Hi,

Spring WS 1.5.6

We using the WebServiceGatewaySupport (1.5.6) and Wss4Jinterceptor to secure client calls. Our application is a middleware app.
and make WS calls on behalf of many clients to many different servers. Each server/service has its own username/password.

Our application needs to dynamically set a username in the Wss4Jinterceptor. We have a password callback function that resolves the password for each username.


Our relevant config is as follows:
Code:
<bean id="messageFactory" class="org.springframework.ws.soap.saaj.SaajSoapMessageFactory" />

    <bean id="omsWebServiceTemplate" class="org.springframework.ws.client.core.WebServiceTemplate">
        <constructor-arg ref="messageFactory" />
        <property name="defaultUri" value="http://example.com/WebService" />
        <property name="messageSender" ref="httpSender" />
        <property name="interceptors">
            <list>
                <ref local="wsSecurityInterceptor" />
            </list>
        </property>
    </bean>

<bean id="wsSecurityInterceptor"
        class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
        <description>
            WSS4J uses no external configuration file; the interceptor is entirely
            configured by properties.
        </description>
        <property name="securementActions" value="UsernameToken"/>
        <property name="secureRequest" value="true"/>
        <property name="secureResponse" value="false"/>
        <property name="securementMustUnderstand" value="true"/>
        <property name="securementPasswordType" value="PasswordText"/>
        <property name="securementCallbackHandler">
            <ref local="passwordCallback"/>
        </property>
    </bean>

We're currently setting the securementusername in code like this
(This class extends WebServiceGatewaySupport) :

Code:
    
         ClientInterceptor[] ci = getWebServiceTemplate().getInterceptors();
         Wss4jSecurityInterceptor wsSec  = (Wss4jSecurityInterceptor)ci[0];
         wsSec.setSecurementUsername(userName);
         getWebServiceTemplate().setInterceptors(ci);


The problem with the above is that we have multiple threads running this code and the username is getting stomped. We're assuming there is a threading issue. Anyone else run into this?

Are we not using the WSS4j interceptor properly ? Is there another approach on how to do this ? We need to be able to dynamically specify a username for
each WS call.

Any help is much appreciated.

Thanks,
Tom