Bug in SAAJ methods SOAPHeader.examineHeaderElements and extractHeaderElements?

[Michael Woinoski <mi...@pineneedleconsulting.com>]

Are the examineHeaderElements and extractHeaderElements methods of the 
SOAPHeader class intended for use only by the ultimate receiver of a SOAP 
message? If so, please ignore this posting. If not, I believe there a bug in 
org.apache.axis.message.SOAPHeader.java. The following code appears in 
getHeadersByActor:

     if (actor == null ||
             nextActor.equals(actor) ||
         (isSOAP12 &&
             Constants.URI_SOAP12_ULTIMATE_ROLE.equals(actor)) ||
         (actors != null && actors.contains(actor))) {
        results.add(header);
     }

I'm concerned about the "actor == null" and 
"Constants.URI_SOAP12_ULTIMATE_ROLE.equals(actor)" tests. The SOAP 1.1 spec states:

   The SOAP actor global attribute can be used to indicate the recipient
   of a header element...Omitting the SOAP actor attribute indicates that
   the recipient is the ultimate destination of the SOAP message.

The semantics of the phrase "the recipient is the ultimate destination of the 
SOAP message" are muddy. "The recipient" could mean either "the intended 
recipient" or "the node currently processing the message." I meekly submit that 
the phrase "the recipient is the ultimate destination of the SOAP message" means 
"this header is intended for the last node in the message processing chain, not 
the current node." I base this interpretation on the SOAP 1.2 spec:

    The absence of a env:role attribute in the...header block
    means that this header element is targeted at the SOAP node that
    assumes the "ultimateReceiver" role...Note that the env:Body element
    does not have a env:role attribute. The body element is always
    targeted at the SOAP node that assumes the "ultimateReceiver" role.

So a header with no role attribute is intended for the same receiver as the 
Body; i.e., the final node. And because the SOAP 1.2 spec states that "SOAP 1.2 
replaces the attribute env:actor with env:role but with essentially the same 
semantics", a missing actor attribute implies the header is intended for the 
ultimate receiver.

So if actor == null, the header is intended for the ultimate destination, not 
the current intermediary (unless the intermediary happens to be the ultimate 
destination.) The same is true if the value of the actor (or role?) attribute is 
the SOAP 1.2 ultimateReceiver URI.

This brings up the question of exactly how the ultimate destination gets all of 
its header elements. It seems that the SAAJ API needs a 
"getUltimateDestinationHeaderElements" method, otherwise the ultimate 
destination first needs to call extractHeaderElements with an actor URI, then 
iterate over all headers and extract those with no actor/role attribute.

I didn't find anything in Bugzilla about this, and of course the Axis 
development team spent many hours discussing the SOAP spec, so this is probably 
completely off-base. If so, please forgive my hubris, but this seems like a 
potential interoperability problem.

Thanks,
Mike


-- 

Mike Woinoski                      Pine Needle Consulting
mailto:michaelw@pineneedleconsulting.com