I've just committed some tests showing how to use ws-security with the jbossws-metro stack
Nice job Alessio ;)
I found out on the wsit fisheye that more recent releases also scan the jar's META-INF folder and that's why I created JIRA-2158.
Did you find more recent Metro tag than the current one metro1_1-release that would include your feature of scanning the jar's META-INF folder?
I've just checked out the tag metro1_1_1-release and the sources of com.sun.xml.wss.impl.misc.DefaultCallbackHandler seems to be OK (i.e. they have a couple of lines to scan the META-INF inside the jar). I'll try using this version soon then I'll let you know.