You breaking new ground with this one. I've have had some experience with this but only through a course from
www.learningtree.com -Building XML Web Services with
Java.
Aside from this course, because this area is so new there isn't much around apart from the IBM's implementation detailed in a tutorial from the webservices.xml url I posted.
If your boss wont send you on this 4 day course then I can only suggest going to the apache site, download the WSS4J (Web Services Security for Java) module and browser through the API.
[ December 22, 2004: Message edited by: James Clinton ]