...

The WS-Security layer and the XML-Security layer in Apache CXF share a common set of security configuration tags from CXF 3.1.0. The Security Configuration page details these tags and values. The WS-Security layer also has some additional configuration tags that are only used for when security is configured via WS-SecurityPolicy, see the following page for more information.

WS-* Security (including UsernameToken and X.509 Token profiles)

...