To my opinion the WmSoapSamples is no good/outdated. It uses Java for everything, while there are API’s now for a lot of soap-things.
SAG has another package, WmServiceUserHandler which is better, but I had some discussion with R&D about making it even better 
So try to get your hands on WmServiceUserHandler.
Furthermore, what are you doing with username/password what the default ws-security-handler can’t do? Do you really need to build your own handler? Because the ws-security-handler through its policy-files can cope with both http-header and soap-header.
#soa#API-Management#webMethods