Maybe this http://community.jboss.org/message/552851 will help you. Securing webservices with jaas is quite simple. I never tried the security token though.
Reply to this message by going to Community
Start a new discussion in JBoss Web Services at Community