SOAP is an extensible protocol hence it doesn't restrict you from doing so.
The tricky part is how to achieve what you wanted to achieve using datapower.
To do this you need to:
- run custom XSLT to extract both the tokens from message and process it the way you want.
- use AAA policy and in the extract identity phase you should choose 'custom template' and provide your XSLT for extraction of both the tokens. In the Authenticate step you can again use custom XSLT to authenticate the identity in the way you want.