You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/09/22 15:38:31 UTC
(cxf) 02/02: Fix secret key sizing for Spnego as well (#3454)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 6cb92e91f1d785f5118da2eed4734d286a0450ad
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Wed Sep 9 06:40:30 2026 +0100
Fix secret key sizing for Spnego as well (#3454)
---
.../policy/interceptors/SpnegoTokenInterceptorProvider.java | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
index ec239e9019c..9e809000b9d 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
@@ -36,6 +36,7 @@ import org.apache.wss4j.dom.engine.WSSConfig;
import org.apache.wss4j.policy.SP11Constants;
import org.apache.wss4j.policy.SP12Constants;
import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.xml.security.algorithms.JCEMapper;
/**
*
@@ -79,8 +80,10 @@ public class SpnegoTokenInterceptorProvider extends AbstractPolicyInterceptorPro
AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim);
if (suite != null) {
client.setAlgorithmSuite(suite);
- int x = suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength();
- if (x < 256) {
+ // The secret must have exactly the length required by the encryption algorithm of the suite
+ int x = JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption());
+ if (x >= suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength()
+ && x <= suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) {
client.setKeySize(x);
}
}