You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/09/08 15:15:25 UTC
(cxf) 01/01: Fix secret key sizing for Spnego as well
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/secure-size
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit a79b1c4a045c76d3c5f9d279927cd0351ceb9492
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Sep 8 16:14:57 2026 +0100
Fix secret key sizing for Spnego as well
---
.../policy/interceptors/SpnegoTokenInterceptorProvider.java | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
index ec239e9019c..9e809000b9d 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java
@@ -36,6 +36,7 @@ import org.apache.wss4j.dom.engine.WSSConfig;
import org.apache.wss4j.policy.SP11Constants;
import org.apache.wss4j.policy.SP12Constants;
import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.xml.security.algorithms.JCEMapper;
/**
*
@@ -79,8 +80,10 @@ public class SpnegoTokenInterceptorProvider extends AbstractPolicyInterceptorPro
AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim);
if (suite != null) {
client.setAlgorithmSuite(suite);
- int x = suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength();
- if (x < 256) {
+ // The secret must have exactly the length required by the encryption algorithm of the suite
+ int x = JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption());
+ if (x >= suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength()
+ && x <= suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) {
client.setKeySize(x);
}
}