title: User authentication in SOAP Webservices
body: <p>I made a question about <a href="https://stackoverflow.com/questions/5314782/jax-ws-authentication-and-authorization-how-to">JAX-WS, Authentication and Authorization - How to?</a>; there was a discussion about security levels, and where to store user credentials.</p>
  
  <p>Now after some conclusions, I want to try one of those scenarios:</p>
  
  <ul>
  <li>SOAP web services - metro</li>
  <li>Message level security - Mutual certificate authentication, to authenticate the client application</li>
  <li>User credential in the Soap Header</li>
  </ul>
  
  <p><strong>How to get the credentials and do the authorization?</strong>
  I have 2 ideas:</p>
  
  <ul>
  <li>JAAS (I don't know anything about this);</li>
  <li>SOAP handler - using the WebServiceContext to extract the credentials from the message and do the authorization "by hand".</li>
  </ul>
  
  <p>Can you help me to decide the best way, and how to implement it?</p>
  
  <p><strong>Remember that I want mutual certificate, plus a user token.</strong></p>