Can you not split the Web app and webservice into two different webmodules ?.
Otherwise if you can use SOAP message Security (WS-Security) for the webservice then a solution is possible. We had a similar thread posted by someone else. Can i see your web.xml
i Will try to cross post a link to that thread here
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]
http://forums.java.net/jive/thread.jspa?messageID=327766