Just had a blog post cross-posted: In the JBoss SOA Platform blog: http://jboss-soa-p.blogspot.com/2010/09/asserting-security-jbossesb-integration.html And at DZone: http://java.dzone.com/articles/asserting-security-jbossesb