Spring Web Services com Soap e Security Interceptors

Estou com um problema com a validação de USER/PASS em msg soap no spring-ws :S

securityPolicy.xml

<xwss:SecurityConfiguration xmlns

wss="http://java.sun.com/xml/ns/xwss/config">
<xwss:RequireUsernameToken
passwordDigestRequired="false" nonceRequired="false" />
</xwss:SecurityConfiguration>

Interceptor e Bean
<bean id="wsSecurityInterceptor"
class="org.springframework.ws.soap.security.xwss.XwsSecurityInterceptor">
<property name="policyConfiguration" value="classpath:securityPolicy.xml" />
<property name="callbackHandlers">
<list>
<ref bean="passwordValidationHandler" />
</list>
</property>
</bean>

<bean id="passwordValidationHandler"
class="org.springframework.ws.soap.security.xwss.callback.SimplePasswordValidationCallbackHandler">
<property name="users">
<props>
<prop key="Bert">Ernie</prop>
</props>
</property>
</bean>

mapeamento

<sws:interceptors>
<sws:payloadRoot namespaceUri="http://www.marketdata.com/loyaltystore/schemas"
localPart="ListCategoriesRequest">
<ref bean="wsSecurityInterceptor" />
</sws:payloadRoot>
</sws:interceptors>

Agora ...

se eu mandar um soap request

<S11:Envelope xmlns:S11="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-
1.0.xsd" xmlns:sch="http://www.marketdata.com/loyaltystore/schemas">

<S11:Header>
<wsse:Security>
<wsse:UsernameToken>
<wsse:Username>Bert</wsse:Username>
<wsse

assword Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Ernie</wsse

assword>
</wsse:UsernameToken>
</wsse:Security>
</S11:Header>

<S11:Body>
<sch:ListCategoriesRequest/>
</S11:Body>
</S11:Envelope>

Estou recebendo

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<SOAP-ENV:Fault>
<faultcode>SOAP-ENV:Client</faultcode>
<faultstring xml:lang="en">com.sun.xml.wss.XWSSecurityException: Message does not conform to configured policy [ AuthenticationTokenPolicy(S) ]: No Security Header found; nested exception is com.sun.xml.wss.XWSSecurityException: com.sun.xml.wss.XWSSecurityException: Message does not conform to configured policy [ AuthenticationTokenPolicy(S) ]: No Security Header found</faultstring>
</SOAP-ENV:Fault>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Alguém tem alguma idéia ?

nossa ..depois de quebrar a cabeça com essa !!!@#@
era realmente a mensagem de entrada:

eis a mensagem que funcionou certo:

Notícias, artigos e o maior fórum brasileiro sobre Java