Yes, it's indeed possible. However there's not a standard pre-built endpoint configuration for this, thus you would have to provide it (see standard-jaxws-endpoint-config.xml for instance) with both the addressing and security handlers.