Securizar un servicio web con WS-Security es sencillo gracias a bilbiotecas como WSS4J.
Pero a veces hay problemas no muy claros, por ejemplo el siguiente (Axis2+Rampart+WSS4J):
Caused by: org.apache.ws.security.WSSecurityException: The signature or decryption was invalid
at org.apache.ws.security.processor.SignatureProcessor.verifyXMLSignature(SignatureProcessor.java:419)
at org.apache.ws.security.processor.SignatureProcessor.handleToken(SignatureProcessor.java:111)
at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:328)
at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:245)
at org.apache.rampart.RampartEngine.process(RampartEngine.java:166)
at org.apache.rampart.handler.RampartReceiver.invoke(RampartReceiver.java:92)
Si se descarta que un componente intermedio (log, ...