This is a workaround for https://issues.apache.org/jira/browse/WSS-584

CachingWss4jSecurityInterceptor.java

/**
 * This is a workaround for https://issues.apache.org/jira/browse/WSS-584
 *
 * Implemented based on the following conversation with a core developer of wss4j
 * https://www.mail-archive.com/[email protected]/msg00404.html
 *
 * Created by lcsontos on 11/28/16.
 */
public class CachingWss4jSecurityInterceptor extends Wss4jSecurityInterceptor implements DisposableBean {

    private boolean replayCacheDisabled = false;

    private ReplayCache timestampReplayCache;
    private ReplayCache nonceReplayCache;
    private ReplayCache samlOneTimeUseReplayCache;

    @Override
    public void afterPropertiesSet() throws Exception {
        super.afterPropertiesSet();

        if (replayCacheDisabled) {
            return;
        }

        timestampReplayCache = createCache("timestampReplayCache");
        nonceReplayCache = createCache("nonceReplayCache");
        samlOneTimeUseReplayCache = createCache("samlOneTimeUseReplayCache");
    }

    @Override
    public void destroy() throws Exception {
        if (replayCacheDisabled) {
            return;
        }
        timestampReplayCache.close();
        nonceReplayCache.close();
        samlOneTimeUseReplayCache.close();
    }

    public boolean isReplayCacheDisabled() {
        return replayCacheDisabled;
    }

    public void setReplayCacheDisabled(boolean replayCacheDisabled) {
        this.replayCacheDisabled = replayCacheDisabled;
    }

    @Override
    protected RequestData initializeRequestData(MessageContext messageContext) {
        RequestData requestData = super.initializeRequestData(messageContext);
        setReplayCaches(requestData);
        return requestData;
    }

    @Override
    protected RequestData initializeValidationRequestData(MessageContext messageContext) {
        RequestData requestData = super.initializeValidationRequestData(messageContext);
        setReplayCaches(requestData);
        return requestData;
    }

    private ReplayCache createCache(String key) throws WSSecurityException {
        ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
        StringBuilder cacheKey = new StringBuilder(CachingWss4jSecurityInterceptor.class.getName());
        cacheKey.append("-").append(key);
        return replayCacheFactory.newReplayCache(cacheKey.toString(), null);
    }

    private void setReplayCaches(RequestData requestData) {
        if (replayCacheDisabled) {
            requestData.setEnableTimestampReplayCache(false);
            requestData.setEnableNonceReplayCache(false);
            requestData.setEnableSamlOneTimeUseReplayCache(false);
            return;
        }

        requestData.setTimestampReplayCache(timestampReplayCache);
        requestData.setNonceReplayCache(nonceReplayCache);
        requestData.setSamlOneTimeUseReplayCache(samlOneTimeUseReplayCache);
    }

}