The password callback handler retrieves identifier-password pairs from a configuration file and then loads the pairs which can be used to find the needed password for a particular identifier. The configuration file must be in XML format and similar to the axis2.xml file.

You can provide a configuration file to the callback handler by specifying it in the web service archive. In the services.xml file, you add a PWCBConfigFile parameter, which is set to point to the configuration file resource on the service class path. The class path includes the service archive, the libraries which are in the service archive, the web application class path (all jar files in WEB-INF/lib and the WEB-INF/classes class folder) and so on.

If you do not specify the configuration file resource, by default the callback handler searches for a resource with name users.xml in the service class path. If it is not available, a FileNotFoundException is thrown.

The same password callback handler is also available at the client side if there is no service archive. Then, presumably, the configuration file is users.xml and is searched on the class path of the client. Then it is loaded as a resource.