From a79b1c4a045c76d3c5f9d279927cd0351ceb9492 Mon Sep 17 00:00:00 2001 From: Colm O hEigeartaigh Date: Tue, 8 Sep 2026 16:14:57 +0100 Subject: [PATCH] Fix secret key sizing for Spnego as well --- .../interceptors/SpnegoTokenInterceptorProvider.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java index ec239e9019c..9e809000b9d 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java @@ -36,6 +36,7 @@ import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.model.AlgorithmSuite; +import org.apache.xml.security.algorithms.JCEMapper; /** * @@ -79,8 +80,10 @@ static String setupClient(STSClient client, SoapMessage message, AssertionInfoMa AlgorithmSuite suite = NegotiationUtils.getAlgorithmSuite(aim); if (suite != null) { client.setAlgorithmSuite(suite); - int x = suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength(); - if (x < 256) { + // The secret must have exactly the length required by the encryption algorithm of the suite + int x = JCEMapper.getKeyLengthFromURI(suite.getAlgorithmSuiteType().getEncryption()); + if (x >= suite.getAlgorithmSuiteType().getMinimumSymmetricKeyLength() + && x <= suite.getAlgorithmSuiteType().getMaximumSymmetricKeyLength()) { client.setKeySize(x); } }