SOAP Header using JAX-WS(Server Side)

The requirement is to include security attributes in header of Soap Message in every WebService request. One way to include is:

@WebService
@SOAPBinding
(   
    style = javax.jws.soap.SOAPBinding.Style.DOCUMENT,
    use = javax.jws.soap.SOAPBinding.Use.LITERAL
)
public interface UserService
{

    @WebMethod
    public AuthenticateResponse authenticateUser(AuthenticateRequest request, @webParam(header=true) ApplicationCredential appcredential);


@WebMethod
    public UserDetailResponse getUserDetail(UserDetailRequest request, @webParam(header=true) ApplicationCredential appcredential);

}

But, with the above mentioned approach, I need to include ApplicationCredential at every operation. It doesn't look good. I am looking for if we can include this ApplicationCredential class in BaseRequest Class and mention there that it is going to be a part of Soap Header(through some开发者_运维百科 annotaion), that would be really helpful. For ex:

public class BaseRequest
{

@SomeAnnotation which states that Appcedential is a part of Soap Header
ApplicationCredential appcredential;

}

So far, I am unable to find any way to do this. Any help would be highly appreciated.

---

I know it's a while ago you asked that question, and you may have found out yourself already, but I answer to it anyway: Try to avoid to create your own authentication handshake for Web Services - instead use either Web Service message level security if your server and client provide it, or just use transport level security, e.g. Basic Authentication and/or SPNEGO.

The selection of the authentication mechanism depends mainly on your context: If you provide the service within a company network, use whatever is provided there, or Basic Authentication if no central authentication infrastructure is in place. If you provide your Web Service to the Internet, the easiest way to do authentication is again Basic Authentication (via SSL), but that again depends on the kind of service consumers you envision.

This answer creates more questions, I guess, sorry about that. My main point is that you should not try to reinvent the wheel again =:-)