How are you setting the security domain to be used? Moreover, please note the <username digestPassword="true" useNonce="true" useCreated="true"/> is to be set on client side (even if this is not the reason of your issue). Finally, as I suggestion, I'd say take a look at the org.jboss.test.ws.jaxws.jbws1988 testcases, they run on all the supported target container, including JBoss 4.2.x. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4201637#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...