All security exceptions reported as wsse:InvalidSecurity

It doesn't seem possible to get Rampart to return specific wsse fault codes other than wsse:InvalidSecurity.

RampartReceiver.setFaultCodeAndThrowAxisFault() always sets the fault code as WSConstants.INVALID_SECURITY. This means that even if your callback handler returns a more specific Fault, such as wsse:FailedAuthentication, that always gets reported as a nested exception in the faultstring of a Fault with a faultcode of wsse:InvalidSecurity.