LDAP auth broken with recent patch? FIPS mode breaks openjdk crypto

[gsmith]

@mntbighker

illegal key size,

Gotcha,

Since Mongo holds all the metadata, have you check your ldap_settings in MongoDb?
By chance did JAVA get update also during your recent update?

[mntbighker (Mark M)]

Read my latest updated post

[mntbighker (Mark M)]

VERIFIED…

fips-mode-setup --disable
reboot

Fixed

Now what, if you need FIPS to be federally compliant? I guess possibly you need a paid java solution with FIPS support?

[gsmith]

Thanks for posting the resolution.

[mntbighker (Mark M)]

Here is a relevant reference on the topic. May take the Graylog devs to implement something, or it may require disabling FIPS in java if FIPS is enabled in the OS.

[gsmith]

I’m actually curious about this situation. Correct me if I’m wrong, but did you have FIPS enable on the OS level then enabled it also on the software level? or was this just enable on the software level then it fail with LDAP?

[mntbighker (Mark M)]

Enabled FIPS at boot time with a kernel arg. Read the RHEL document, it seems OpenJDK picks up the fips boot mode and acts accordingly. This broke the Graylog LDAP. It seems you can force OpenJDK not to follow the boot env and disable it. But that sort of defeats the purpose.

This broke my Gitlab setup as well as it turns out. It also uses java.

[gsmith]

Thank you for your reply, This is good to know.