No, there's no standard way of setting up ws-security, at least not atm. The reason is basically in different options supported and no java spec covering this. We might come to a jbossws common api for doing this, but this is still in planning phase, sorry.