[
https://issues.apache.org/jira/browse/KNOX-3361?focusedWorklogId=1028225&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028225
]
ASF GitHub Bot logged work on KNOX-3361:
----------------------------------------
Author: ASF GitHub Bot
Created on: 06/Jul/26 13:31
Start Date: 06/Jul/26 13:31
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1299:
URL: https://github.com/apache/knox/pull/1299
[KNOX-3361](https://issues.apache.org/jira/browse/KNOX-3361) - Route
OpenSAML off BouncyCastle in FIPS mode
## What changes were proposed in this pull request?
New `gateway-shim-opensaml-security-api` module: a shaded drop-in for
`org.opensaml:opensaml-security-api` that swaps upstream's
GlobalNamedCurveRegistryInitializer for a Knox-owned wrapper. When Knox is
running on a FIPS cluster, the wrapper short-circuits SPI-driven EC curve
registration so `AbstractNamedCurve.initialize()` never invokes
`org.bouncycastle.jce.ECNamedCurveTable` — preventing BouncyCastle EC code from
executing. In non-FIPS deployments the wrapper delegates to the upstream
initializer, preserving unmodified OpenSAML behavior.
ECDH-ES-encrypted SAML assertion decryption is not supported in FIPS mode
(empty NamedCurveRegistry). RSA-signed and RSA-OAEP-encrypted SAML flows work
identically in FIPS and non-FIPS.
This solution builds on what
[elasticsearch](https://github.com/elastic/elasticsearch/pull/98199) did,
however for Knox it acts based on being on FIPS cluster or not.
## How was this patch tested?
- Unit tests
`KnoxNamedCurveRegistryInitializerTest` covers both branches:
FIPS mode → registry empty, `ECSupport.getNamedCurve` returns null
Non-FIPS mode → registry populated by upstream,
`ECSupport.getNamedCurve` resolves `secp256r1`
- Tested classpath for installed Knox
- Tested RSA SAML with Keycloak for both FIPS and non-FIPS
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1028225)
Remaining Estimate: 0h
Time Spent: 10m
> Route OpenSAML off BouncyCastle in FIPS mode
> --------------------------------------------
>
> Key: KNOX-3361
> URL: https://issues.apache.org/jira/browse/KNOX-3361
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
