Bug : Threading issue in wss4j subproject (patch included)

[Er...@inventivedesigners.com]

Hi there, 

Since I could not yet find an entry in the apache bug database for the 
wss4j project (probably since you guys haven't formally released yet), 
I'll use the mailinglist. Please forgive me if it's inapropriate. 

We've been using the wss4j project in combination with axis to enable web 
service security. We hit a multithreading issue which only manifests 
itself on systems with at least 2 physical cpu's and only when the 
webservice is hit with a lot of requests at the same time. The problem was 
located in org.apache.ws.axis.security.WSDoAllReceiver.

We extended our own handler from the WSDoAllReceiver and registered that 
in Axis. Our invoke method, called the super.invoke method of 
WSDoAllReceiver and after that retrieved some security information from 
the messagecontext (for instance the Nonce and the createdTime). The 
WSDoAllReceiver.invoke method saved the MessageContext in a class 
variable. There is however only a single instance of the 
authenticationhandler present in the webapp and it is shared by all the 
webservice calls in Axis. This causes several webservice request chains to 
flow through the same instance of WSDoAllReceiver and as a consequence 
during the executing of the invoke the messagecontext may be changed by 
another thread.

I've attached the patch below



---------

Erik Vanherck  -  System Programmer & Designer
Inventive Designers 
Visit http://www.inventivedesigners.com
Visit http://www.inventivedesigners.com/scriptura for Scriptura 
information !

Phone: +32 - 3 - 8210170
Fax: +32 - 3 - 8210171
Email: Erik_Vanherck@inventivedesigners.com

"Computers in the future may weigh no more than 1.5 tons." - Popular 
Mechanics, forecasting the relentless march of science, 1949 
--------------------------------------------------
Inventive Designers' Email Disclaimer:
http://www.inventivedesigners.com/email-disclaimer