[BUG] Current version of OpenSAML is incompatible with the Bouncy Castle FIPS library

[dancristiancecoi]

What is the bug?
Current version of OpenSAML (4.3.2) does not work in FIPS mode as it has a hard dependency (org.bouncycastle.jce.ECNamedCurveTable) on the non-FIPS distribution of Bouncy Castle

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Replace BC with BC-FIPS
2. Run OpenSAML related tests
3. You will see a error due to missing the ECNamedCurveTable dependency

Potential solutions

1. Downgrade OpenSAML to 3.x
2. Downgrade OpenSAML to 4.0 (Tests seem to pass under that version, however some untested functionality might still be broken)
3. Replace OpenSAML with Keycloak as it supports running in FIPS 140-2 compliant mode
   

Relevant links
#3420
elastic/elasticsearch#71983
https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1159627167/FIPS
https://shibboleth.net/pipermail/dev/2023-August/011111.html
https://www.keycloak.org/server/fips

[cwperks]

[Triage] Thank you for filing an issue for this @dancristiancecoi. Should I assign this issue to you?

[dancristiancecoi]

@cwperks I can give it a try, thanks!

Would also be great to get some feedback from the community on what potential solution would be the best way forward.

@dancristiancecoi
Removing service 'META-INF/services/org.opensaml.security.crypto.ec.NamedCurve' from opensaml will ensure EC classes are not loaded eagerly and you can remove bc non fips dependencies.

Elastic search have implemented this already, please refer to this : https://github.com/elastic/elasticsearch/pull/98199/files

[dancristiancecoi]

Excellent find @shshankvikrram, thanks!

Am I correct saying that this fixes the error on start-up for Elasticsearch but the functionality that relies on EC will still be broken?

In OpenSearch's case the error does not happen on start-up but when the OpenSAML code gets called. If we used this solution and we do not rely on any EC related functionality then we might be okay.

Are we confident that we don't rely on any of that functionality and that the test coverage in that area is sufficient to prove this?

Yes if it relies on EC then it might break but that doesn't seem to be the case here as per my understanding. Looks like OpenSearch doesn't invoke any flow which might use EC functionality in OpenSAML though I am not 100% confident.

[dancristiancecoi]

As you suggested, @cwperks , I tried running the tests in saml_auth_test.spec.js against an OpenSearch cluster with the Security plugin and FIPS jars.

The tests didn't run successfully, likely because I'm using a different OpenSAML server than the one the tests expect.

However, when testing the setup manually, I get the following error after clicking the "Log in with single sign-on" button:

InvocationTargetException; nested: NoClassDefFoundError[org/bouncycastle/crypto/DerivationParameters]; nested: ClassNotFoundException[org.bouncycastle.crypto.DerivationParameters];
org.opensearch.OpenSearchException: java.lang.reflect.InvocationTargetException
        at org.opensearch.security.support.ReflectionHelper.instantiateAAA(ReflectionHelper.java:73) ~[?:?]
        at org.opensearch.security.securityconf.DynamicConfigModelV7.lambda$newInstance$1(DynamicConfigModelV7.java:433) ~[?:?]
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:319) ~[?:?]
        at org.opensearch.security.securityconf.DynamicConfigModelV7.newInstance(DynamicConfigModelV7.java:431) ~[?:?]
        at org.opensearch.security.securityconf.DynamicConfigModelV7.buildAAA(DynamicConfigModelV7.java:329) ~[?:?]
        at org.opensearch.security.securityconf.DynamicConfigModelV7.<init>(DynamicConfigModelV7.java:102) ~[?:?]
        at org.opensearch.security.securityconf.DynamicConfigFactory.onChange(DynamicConfigFactory.java:263) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.notifyAboutChanges(ConfigurationRepository.java:567) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.notifyConfigurationListeners(ConfigurationRepository.java:556) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.reloadConfiguration0(ConfigurationRepository.java:551) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.loadConfigurationWithLock(ConfigurationRepository.java:535) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.reloadConfiguration(ConfigurationRepository.java:528) ~[?:?]
        at org.opensearch.security.configuration.ConfigurationRepository.reloadConfiguration(ConfigurationRepository.java:519) ~[?:?]
        at org.opensearch.security.action.configupdate.TransportConfigUpdateAction.nodeOperation(TransportConfigUpdateAction.java:128) ~[?:?]
        at org.opensearch.security.action.configupdate.TransportConfigUpdateAction.nodeOperation(TransportConfigUpdateAction.java:52) ~[?:?]
        at org.opensearch.action.support.nodes.TransportNodesAction.nodeOperation(TransportNodesAction.java:200) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.action.support.nodes.TransportNodesAction$NodeTransportHandler.messageReceived(TransportNodesAction.java:334) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceivedDecorate(SecuritySSLRequestHandler.java:207) ~[?:?]
        at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:210) ~[?:?]
        at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:106) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin$6$1.messageReceived(OpenSearchSecurityPlugin.java:869) ~[?:?]
        at org.opensearch.wlm.WorkloadManagementTransportInterceptor$RequestHandler.messageReceived(WorkloadManagementTransportInterceptor.java:63) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:108) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.transport.TransportService$7.doRun(TransportService.java:1048) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:975) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) ~[opensearch-3.0.0-SNAPSHOT.jar:3.0.0-SNAPSHOT]
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?]
        at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:74) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
        at org.opensearch.security.support.ReflectionHelper.instantiateAAA(ReflectionHelper.java:62) ~[?:?]
        ... 28 more
Caused by: java.lang.NoClassDefFoundError: org/bouncycastle/crypto/DerivationParameters
        at org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations(DefaultSecurityConfigurationBootstrap.java:152) ~[?:?]
        at org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap.buildDefaultEncryptionConfiguration(DefaultSecurityConfigurationBootstrap.java:126) ~[?:?]
        at org.opensaml.xmlsec.config.impl.GlobalSecurityConfigurationInitializer.init(GlobalSecurityConfigurationInitializer.java:33) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.initializeOpenSAMLConfiguration(HTTPSamlAuthenticator.java:325) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.lambda$ensureOpenSamlInitialization$0(HTTPSamlAuthenticator.java:301) ~[?:?]
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:571) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.ensureOpenSamlInitialization(HTTPSamlAuthenticator.java:296) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.<init>(HTTPSamlAuthenticator.java:111) ~[?:?]
        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
        at org.opensearch.security.support.ReflectionHelper.instantiateAAA(ReflectionHelper.java:62) ~[?:?]
        ... 28 more
Caused by: java.lang.ClassNotFoundException: org.bouncycastle.crypto.DerivationParameters
        at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:445) ~[?:?]
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:593) ~[?:?]
        at java.base/java.net.FactoryURLClassLoader.loadClass(URLClassLoader.java:872) ~[?:?]
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526) ~[?:?]
        at org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations(DefaultSecurityConfigurationBootstrap.java:152) ~[?:?]
        at org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap.buildDefaultEncryptionConfiguration(DefaultSecurityConfigurationBootstrap.java:126) ~[?:?]
        at org.opensaml.xmlsec.config.impl.GlobalSecurityConfigurationInitializer.init(GlobalSecurityConfigurationInitializer.java:33) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.initializeOpenSAMLConfiguration(HTTPSamlAuthenticator.java:325) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.lambda$ensureOpenSamlInitialization$0(HTTPSamlAuthenticator.java:301) ~[?:?]
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:571) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.ensureOpenSamlInitialization(HTTPSamlAuthenticator.java:296) ~[?:?]
        at org.opensearch.security.auth.http.saml.HTTPSamlAuthenticator.<init>(HTTPSamlAuthenticator.java:111) ~[?:?]
        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?]
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?]
        at org.opensearch.security.support.ReflectionHelper.instantiateAAA(ReflectionHelper.java:62) ~[?:?]
        ... 28 more

It works fine when I replace the security plugin with a non-fips version.

Unfortunately it looks like we will need to make changes in this area to make it work in an FIPS environment.

Thanks again for your instructions and help!

cc @terryquigleysas