AxiomSoapMessageFactory with payloadCaching="false" and Wss4jSecurityInterceptor

[pdotsenko]

Hi,

In Spring-ws 1.5.* it appears to be impossible to use AxiomSoapMessageFactory with payloadCaching="false" and Wss4jSecurityInterceptor (since the interceptor needs to read the xml stream and consumes it in the process). Are there any known workarounds to be able to set payloadCaching="false" and still use a security interceptor?

I have web services implemented with Spring-ws 1.5.5 which need to support large soap messages (up to 10Mb with a reasonable concurrent requests load) so I stuck with AxiomSoapMessageFactory and StaxPayloadEndpoint implementations hoping to avoid OutOfMemoryErrors associated with large DOM trees. I also had to implement WS-security requiements (encryption, dig signatures, timestamps) which I did using Wss4jSecurityInterceptor.

This all works as long as I leave AxiomSoapMessageFactory's payloadCaching="true" which still exposes the app to OutOfMemory problems. When I set payloadCaching="false" to minimize amount of server memory used for XML processing, I get this exeption:

java.lang.IllegalArgumentException: Error in converting SOAP Envelope to Document
	at org.springframework.ws.soap.axiom.support.AxiomUtils.toDocument(AxiomUtils.java:135)
	at org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor.toDocument(Wss4jSecurityInterceptor.java:621)
	at org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor.validateMessage(Wss4jSecurityInterceptor.java:492)
	at org.xxx.ws.security.WsSecurityInterceptor.validateMessage(WsSecurityInterceptor.java:84)
	at org.springframework.ws.soap.security.AbstractWsSecurityInterceptor.handleRequest(AbstractWsSecurityInterceptor.java:104)
...
Caused by: org.apache.axiom.om.OMException: java.util.NoSuchElementException
	at org.apache.axiom.om.impl.builder.StAXOMBuilder.next(StAXOMBuilder.java:249)
	at org.apache.axiom.om.impl.llom.OMNodeImpl.build(OMNodeImpl.java:327)
	at org.apache.axiom.om.impl.llom.OMElementImpl.build(OMElementImpl.java:706)
	at org.springframework.ws.soap.axiom.support.AxiomUtils.toDocument(AxiomUtils.java:125)
	... 61 more
Caused by: java.util.NoSuchElementException
	at com.ctc.wstx.sr.BasicStreamReader.next(BasicStreamReader.java:1083)
	at org.apache.axiom.om.impl.builder.StAXOMBuilder.parserNext(StAXOMBuilder.java:506)
	at org.apache.axiom.om.impl.builder.StAXOMBuilder.next(StAXOMBuilder.java:161)
	... 64 more

Wss4jSecurityInterceptor is clearly the culprit.. So am I out of luck as far as being able to set payloadCaching="false" with Wss4jSecurityInterceptor or is there a way? Could this be a feature request?

Thanks very much for any insight..

[pdotsenko]

Here is one similar thread I somehow missed before posting: http://forum.springframework.org/showthread.php?t=56388

As the above thread suggests, since 1.5.4 it is possible to set payloadCaching="false" and use Wss4jSecurityInterceptor when only Soap headers need to be examined by wss4j (as in reading a Username token), however for encryption/decryption or signature validation Wss4jSecurityInterceptor needs payloadCaching="true" since the payload itself needs to be read/transformed. Please correct me if I'm missing something.

[joe_roberts_z]

Hi Spring-WS folks,

I have a follow up question to the previous two threads. I am also exploring similar options but with the possibility of request messages with large attachments.

The payload won't necessarily be that large, but the attachments will. If I use payloadCaching=true, would this still expose my application to out of memory issues, or as long as I use MTOM for the attachments, I should be OK?

Thanks in advance for your response,

Joe

[mada]

hI,
ye it would be ok.
I have successfully sent files about 10 to 60 mo as mtom attachment with Spring WS without outofmemory while monitoring with Jconsole the out of the box tomcat server configuration (just 64 mo of memory dedicated and about 40 was already used at the start of the server).

Just a tip: you will have to add axiom dependency jars . It doesnt work with the version above 1.2.9 with Wss4jSecurityInterceptor with spring 2-M3 and i dont know why.I've used 1.2.8 version.