As an alternative approach we can just use the MBeanServer in WSSecurityDispatcher to load the url, store type and passwords and create a SecurityStore leaving the decode option to SecurityStore. This way only the {EXT} and {CLASS} will be supported and it is transparent. Is this fine? I like this approach! View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3981681#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...