Java EE (Java Enterprise Edition) General Discussion

We want to use a filter to do a message authentication check (HMAC-SHA1) for web-service calls. We want to use the request body as part of the message to hash/authenticate (ala Amazon Web Services). Our problem: we can retrieve the message body--via request.getReader() or request.getInputStream()--and use it to authenticate the incoming request. However, calls to chain.doFilter() or getRequestDispatcher().forward() fail with a "java.lang.IllegalStateException: getReader()|getInputStream() has already been called for this request" error. Attempts to copy the request to another object before calling getReader(), using a HttpServletRequestWrapper, closing or resetting the reader etc all result in the IllegalStateException error.
So: is there a way to retrieve the request body without using getReader()|getInputStream()? Or is there a way to reset the request/reader state so that the request can be reached from the filter? Or is there a better way to do HMAC processing in Java EE?