It seems that most of the questions I have to ask on Stack Overflow are about setting up clients for web services. Typically in this case, you have to "deal" with what the service provider has -- you are not at liberty to demand "better" technology be used by the server.
The problem of the day is very closely related to this: http://stackoverflow.com/questions/16451/calling-net-web-service-wse-2-3-ws-security-from-java
However, the use-case I have is slightly different: no certificates, just wsse:UsernameToken, wsse:Password, wsse:Nonce and wsu:Created elements, perhaps with some kind of hash code mangling of the element text (or not). It turns out, apache wss4j might well solve this particular problem. This is just one instance of a systemic problem of ongoing kluges, though.
The deeper issue here, for me, is that there are articles all over the internet (and books) telling you all about generating your own web services. For the PDB* who has to generate your own client for whatever random protocol was in vogue at the time the vendor (or customer, whatever) implemented their service, it is a real uphill slog trying to tweak stuff to work. If somebody knows a bunch of these different protocols and the tool sets to mate up with most of them in one or two languages (with real working examples), you are sitting on a gold mine.
My current environment involves the use of Java (1.6). I am also using the Axis2 (1.5) code generator, which does a good enough (just?) job of generating parameter objects and result objects for the proxy stub method calls. However, it seems there is always some fool thing in the protocol of the day that needs some obscure tweak. This stuff is real black magic. Anybody know a "service oriented architecture" (SOA - corporate-IT-speak) client wizard**?
* PDB = poor dumb bastard, the notional recipient of thankless dirty work.
** by "wizard" I mean a person skilled in the dark arts, not a dialog box