Web services security - what to expect

I am reviewing a vendor抯 product that will run on a J2EE platform. One of the features of this product is a web services framework for developing web services. What I want to assess is how well they support web services security. They may say they rely on the underlying application server to 揹o the security stuff?is this enough?

A further question is: what should I expect from different J2EE application server vendors in the area of security. Is there reasonable compliance between them or is there still an amount of proprietary implementation should I need a particular security feature, that will ultimately result in application server lock-in?

[666 byte] By [paularmstronga] at [2007-10-1 0:28:50]