Does the client include the WSS UsernameToken  in the first place? Or do you need to add that yourself in the Camel route?

Well the SOAP message can be represented in text/xml that is send over HTTP. So if you can add the WSS UsernameToken as a blob of xml then you can add that into the message body from the jetty.

For example from a java bean you can do

public String enrichWithUsernameToken(String xml) {
   // add the username into the xml
   return enriched;
}

You can use the Document API if that is easier

public Document enrichWithUsernameToken(Document dom) {
   // add the username into the xml
   return enriched;
}

Though if you are using Apache CXF it has some security functionality which you can read about

http://cxf.apache.org/docs/security.html

Though using CXF can be a configuration hell, as its sometimes verbose and confusing to configure properly.

Also you can check out the WebService Security Guide here

https://access.redhat.com/knowledge/docs/Fuse_ESB_Enterprise/

If the incoming SOAP message is not secure at all, then I think this is more difficult. And you may want to use the Apache CXF instead of the http component, to call the web-service. As Apache CXF supports WS-Secure and you can configure it to use the WS UserName token and whatnot. See the links I provided.

Though its not easy to configure and use IMHO. But that is the WS-* world.