Security in Webservice without login credentials

I'm development a SOAP web service version 1.1 in Java.

I have the following situation:

1. there's a secured channel with ssh;
2. customers don't have login credentials (they don't have username and password);
3. when a customer opens an account is generated a session token;
4. when a customer make requests is validated by their session token;
5. when a customer account is open only him or employee is allowed to close the account (session timeout can't exist);

what is the best way to implement security in this situation? should i generate the session tokens or there is already apis/frameworks to do that job? Does STS (开发者_JAVA百科Security Token Service) able to do it without requirements of login credentials?

the purpose of that is to invoke the web service in android application.