title: WS-Security Websphere Configuration
body: <p>I'm trying to develop a web service that uses WS-Security using Websphere 7 and JAX-WS. Looking through some guides, it appears that I MUST create a application server user registry and maintain username/passwords inside of that server. Is there anyway to avoid having to create usernames in the server itself and somehow capture the header and do validation based upon another a custom security configuration like a single sign-on?</p>
  
  <p>I'm able to create a handler to get the header, but when mustUnderstands is set to 1 in the request (which is mandatory), it gets rejected before my handler sees the message.</p>
  
  <p>I'm only looking to use the UsernameToken part of WS-Security.</p>
  
  <p>Any help is appreciated.</p>
  
  <p>An example of my request</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
    &lt;soapenv:Header&gt;
      &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1"&gt;
        &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" Id="unt_20"&gt;
          &lt;wsse:Username&gt;some_username&lt;/wsse:Username&gt;
          &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;some_password&lt;/wsse:Password&gt;
        &lt;/wsse:UsernameToken&gt;
      &lt;/wsse:Security&gt;
    &lt;/soapenv:Header&gt;
    &lt;soapenv:Body&gt;
      ...body...
    &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>Is it possible to create a custom security implementation so I can use my existing user validation scheme?</p>