Alessio,
Thanks for the hints, but:
1) I tried to programatically configure ws-security, following jbossws docs. It didn't worked. My code is the same as the samples in the docs. It looks to me the same as in UsernameTestCase, I had already read those sources.
2) My Eclipse project has just jboss as 7.1.1 configured as runtime and target server. I don't have any other server in the Eclipse workspace and have not downloaded Metro. How could Metro be used instead of the jboss-suplied Apache CXF?