// read the header
Message msg = context.getMessage();
HeaderList hl = msg.getHeaders();
Header securityHeader = hl.get(WSSE_SECURITY, true);
JAXBElement<SecurityHeaderType> sht = securityHeader.readAsJAXB(WSSE_CONTEXT.createUnmarshaller());
for (Object uno : sht.getValue().getAny()) {
if ((uno instanceof JAXBElement) && ((JAXBElement<?>) uno).getValue() instanceof UsernameTokenType) {
UsernameTokenType utt = (UsernameTokenType) ((JAXBElement<UsernameTokenType>) uno).getValue();
username = utt.getUsername().getValue();