[andreas-ibm]

Fix ArrayIndexOutOfBoundsException in isCertificateInKeyStore (RAMPART-461)

WSS4J 2.x+ returns an empty array (not null) when no certificate matches a lookup. The existing guard foundCerts != null && foundCerts[0] != null skipped the length check, throwing ArrayIndexOutOfBoundsException whenever a certificate was absent from the keystore.

Add foundCerts.length > 0 to the condition. Adds four unit tests covering the empty-array, null-array, matching-cert, and different-cert cases.

[andreas-ibm]

Built cleanly on my machine, but I needed to make some changes to the base master first because I'm using Semeru Java:

• Update WS-WSS4J to latest, to get Kerberos fixes
• RampartTest.java: Added serviceClient.cleanupTransport() after each invocation in the sc- Secure Conversation loop to cleanly reset TLS connections and avoid broken pipe socket errors.
• SymmetricBindingBuilder.java: In setupEncryptedKey, generated symmetric keys dynamically using the algorithm from the policy's configured algorithm suite (e.g. 256-bit for Basic256) rather than hardcoding AES_128, resolving the decryption BadPaddingException in Sample 09.

I'll submit a separate PR for these

[robertlazarski]

Thanks, this looks right. I confirmed the new testEmptyArrayReturnsFalse
fails with the AIOOBE before the change and passes after it. Happy to
merge as is. The SymmetricBindingBuilder AES_128 hard-coding looks like a
real bug, so please open a separate JIRA for it with that PR.