Thank you vikas for your quick reply.
No we are not passing auth info at transport level.
As per Salesforce documentation first we need to call login API, and we only need to pass login info to this service. This Service will return the session id and url to call other urls.
Login service accepts tns:login, auth, Header_LoginScopeHeader, timeout,port and url parameter.
We are only setting username and Password in tns:login document.