Romain has made the code to use ws-security while configuring it by server files. Great !
But this only work when you inject Port with @WebServiceRef.
In JaxWS we can inject javax.xml.ws.Service sublclass, for example generated by the jaxws maven plugin, then we can get the port by using a get method.
This is essential to be able to put features (like MTOM and Adressing) that sometimes need some parameters (threshold for MTOM for example).
I made the patch, with the unit test