This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/secure-size in repository https://gitbox.apache.org/repos/asf/cxf.git
commit a79b1c4a045c76d3c5f9d279927cd0351ceb9492 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Sep 8 16:14:57 2026 +0100 Fix secret key sizing for Spnego as well --- .../policy/interceptors/SpnegoTokenInterceptorProvider.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java index ec239e9019c..9e809000b9d 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java @@ -36,6 +36,7 @@ import org.apache.wss4j.dom.engine.WSSConfig; import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.model.AlgorithmSuite; +import org.apache.xml.security.algorithms.JCEMapper; /** * @@ -79,8 +80,10 @@ public class SpnegoTokenInterceptorProvider extends AbstractPolicyInterceptorPro AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim); if (suite != null) { client.setAlgorithmSuite(suite); - int x = suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength(); - if (x < 256) { + // The secret must have exactly the length required by the encryption algorithm of the suite + int x = JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption()); + if (x >= suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength() + && x <= suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) { client.setKeySize(x); } }
