just a link for now

http://www.theserverside.net/tt/articles/showarticle.tss?id=ClaimsBasedSecurityModel2

http://www.devx.com/codemag/Article/33342/1954

http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx

http://www.codeplex.com/WCFSecurity/

If you get the following error message

com.sun.xml.ws.transport.http.servlet.WSServletContextListener contextInitialized
SEVERE: WSSERVLET11: failed to parse runtime descriptor: com.sun.xml.ws.util.ServiceConfigurationError: com.sun.xml.ws.api.wsdl.writer.WSDLGeneratorExtension: Provider com.sun.xml.ws.policy.jaxws.PolicyWSDLGeneratorExtension is specified in jar:file:/home/mla/apache-tomcat-5.5.27/shared/lib/webservices-rt.jar!/META-INF/services/com.sun.xml.ws.api.wsdl.writer.WSDLGeneratorExtensionbut could not be instantiated: java.lang.ClassCastException
com.sun.xml.ws.util.ServiceConfigurationError: com.sun.xml.ws.api.wsdl.writer.WSDLGeneratorExtension: Provider com.sun.xml.ws.policy.jaxws.PolicyWSDLGeneratorExtension is specified in jar:file:/home/mla/apache-tomcat-5.5.27/shared/lib/webservices-rt.jar!/META-INF/services/com.sun.xml.ws.api.wsdl.writer.WSDLGeneratorExtensionbut could not be instantiated: java.lang.ClassCastException

after installing metro 1.3.1 into tomcat using the metro_on_tomcat.xml ant buildfile two incompatible webservice implementations are installed.

he easy solution is to remove all files starting with "webservices" from the tomcat/shared/lib directory.

Find more information here http://wso2.org/library/3132 

@WebService()
@javax.xml.ws.BindingType(value="http://java.sun.com/xml/ns/jaxws/2003/05/soap/bindings/HTTP/")
public class HelleWorld {

/**
* Web service operation
*/
@WebMethod(operationName = "Hi")

public String Hi() {
//TODO write your implementation code here:
return "HelloWorld";
}

}