[CXF-4987] org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor disables mtom silently

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.4
• Fix Version/s: 2.7.8, 2.6.11
• Labels: mtom security
• Estimated Complexity: Novice
• Assignee: Colm O hEigeartaigh
• Reporter: Stefan Magnus Landrø
• Created: 25/Apr/13 13:04
• Updated: 26/Nov/13 17:40
• Resolved: 04/Nov/13 12:17

Description

handleMessage(..) in WSS4JOutInterceptor disables mtom silently:

public void handleMessage(SoapMessage mc) throws Fault {
//must turn off mtom when using WS-Sec so binary is inlined so it can
//be properly signed/encrypted/etc...
if (!mtomEnabled)

{ mc.put(org.apache.cxf.message.Message.MTOM_ENABLED, false); }

....
}

It would make sense to add a log warning if the client is configured to use mtom and the WSS4JInterceptor:

public void handleMessage(SoapMessage mc) throws Fault {
//must turn off mtom when using WS-Sec so binary is inlined so it can
//be properly signed/encrypted/etc...
if(mc.get(org.apache.cxf.message.Message.MTOM_ENABLED) == true &&
!mtomEnabled) { log.warn("Incomatible configurations .... bla bla bla"); }

if (!mtomEnabled) { mc.put(org.apache.cxf.message.Message.MTOM_ENABLED, false); }

....
}