[jira] [Resolved] (KNOX-3361) Route OpenSAML off BouncyCastle in FIPS mode

["Tamás Hanicz (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3361?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tamás Hanicz resolved KNOX-3361.
--------------------------------
    Resolution: Fixed

> Route OpenSAML off BouncyCastle in FIPS mode
> --------------------------------------------
>
>                 Key: KNOX-3361
>                 URL: https://issues.apache.org/jira/browse/KNOX-3361
>             Project: Apache Knox
>          Issue Type: Task
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Tamás Hanicz
>            Assignee: Tamás Hanicz
>            Priority: Major
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> OpenSAML library uses non-FIPS compliant BouncyCastle dependencies.
> New {{gateway-shim-opensaml-security-api}} module: a shaded drop-in for {{org.opensaml:opensaml-security-api}} that swaps upstream's GlobalNamedCurveRegistryInitializer for a Knox-owned wrapper. When Knox is running on a FIPS cluster, the wrapper short-circuits SPI-driven EC curve registration so {{AbstractNamedCurve.initialize()}} never invokes {{org.bouncycastle.jce.ECNamedCurveTable}} — preventing BouncyCastle EC code from executing. In non-FIPS deployments the wrapper delegates to the upstream initializer, preserving unmodified OpenSAML behavior.
> ECDH-ES-encrypted SAML assertion decryption is not supported in FIPS mode (empty NamedCurveRegistry). RSA-signed and RSA-OAEP-encrypted SAML flows work identically in FIPS and non-FIPS.
> This solution builds on what [elasticsearch|https://github.com/elastic/elasticsearch/pull/98199] did, however for Knox it acts based on being on FIPS cluster or not.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)