Repository navigation
FIPS 140-2 support #9967
Description
Description
Make it possible to easily run Keycloak in a mode that is compliant with FIPS 140-2.
This can be broken down into:
- Host - see for example documentation for RHEL 8
- OpenJDK- see for example documentation for Red Hat OpenJDK
- Quarkus - validating if Quarkus is FIPS 140-2 compliant
- BouncyCastle - leverage BouncyCastle FIPS instead of regular BouncyCastle (see Quarkus documentation)
Additionally when Keycloak is running in FIPS mode all crypto algorithms that are not permitted by FIPS 140-2 should be unavailable. This would require crypto providers in Keycloak to be disabled, rather than simply not working if the underlying security providers do not provide specific algorithms.
In addition to the above where Keycloak should dynamically offer crypto algorithms based on what is provided through underlying security providers (OpenJDK + BouncyCastle) it may be beneficial to make it easy to disable specific providers (for example SHA1 although compliant with FIPS 140-2 could be something that people want to explicitly disable). This should be offered through a Keycloak level configuration rather than requiring deep understanding of OpenJDK.
A relatively straightforward way to enabling a FIPS mode for Keycloak would be to base it on the FIPS mode in RHEL. This can at least serve as a starting point where Keycloak is able to react to being on a RHEL system, and configures itself accordingly (on RHEL OpenJDK is already configured). We may also want to document how to run Keycloak in a FIPS compliant way on non-RHEL systems, and/or configuring the container to run in FIPS mode when not running on a RHEL/Fedora host with FIPS mode enabled.
Tasks
Tasks for this epic is managed in FIPS 140-2
Motivation
FIPS 140-2 is a requirement in certain deployments, and can also serve as a better secure by default mode even when not strictly required.
Details
See also #9916, which is covering a workaround to make Keycloak run on RHEL/Fedora systems with FIPS mode enable. Worth highlighting that it is not adding FIPS compliance to Keycloak, but rather just making sure Keycloak can run on a FIPS compliant host.
Activity
WKupper commentedon Feb 3, 2022
Posting in full support of this. Keycloak needs these changes to ever see government adoption.
rush2sk8 commentedon Feb 3, 2022
Can confirm. This error is halting our development.
stianst commentedon Feb 4, 2022
I have a POC with Keycloak Quarkus dist, on a FIPS enabled Fedora system, with BouncyCastle FIPS here:
https://github.com/stianst/keycloak/tree/FIPS-POC
It starts and you can login, but a bunch of things are not working, and it's going to be quite a bit of an effort to make this work properly, then there's polish around things like not making unsupported crypto algorithms available, rather than just fail unexpectedly.
WKupper commentedon Feb 8, 2022
What type of stuff doesnt work? Can contribute to changing over hash algos.
isaacjensen commentedon Feb 10, 2022
I've been working with a few colleagues on FIPS 140-2 keycloak. We've got the bc-fips, bcpkix-fips, bctls-fips jars included, and have been fixing arquillian integration tests. We are interested in contributing.
tspearconquest commentedon Feb 15, 2022
Following. Is there any plan to try to have this done before June when the WildFly distribution is phased out?
We have BC FIPS running in the WildFly distribution and want to make sure we can configure FIPS in Quarkus before we are forced to migrate to Quarkus in June.
sudeepd commentedon Feb 23, 2022
@tspearconquest I am working on getting a contribution in, like @isaacjensen mentioned above. It may seem surprising, but getting KC to work properly in FIPS mode is more than just replacing crypto libraries. The changes we had to make are widespread. We may be able to get things in, a June timeframe might be somewhat aggressive though
sudeepd commentedon Feb 24, 2022
@stianst We have a fork that runs KC purely with bouncy castle FIPS libraries. We would like to find a path to merge it to main. The changes are significant, and there are also changes to upstream components like xmlsec. We would like to explore a dedicated path forward towards this, and would appreciate your help to drive this forward.
tspearconquest commentedon Feb 24, 2022
Hi @sudeepd from what I could see on yours and @isaacjensen's keycloak forks' branches it appears they are based on the Wildfly build of Keycloak, is that right?
It's a big concern for us regarding whether this will be available in Keycloak by June because the Wildfly Keycloak build is currently able to be configured for FIPS compliance as per your own confirmation (the method for doing so being what you described), but this build is being EOL in June, and so any efforts toward merging something into keycloak/keycloak:main should focus on the Quarkus build.
The default build for Keycloak 17 and higher is the Quarkus build and you have to download Keycloak 17 Legacy to get the Wildfly build, so they are already pushing some users to it.
As per your own confirmation it is possible to configure the Wildfly build for FIPS compliance, so we have to continue running the Wildfly build in order to maintain our FIPS compliance, and if that build is EOL before the Quarkus build has a method to configure it for FIPS compliance, then we have to run the unsupported Wildfly build and run the risk that a critical vulnerability becomes publicized at some point which won't be patched. It wouldn't be good to be put in that situation so I am asking for additional info on how much priority this has from the Keycloak team. We should hope that it would be a top priority for them since we will be effectively losing functionality.
WKupper commentedon Feb 24, 2022
I would like to comment, that per DoD AppSecDev SRG item: https://www.stigviewer.com/stig/application_security_and_development/2020-09-30/finding/V-222658
All products utilized by the DoD must be under product support. This is a CAT 1 finding, meaning it has exactly 0% chance of ever being approved for usage if Wildfly is the only way to do FIPS and it goes EOL.
sudeepd commentedon Feb 24, 2022
@tspearconquest , I am absolutely with you on this. I am requesting keycloak team to prioritize this, maybe @stianst can provide some inputs. My approach so far as been to separate my FIPS effort into getting the application logic to be FIPS 140-2 , and address the application server separately. @isaacjensen and I do not have expertise on wildfly/quarkus/undertow etc, and that is where we are asking for the keycloak team to prioritize and the community to help. I and isaac are offering all the help to move this forward.
8 remaining items
saguntumkar commentedon May 3, 2022
@sudeepd @stianst we are also having the same issue with the FIPS enabled Linux machines. The suggested workaround of disabling FIPS would not work for us due to customer complaints. Any updates on adding FIPS support in keycloak?
blacklobo commentedon Aug 2, 2022
Has there been any further discussion on to the path that will be taken to FIPS 140-2 compliance?
shpeedle commentedon Oct 23, 2022
Any updates on the FIPS effort?
tspearconquest commentedon Oct 26, 2022
I see they've moved this to milestone 21.0.0. What should existing users who are on Wildfly expected to do? Remain on 19 without support until 21 is released? What about when we have a CVE? It happens with every Keycloak release. The fact that this is not being prioritized and the WildFly distribution is being dropped, despite users within the DoD actively using the WildFly distribution is a big problem. I'm going to echo the comment from @WKupper, there is a 0% chance of us proceeding forward with Keycloak after v20 if FIPS is not available with documentation in that release.
rush2sk8 commentedon Nov 3, 2022
This was posted a couple weeks ago. #9916 (comment)
mposolda commentedon Feb 22, 2023
Resolving this as FIPS 140-2 support is now added and will be available in Keycloak 21. FIPS would be available as "preview feature" with the aim to make it fully supported from Keycloak 22.
Keycloak 21 release is very likely going to happen in the next few weeks (hopefully even this week or next week, but hard to promise...).
Feedback is welcome from anyone trying Keycloak 21 release. Feel free to tag my GH username directly in any FIPS related issue reported.
Just for the reference, here is the FIPS project, which is tracking FIPS related work: FIPS 140-2 (view)