title: Bottom-up CXF Web Service with WS-Trust - is it possible?
body: <p>I'm trying to develop a secure CXF web service with a java-first approach (java2ws).
  All is fine until I try to define a "IssuedToken" policy as shown, for example, <a href="https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Fuse/6.1/html/Apache_CXF_Security_Guide/STS-Demo.html#STS-Demo-ServerWsdl" rel="nofollow noreferrer">here</a>.</p>
  
  <p>The problem is, of course, that the WSDL is generated, so I can't insert the policy in the WSDL. I tried with the <a href="https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Fuse/6.2.1/html/Apache_CXF_Development_Guide/JAXWSServiceDevJavaFirstAnnotate.html#JAXWSServiceDevJavaFirstAnnotateCxf" rel="nofollow noreferrer">@Policy</a> annotation and managed to generate a proper WSDL file, only to find that the policy is ignored by the service, which doesn't even show it in the "online" WSDL.</p>
  
  <p>So how do I go about implementing a secure web service with a bottom-up approach? Can it be done?</p>
  
  <p>P.S. I'm going to deploy the service in fuse</p>