR:**
Use Zeep for SOAP generation and python-xmlsec for WS-Security (signing + encryption). That’s the most reliable and Pythonic way to meet enterprise SOAP 1.2 security requirements.