I think the best way for web  services authentication/authorization is WS Security standardized by W3C. It is distributed with axis  2 but you can add  it to your axis 1.x. just google it for details.



I don’t know how to intercept external objects  into Spring but there is ACGI Security developed for Spring that as I remember has URL based authorization which may help you to some extent.