1. You should know how to invoke Siebel webservice using invoke activity from bpel or by dragging siebel webservice on External references and linking BPEL to this siebel webservice
2. You should setup wss_username_token_client_policy_mustunderstand policy at SOA Server. This you need to get it from Oracle Support metalink. Search through mustunderstand policy.
Once the above steps are set then follow these :-
1. Go to composite.xml file , open in design mode
2. Right click on the external reference service(The siebel webservice which is visible in External references) and select “Configure WS policies”
3. Under the security tab, click add button and select “oracle/ wss_username_token_client_policy_mustunderstand
Please note that this policy needs to be setup separately at server level which you can get it from Oracle Support Metalink. You need to have this account through the organization where you work.