(cxf) branch 4.1.x-fixes updated: Fix secret key sizing for Spnego as well (#3454)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new 4ec8553a2da Fix secret key sizing for Spnego as well (#3454)
4ec8553a2da is described below

commit 4ec8553a2dac2dac91d5145cc20b4bf497d37ae5
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Wed Sep 9 06:40:30 2026 +0100

    Fix secret key sizing for Spnego as well (#3454)
    
    (cherry picked from commit 223fd2ffe6547fae6126f721acaceb3a4e912b7f)
---
 .../policy/interceptors/SpnegoTokenInterceptorProvider.java        | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git 
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
 
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
index ec239e9019c..9e809000b9d 100644
--- 
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
+++ 
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
@@ -36,6 +36,7 @@ import org.apache.wss4j.dom.engine.WSSConfig;
 import org.apache.wss4j.policy.SP11Constants;
 import org.apache.wss4j.policy.SP12Constants;
 import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.xml.security.algorithms.JCEMapper;
 
 /**
  *
@@ -79,8 +80,10 @@ public class SpnegoTokenInterceptorProvider extends 
AbstractPolicyInterceptorPro
         AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim);
         if (suite != null) {
             client.setAlgorithmSuite(suite);
-            int x = 
suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength();
-            if (x < 256) {
+            // The secret must have exactly the length required by the 
encryption algorithm of the suite
+            int x = 
JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption());
+            if (x >= 
suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength()
+                && x <= 
suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) {
                 client.setKeySize(x);
             }
         }