I know it is late to answer, but it can be useful for others. Here are links from documentation where it is all very nicely explained. I would suggest to check Wss4jSecurityInterceptor
https://docs.spring.io/spring-ws/docs/3.0.1.RELEASE/reference/#security-wss4j-security-interceptor