Dennis Sosnoski at IBM Developerworks has released a new guide on how to handle WS-Security with the Metro Web services framework.
The Metro framework, a reference implementation of the JAXB2 and JAX-WS 2 Java standards, does not include WS* technologies like security. A key component for enabling this security is understanding where the Web Services Interoperability (WSIT) fit in and how to configure them for your application. WSIT, which came out of Sun’s Tango project, are a framework for providing interoperability of security and reliable messaging with the .NET platform.
This guide explains with code how to set WSIT on the server and how to configure the Web Services Description Language policy information to make your applications secure. It includes a guide to setting up tokens, configuring the client, implementing the server, and signing and encrypting in Metro.
Read the guide here: http://www.ibm.com/developerworks/java/library/j-jws10.html