WSHandler#getPassword tries to get a password by:
a) Trying to construct a password callback
b) Trying to get a password callback object from the Message Context
c) Trying to get the password directly from the Message Context, i.e. delegating this to a subclass of WSHandler
There are some problems with how the current code handles option (c). In particular, the action to be performed, as well as the username, are not preserved in the WSPasswordCallback object that gets returned. This in turn leads to problems with the UsernameTokenAction, which obtains the username from the WSPasswordCallback.
See attached for a patch for this problem. In addition, I added some fairly extensive unit testing of the getPassword method.