Verifies a wsse:UsernameToken in the inbound wsse:Security header against a pluggable {@link UserDataProvider} (the same abstraction basicAuthentication uses - a static list, an htpasswd file, JDBC, or LDAP), so hashed passwords (bcrypt, crypt(3), argon2id) are supported the same way they are there. When the token carries a wsu:Created/wsse:Nonce, this also rejects stale tokens and replayed nonces - the standard WS-Security anti-replay mechanism for UsernameToken. A missing or malformed token answers wsse:InvalidSecurityToken, a wrong or replayed credential wsse:FailedAuthentication. On success, the username is exposed to the rest of the exchange the same way a basicAuthentication login is, so user() in a later template or groovy step returns it.
wsse:Password of type PasswordDigest is not supported yet: verifying it requires the literal plaintext password on the gateway's side to recompute the digest, which a pluggable, hash-friendly provider cannot hand back out. A digest token is rejected with wsse:UnsupportedSecurityToken.
Tolerance, as an ISO-8601 duration, applied to a token's wsu:Created and to how long its wsse:Nonce is remembered for replay detection. Only checked when the token actually carries wsu:Created/wsse:Nonce. Nonces are remembered per gateway instance, so a replay is caught once per instance rather than across a cluster.