make test-suite runnable under FIPS#5866
make test-suite runnable under FIPS#5866beanuwave wants to merge 1 commit intoopensearch-project:mainfrom
Conversation
Signed-off-by: Igonin <iigonin@sternad.de> Co-authored-by: Benny Goerzig <benny.goerzig@sap.com> Co-authored-by: Karsten Schnitter <k.schnitter@sap.com> Co-authored-by: Kai Sternad <k.sternad@sternad.de>
| private static final String password = CryptoServicesRegistrar.isInApprovedOnlyMode() ? "dtekVF0vEAA9FNvm#KMkTwMN" : "secret"; | ||
|
|
||
| static { | ||
| ADMIN_USER = new TestSecurityConfig.User("admin").roles(ALL_ACCESS) |
There was a problem hiding this comment.
This modifies an attribute that was formely static final but was changed to just static in this PR.
I think this needs to be done in a different way, this is very prone to concurrency issues; and it is modifying static members of other classes is very surprising behavior which is usually not expected.
There was a problem hiding this comment.
I agree - this is just a dirty hack to make it work. Thanks for pointing it out, it should be reworked before moving out of WIP
| DefaultConnectionFactory connFactory = new DefaultConnectionFactory(config); | ||
|
|
||
| // Register custom socket factory for SNI hostname verification with BouncyCastle FIPS if SSL is enabled | ||
| if (config.getLdapUrl() != null && config.getLdapUrl().startsWith("ldaps:")) { |
There was a problem hiding this comment.
I am a bit confused by this; according to the PR this, this is only about the test code; yet, this is prod code.
Could you elaborate which this change is necessary here? Possibly, we can do it in a separate PR?
There was a problem hiding this comment.
I expect the amount of code to double or triple once this moves out of WIP. I also see potential to split this PR by authentication mechanism: LDAP, SAML, ... and possibly hashing-related logic, plus the rest.
3 participants
Description
Makes the required changes to build and test under FIPS-140-3 compliance support. FIPS mode can be activated by adding the -Pcrypto.standard=FIPS-140-3 Gradle parameter and configuring BC security providers as high prio.
Includes:
Issues Resolved
Resolves RFC
Testing
[Please provide details of testing done: unit testing, integration testing and manual testing]
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.