You can use the Context Resource which allows you to specify a schema to hold context data from an incoming request or outgoing replies to a service. This allows you to pass on data, such as the username and password sent by the requesting application, to operation implementations without requiring the implementations to be aware of which transport the request was bound to. Also, you can pass data from the process that implements an operation back to the service for any outgoing reply message. The Context Resource can also be used to store SOAP headers or message attachments.
A demo project is attached (Filename: WSSecurity.zip).