ws-security issues in high load

We have ws-security enabled for a proxy which signs the message and sends request to backend API but on a high load it throws below error.(again the proxy works across all nodes with out any issues) but intermittently it throws below error. We are trying to troubleshoot but looking for any pointers/any suggestions?

==

org.apache.ws.security.WSSecurityException: Signature creation failed; nested exception is: java.lang.NullPointerException at org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:515) at org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:442) at org.apache.ws.security.message.WSSecSignature.build(WSSecSignature.java:348) at com.apigeepki.PKISignEncrypt.signSOAPEnvelope(PKISignEncrypt.java:90) at com.apigeepki.PKISignEncrypt.execute(PKISignEncrypt.java:52) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$ClassLoadWrappedExecution.execute(JavaCalloutStepDefinition.java:166) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution$1.run(JavaCalloutStepDefinition.java:231) at java.security.AccessController.doPrivileged(Native Method) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution.execute(JavaCalloutStepDefinition.java:228) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$CallOutWrapper.execute(JavaCalloutStepDefinition.java:101) at com.apigee.messaging.runtime.steps.StepExecution.execute(StepExecution.java:146) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:74) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:45) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.lang.NullPointerException at org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:487) ... 18 more 

==

==

java.lang.NullPointerException at org.apache.ws.security.util.WSSecurityUtil.prependChildElement(WSSecurityUtil.java:677) at com.apigeepki.PKISignEncrypt.timestampMSG(PKISignEncrypt.java:206) at com.apigeepki.PKISignEncrypt.execute(PKISignEncrypt.java:49) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$ClassLoadWrappedExecution.execute(JavaCalloutStepDefinition.java:166) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution$1.run(JavaCalloutStepDefinition.java:231) at java.security.AccessController.doPrivileged(Native Method) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution.execute(JavaCalloutStepDefinition.java:228) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$CallOutWrapper.execute(JavaCalloutStepDefinition.java:101) at com.apigee.messaging.runtime.steps.StepExecution.execute(StepExecution.java:146) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:74) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:45) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745)

==

Below is the snippet which it points..

==

WSSecurityUtil.prependChildElement(secHeader.getSecurityHeader(), timestamp.getElement());

-Vinay

0 1 438
1 REPLY 1

hi Vinay,

is this your code running in a Java callout? Or... is it some code that is part of the Apigee Edge product?

The NPE is being generated from WSS4J, apparently. I cannot tell which version of WSS4J you are using, nor which line of code, but it seems to be within the prependChildElement() method of WSSecurityUtil. What could be the problem ? You may need to do a code inspection to examine the offending line. Maybe you need additional error checking or try...catch to diagnose the problem.