Web Service client response in DWR method call return null

Summary

I have implemented Spring security 4.x in my Enterprise web application running on WAS85 in local environment. In existing code , we are consuming web service call implemented in DWR method.
It was invoking DWR call successfully, but when it try to call web service endpoint method , it was generating SOAP request message successfully but it return null response with following "Bad envelope tag: HTML" error .
Same behavior have been observed for all type of web service invocation in my application whenever spring security is enabled . When i disabled security, it would be working successfully.
It was generating appropiate SOAP message request and tried to send in request but failed to get response ,it would always returning null. When i have tested same SOAP requesting using SOAP UI it was return proper response.
Following ignoring method called by adding web service url in my securityConfig java classes but didn''t help much.
Do we need any additional configuration required to invoke external or internal web service method call consists of different host name ? Please advise.

Actual Behavior

It has throwing Bad envelope tag: HTML error whenever we are invoking any interfacing system web service call .

Expected Behavior

It should invoke all web service method call consuming in the application after successful spring security authorization & authentication.

Configuration

Struts 1.x ,spring security 4.1 ,DWR 1.x ,Axis 1.4 on IBM WAS85 ,

Version

Spring Security 4.1

Sample

SecurityConfig class
@Override
public void configure(WebSecurity web) throws Exception {
web

    .ignoring()
       .antMatchers("http://demo.com:1002/web/service/callservice/**"); //
}

Error Logs are as follow
org.xml.sax.SAXException: Bad envelope tag: HTML
at javax.servlet.GenericServlet.init(GenericServlet.java:161)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.init(ServletWrapper.java:336)
at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.init(ServletWrapperImpl.java:168)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.loadOnStartupCheck(ServletWrapper.java:1341)
at com.ibm.ws.webcontainer.webapp.WebApp.doLoadOnStartupActions(WebApp.java:588)
at com.ibm.ws.webcontainer.webapp.WebApp.commonInitializationFinally(WebApp.java:559)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.initialize(WebAppImpl.java:425)
at com.ibm.ws.webcontainer.webapp.WebGroupImpl.addWebApplication(WebGroupImpl.java:88)
at com.ibm.ws.webcontainer.VirtualHostImpl.addWebApplication(VirtualHostImpl.java:169)
at com.ibm.ws.webcontainer.WSWebContainer.addWebApp(WSWebContainer.java:746)
at com.ibm.ws.webcontainer.WSWebContainer.addWebApplication(WSWebContainer.java:634)
at com.ibm.ws.webcontainer.component.WebContainerImpl.install(WebContainerImpl.java:426)
at com.ibm.ws.webcontainer.component.WebContainerImpl.start(WebContainerImpl.java:718)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:1170)
at com.ibm.ws.runtime.component.DeployedApplicationImpl.fireDeployedObjectStart(DeployedApplicationImpl.java:1370)
at com.ibm.ws.runtime.component.DeployedModuleImpl.start(DeployedModuleImpl.java:638)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.startModule(ApplicationMgrImpl.java:1674)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.access$700(ApplicationMgrImpl.java:217)
at com.ibm.ws.runtime.component.ApplicationMgrImpl$3.run(ApplicationMgrImpl.java:1609)
at com.ibm.ws.security.auth.ContextManagerImpl.runAs(ContextManagerImpl.java:5429)
at com.ibm.ws.security.auth.ContextManagerImpl.runAsSystem(ContextManagerImpl.java:5555)
at com.ibm.ws.security.core.SecurityContext.runAsSystem(SecurityContext.java:255)
at com.ibm.ws.runtime.component.ApplicationMgrImpl._startModule(ApplicationMgrImpl.java:1638)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:88)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:613)
at sun.reflect.misc.Trampoline.invoke(MethodUtil.java:68)
at sun.reflect.GeneratedMethodAccessor42.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:613)
at sun.reflect.misc.MethodUtil.invoke(MethodUtil.java:287)
at javax.management.modelmbean.RequiredModelMBean$4.run(RequiredModelMBean.java:1256)
at java.security.AccessController.doPrivileged(AccessController.java:252)
at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:87)
at javax.management.modelmbean.RequiredModelMBean.invokeMethod(RequiredModelMBean.java:1250)
at javax.management.modelmbean.RequiredModelMBean.invoke(RequiredModelMBean.java:1088)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:831)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:804)
at com.ibm.ws.management.AdminServiceImpl$1.run(AdminServiceImpl.java:1335)
at com.ibm.ws.security.util.AccessController.doPrivileged(AccessController.java:118)
at com.ibm.ws.management.AdminServiceImpl.invoke(AdminServiceImpl.java:1228)
at com.ibm.ws.management.application.sync.StartDeploymentTask.startDeployment(StartDeploymentTask.java:236)
at com.ibm.ws.management.application.sync.StartDeploymentTask.fineGrainUpdate(StartDeploymentTask.java:187)
at com.ibm.ws.management.application.sync.StartDeploymentTask.performTask(StartDeploymentTask.java:99)
at com.ibm.ws.management.application.sync.AppBinaryProcessor$ExpandApp.expand(AppBinaryProcessor.java:1705)
at com.ibm.ws.management.application.sync.AppBinaryProcessor.postProcessSynchronousExt(AppBinaryProcessor.java:745)
at com.ibm.ws.management.bla.sync.BLABinaryProcessor.postProcess(BLABinaryProcessor.java:581)
at com.ibm.ws.management.bla.sync.BLABinaryProcessor.onChangeCompletion(BLABinaryProcessor.java:458)
at com.ibm.ws.management.repository.FileRepository.postNotify(FileRepository.java:1955)
at com.ibm.ws.management.repository.FileRepository.update(FileRepository.java:1464)
at com.ibm.ws.management.repository.client.LocalConfigRepositoryClient.update(LocalConfigRepositoryClient.java:189)
at com.ibm.ws.sm.workspace.impl.WorkSpaceMasterRepositoryAdapter.update(WorkSpaceMasterRepositoryAdapter.java:665)
at com.ibm.ws.sm.workspace.impl.RepositoryContextImpl.update(RepositoryContextImpl.java:1998)
at com.ibm.ws.sm.workspace.impl.RepositoryContextImpl.synch(RepositoryContextImpl.java:1946)
at com.ibm.ws.sm.workspace.impl.WorkSpaceImpl.synch(WorkSpaceImpl.java:549)
at com.ibm.ws.management.configservice.ConfigServiceImpl.save(ConfigServiceImpl.java:717)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:88)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:613)
at sun.reflect.misc.Trampoline.invoke(MethodUtil.java:68)
at sun.reflect.GeneratedMethodAccessor42.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:613)
at sun.reflect.misc.MethodUtil.invoke(MethodUtil.java:287)
at javax.management.modelmbean.RequiredModelMBean$4.run(RequiredModelMBean.java:1256)
at java.security.AccessController.doPrivileged(AccessController.java:252)
at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:87)
at javax.management.modelmbean.RequiredModelMBean.invokeMethod(RequiredModelMBean.java:1250)
at javax.management.modelmbean.RequiredModelMBean.invoke(RequiredModelMBean.java:1088)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:831)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:804)
at com.ibm.ws.management.AdminServiceImpl$1.run(AdminServiceImpl.java:1335)
at com.ibm.ws.security.util.AccessController.doPrivileged(AccessController.java:118)
at com.ibm.ws.management.AdminServiceImpl.invoke(AdminServiceImpl.java:1228)
at com.ibm.ws.management.connector.AdminServiceDelegator.invoke(AdminServiceDelegator.java:181)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:88)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:613)
at com.ibm.ws.management.connector.soap.SOAPConnector.invoke(SOAPConnector.java:480)
at com.ibm.ws.management.connector.soap.SOAPConnector.service(SOAPConnector.java:309)
at com.ibm.ws.management.connector.soap.SOAPConnection.handleRequest(SOAPConnection.java:65)
at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java:733)
at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:532)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1783)

Start with the SecurityConfig class and its configure(WebSecurity) method, especially the antMatchers entry for the web-service URL, then review how Spring Security 4.1 handles these external SOAP calls. Reproduce the DWR-to-web-service invocation with security enabled and verify that the response is a SOAP envelope rather than an HTML response.