The best book you can buy is J2EE Web Services - Richard Monson-Haefel. It is more a reference than a tutorial. The security topics are not covered in this book. A good book about security is "Securing Web Services with WS-Security" - Jothy Rosenberg. If you need a tutorial you can find one on the sun site.
