Hi Peter, Can you address this issue. I have a POJO web service. Now since I am able to sign and encrypt the messages. I want to authenticate and authorize the users. Now the scenario is that we need to first set the user credentials(username/password) or the SSO ticket in the SOAP headers(Not sure how we can put an SSO ticket). Then on server we need to extract the credentials/SSO ticket and validate against either an SSO system or LDAP user store using JAAS. Pls throw some light on it. Best Regards Shashank View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4128988#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...