CXF-9008: Add FIPS 140-2 compliance support by ffang · Pull Request #1893 · apache/cxf

ffang · 2024-05-26T20:12:44Z

Summary

Add support for running Apache CXF in FIPS 140-2 compliant mode. When a FIPS-approved security provider is detected, CXF automatically selects FIPS-compliant algorithms across WS-Security, JOSE/JWT, RS-Security XML encryption, and STS components.

Key Changes

Core Infrastructure

JavaUtils: Add isFIPSEnabled() and getFIPSSecurityProvider() utility methods for runtime FIPS detection, configurable via system properties (fips.enabled, fips.security.provider)
parent/pom.xml: Add FIPS-specific test profiles

Algorithm Selection (FIPS mode defaults)

JOSE/JWT: Use RSA-OAEP-256 instead of RSA-OAEP for key encryption (RSA 1.5 is not FIPS-approved); reject RSA1_5 during decryption in FIPS mode
RS XML Security: Use RSA-OAEP-11 (xenc11) instead of RSA-OAEP for key transport
WS-Security STS: Use KEYTRANSPORT_RSAOAEP_XENC11 instead of KEYTRANSPORT_RSAOAEP for key wrapping; exclude RSA 1.5 from accepted key wrap algorithms in FIPS mode
HTTP Signature: Use configurable FIPS security provider (via JavaUtils.getFIPSSecurityProvider())

WS-Security Policy

DefaultAlgorithmSuiteLoader: Add FIPS-compliant algorithm suite policies using GCM ciphers with RSA-OAEP key transport; CustomAlgorithmSuite uses RSA-OAEP instead of RSA15 in FIPS mode

Test Infrastructure

FIPS-specific WSDLs, Spring XML configs, and properties files across all security system tests
FIPS-specific keystores (PKCS12 format) for test certificates
Conditional test logic using JavaUtils.isFIPSEnabled() to select appropriate algorithms and configs
Unit tests for FIPS algorithm selection in JavaUtilsTest and JweFipsAlgorithmTest
RSA1_5/CBC tests skipped in FIPS mode (not FIPS-approved algorithms)
FIPS test properties use RSA-OAEP-256 (FIPS-approved key encryption algorithm)
Shared FipsTestUtils for FIPS state manipulation in tests

Modules Affected

cxf-core — FIPS utility methods
cxf-rt-rs-security-jose — JOSE/JWE algorithm selection and enforcement
cxf-rt-rs-security-xml — RS XML encryption algorithm selection
cxf-rt-rs-security-http-signature — Security provider selection
cxf-rt-ws-security — WS-Security algorithm suite loader
cxf-services-sts-core — STS encryption and key wrap algorithms
cxf-rt-rs-security-oauth2 — OAuth JWT producer
cxf-systests-ws-security, cxf-systests-rs-security, cxf-systests-sts — FIPS test configurations

JIRA

CXF-9008

jgoodyear · 2024-05-26T20:19:24Z

To help provide some testing of this PR , does one need to enable a profile or another parameter to test all the FIPS test cases or its all included in mvn install ?

ffang · 2024-05-26T20:23:56Z

what I have done in this PR

introduce a system property "fips.enabled", when it's true, switch the security algorithms which are not allowed in fips to fips compliant ones.
Mainly they are from AES_CBC to AES_GCM; from RSA_OAEP to RSA1_5. This needs the Apache WSS4J side change also. Please see
https://issues.apache.org/jira/browse/WSS-711
The default value of "fips.enabled" is false. So the default behaviour is the same as before.
A maven profile "fips" is introduced. So just run "mvn clean install -Pfips" on a fips enabled machine/jdk should be sufficient.
Several fips compliant ws-securitypolicy names are introduced to help easily run in fips mode
A lot security related tests are revised to pick up the fips compliant configurations/keys/certs when running tests with fips profile.

ffang · 2024-05-26T20:25:19Z

To help provide some testing of this PR , does one need to enable a profile or another parameter to test all the FIPS test cases or its all included in mvn install ?

Hi @jgoodyear ,
A maven profile "fips" is introduced. So just run "mvn clean install -Pfips" on a fips enabled machine/jdk should be sufficient.

Cheers
Freeman

jgoodyear · 2024-05-26T20:49:30Z

Is there a FIPS enabled build host on Apache infra? (CXF has ubuntu and windows test hosts, would be nice if the FIPS paths are regularly tested as well).

jgoodyear · 2024-05-27T12:31:57Z

Non-FIPS builds of CXF-9008 branch:

Stream 9 OS with Eclipse Adoptium 17 on PPC64LE Passed.
Ubuntu 22.04 LTS with Eclipse Adoptium 17 on x64 Passed.

jgoodyear · 2024-05-27T13:05:23Z

FIPS mode enabled on Stream 9 OS:

`
[jgoodyear@localhost cxf]$ fips-mode-setup --check

FIPS mode is enabled.

[jgoodyear@localhost ~]$ uname -a

Linux localhost.localdomain 5.14.0-447.el9.ppc64le #1 SMP Tue May 7 10:29:50 UTC 2024 ppc64le ppc64le ppc64le GNU/Linux
`

Invocation:

[jgoodyear@localhost cxf]$ mvn clean install -Dsemeru.fips=true -Pfips

Error Message:

`
[INFO]

[INFO] --- surefire:3.2.5:test (default-test) @ cxf-core ---

[INFO] Using auto detected provider org.apache.maven.surefire.junit4.JUnit4Provider

[INFO]

[INFO] -------------------------------------------------------

[INFO] T E S T S

[INFO] -------------------------------------------------------

java.lang.RuntimeException: Restricted security mode is not supported on this platform.
`

Maven/Java versions:

`
[jgoodyear@localhost cxf]$ mvn -version

Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)

Maven home: /home/jgoodyear/Documents/x1/maven/apache-maven-3.9.6

Java version: 17.0.8.1, vendor: IBM Corporation, runtime: /usr/lib/jvm/ibm-semeru-open-17-jdk

Default locale: en_US, platform encoding: UTF-8

OS name: "linux", version: "5.14.0-447.el9.ppc64le", arch: "ppc64le", family: "unix"
`

Its very possible I do not have a complete FIPS configuration for this system, that being said, enabling FIPS on the OS, and passing to Semeru fips=true should be the out of the box requirement for basic use. Any pointers welcome :)

This is a very cool feature to support for CXF.

ffang · 2024-05-27T14:32:08Z

FIPS mode enabled on Stream 9 OS:

` [jgoodyear@localhost cxf]$ fips-mode-setup --check

FIPS mode is enabled.

[jgoodyear@localhost ~]$ uname -a

Linux localhost.localdomain 5.14.0-447.el9.ppc64le #1 SMP Tue May 7 10:29:50 UTC 2024 ppc64le ppc64le ppc64le GNU/Linux `

Invocation:

[jgoodyear@localhost cxf]$ mvn clean install -Dsemeru.fips=true -Pfips

Error Message:

` [INFO]

[INFO] --- surefire:3.2.5:test (default-test) @ cxf-core ---

[INFO] Using auto detected provider org.apache.maven.surefire.junit4.JUnit4Provider

[INFO]

[INFO] -------------------------------------------------------

[INFO] T E S T S

[INFO] -------------------------------------------------------

java.lang.RuntimeException: Restricted security mode is not supported on this platform. `

Maven/Java versions:

` [jgoodyear@localhost cxf]$ mvn -version

Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)

Maven home: /home/jgoodyear/Documents/x1/maven/apache-maven-3.9.6

Java version: 17.0.8.1, vendor: IBM Corporation, runtime: /usr/lib/jvm/ibm-semeru-open-17-jdk

Default locale: en_US, platform encoding: UTF-8

OS name: "linux", version: "5.14.0-447.el9.ppc64le", arch: "ppc64le", family: "unix" `

Its very possible I do not have a complete FIPS configuration for this system, that being said, enabling FIPS on the OS, and passing to Semeru fips=true should be the out of the box requirement for basic use. Any pointers welcome :)

This is a very cool feature to support for CXF.

Hi @jgoodyear ,

Thanks for testing with this PR.

I'm not sure how to configure the environment you are using. Just FYI, my FIPS testing machine is like
Maven home: /tools/opt/apache-maven-3.8.6
Java version: 21.0.2, vendor: Red Hat, Inc., runtime: /usr/lib/jvm/java-21-openjdk-21.0.2.0.13-1.el8.x86_64
Default locale: en_CA, platform encoding: UTF-8
OS name: "linux", version: "4.18.0-477.27.1.el8_8.x86_64", arch: "amd64", family: "unix"

And If I do "mvn clean install -Pfips" I get a green build on that machine

Freeman

jgoodyear · 2024-05-27T15:56:26Z

No additions to your settings xml ?

I'll try the older Maven version, and RH OpenJDK 17 (want to verify using FIPS doesn't require a higher version than main builds).

ffang · 2024-05-27T16:02:04Z

No additions to your settings xml ?

I'll try the older Maven version, and RH OpenJDK 17 (want to verify using FIPS doesn't require a higher version than main builds).

No additions to my settings.xml.

And I think you need to use JDK21(LTS version) to get all tests passed with FIPS mode, because KW and KWP were added to PKCS11 provider(this is the FIPS compliant security provider) since JDK18, JDK17 missed this part.

Please see
https://bugs.openjdk.org/browse/JDK-8264849

jgoodyear · 2024-05-27T16:04:43Z

Interesting, thanks for that heads up -- will re-try Semeru on version 21 as well.

jgoodyear · 2024-05-27T17:22:49Z

As a heads up, IBM Semeru 17.0.10 is where FIPS support begins - i had 17.0.8.
I have a build currently in flight, will update when complete.

jgoodyear · 2024-05-27T17:34:44Z

Using Semeru 17.0.10 I got to :
[INFO] Apache CXF Runtime WS Security ..................... FAILURE [ 35.135 s]

In which the error messages were of the form:

`
NoSuchAlgorithmException: PKCS11 SecureRandom not available

or

org.apache.cxf.binding.soap.SoapFault: Security processing failed.
`

[ERROR] Tests run: 228, Failures: 3, Errors: 60, Skipped: 19

Will try Semeru 21 now

jgoodyear · 2024-05-27T18:04:59Z

Semeru 21 had class not found error,
RH OpenJDK 22 (latest) was not happy either.

`
[INFO]

[INFO] Apache CXF ......................................... SUCCESS [ 0.217 s]

[INFO] Apache CXF BOM ..................................... SUCCESS [ 0.011 s]

[INFO] Apache CXF Parent .................................. SUCCESS [ 1.125 s]

[INFO] Apache CXF Core .................................... FAILURE [ 19.362 s]
`

I'll take a deeper look on Semeru 17 tomorrow.

ffang · 2024-05-27T18:17:00Z

Semeru 21 had class not found error, RH OpenJDK 22 (latest) was not happy either.

` [INFO]

[INFO] Apache CXF ......................................... SUCCESS [ 0.217 s]

[INFO] Apache CXF BOM ..................................... SUCCESS [ 0.011 s]

[INFO] Apache CXF Parent .................................. SUCCESS [ 1.125 s]

[INFO] Apache CXF Core .................................... FAILURE [ 19.362 s] `

I'll take a deeper look on Semeru 17 tomorrow.

A quick question, did you manually applied this PR to WSS4J first and build locally
apache/ws-wss4j#313
This CXF PR relies on the WSS4J PR

ffang · 2024-05-27T18:20:08Z

Using Semeru 17.0.10 I got to : [INFO] Apache CXF Runtime WS Security ..................... FAILURE [ 35.135 s]

In which the error messages were of the form:

` NoSuchAlgorithmException: PKCS11 SecureRandom not available

or

org.apache.cxf.binding.soap.SoapFault: Security processing failed. `

[ERROR] Tests run: 228, Failures: 3, Errors: 60, Skipped: 19

Will try Semeru 21 now

Hi @jgoodyear ,

Not an expert for IBM JDK configuration, but per the IBM doc here
https://www.ibm.com/support/pages/fips-certified-cryptography-ibm-semeru-runtimes
PKCS11 SecureRandom should be available with IBM fips certified JDK.

I guess somehow the testing environment/machine/jdk isn't fully FIPS ready?

Best Regards
Freeman

jgoodyear · 2024-05-27T18:20:12Z

Ah, no - will update for that tomorrow :)
Thanks for the catch

ffang · 2024-05-30T16:00:13Z

Hi @coheigea ,

Could you please review this PR when you have free cycle?

This also requires a PR from Apache WSS4J side
apache/ws-wss4j#313

Thanks!
Freeman

# Conflicts: # parent/pom.xml # rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java # systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwejws/JAXRSJweJwsTest.java

RSA 1.5 (PKCS#1 v1.5) is not FIPS-approved for key transport. Replace all FIPS-mode RSA 1.5 defaults with proper FIPS-approved alternatives: - JOSE: RSA1_5 -> RSA_OAEP_256 (SHA-256 based) - XML Security: RSA_v1dot5 -> RSA_OAEP_11 (xenc11, SHA-256 based) - WS-Security/STS: KEYTRANSPORT_RSA15 -> KEYTRANSPORT_RSAOAEP_XENC11 Also: - Add configurable FIPS security provider via fips.security.provider system property instead of hardcoding SunPKCS11-NSS-FIPS - Fix Boolean.valueOf -> Boolean.parseBoolean for FIPS property - Fix tab character in parent/pom.xml - Fix misleading 'fips compliant' comment on RSA 1.5 algorithm suites - Update JoseConstants javadoc

- JavaUtilsTest: tests isFIPSEnabled(), getFIPSSecurityProvider(), isJavaKeyword(), and makeNonJavaKeyword() - JweFipsAlgorithmTest: verifies RSA-OAEP-256 is selected in FIPS mode and RSA-OAEP in non-FIPS mode for JWE key algorithms and RSAKeyDecryptionAlgorithm defaults

- DefaultSignatureConstants: move private constructor before static method to satisfy DeclarationOrder rule - alice-enc-fips.properties, bob-enc-fips.properties: add required license header comment prefix/suffix lines

Add required #/# prefix and suffix lines around the ASF license header in all FIPS properties files under systests/rs-security to comply with the RegexpHeader checkstyle rule. Also add missing trailing newlines.

AbstractServerRestricted.java was using UXPingServiceFips instead of UXNoTimestampPingServiceFips for the /UX-NoTimestampPingService endpoint in FIPS mode, which would bind the wrong WSDL port to that endpoint.

- Reject RSA1_5 key encryption in FIPS mode in RSAKeyDecryptionAlgorithm - Make CustomAlgorithmSuite FIPS-aware (use RSA-OAEP instead of RSA15) - Remove hardcoded SunPKCS11-NSS-FIPS provider, use configurable FIPS provider - Fix inverted FIPS ternary in JweCompactReaderWriterTest encryptContent helper - Add RSA1_5 rejection test and FIPS state restoration to JweFipsAlgorithmTest - Skip RSA15/CBC test in FIPS mode (not FIPS-approved algorithms)

- Extract duplicated setFipsEnabled/setFipsProvider reflection helpers into FipsTestUtils utility classes in core and jose test sources - Update FIPS test properties files to use RSA-OAEP-256 instead of RSA1_5 for stricter FIPS compliance

gnodet

All CI checks pass. FIPS 140-2 compliance support looks good — algorithm selection, enforcement, and test coverage are solid.

ffang · 2026-03-11T14:11:24Z

All CI checks pass. FIPS 140-2 compliance support looks good — algorithm selection, enforcement, and test coverage are solid.

Thanks so much @gnodet !

fips support

c3a75c7

ffang requested a review from coheigea May 30, 2024 15:59

gnodet added 5 commits March 10, 2026 18:33

Merge branch 'main' into CXF-9008

5d7084f

# Conflicts: # parent/pom.xml # rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java # systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jose/jwejws/JAXRSJweJwsTest.java

Fix checkstyle violations in FIPS changes

98e429c

- DefaultSignatureConstants: move private constructor before static method to satisfy DeclarationOrder rule - alice-enc-fips.properties, bob-enc-fips.properties: add required license header comment prefix/suffix lines

Fix license header format in FIPS properties files for checkstyle

9fca841

Add required #/# prefix and suffix lines around the ASF license header in all FIPS properties files under systests/rs-security to comply with the RegexpHeader checkstyle rule. Also add missing trailing newlines.

gnodet changed the title ~~fips support~~ CXF-9008: Add FIPS 140-2 compliance support Mar 10, 2026

gnodet added 3 commits March 11, 2026 00:44

Fix wrong FIPS service class for UX-NoTimestampPingService endpoint

6e8e560

AbstractServerRestricted.java was using UXPingServiceFips instead of UXNoTimestampPingServiceFips for the /UX-NoTimestampPingService endpoint in FIPS mode, which would bind the wrong WSDL port to that endpoint.

gnodet approved these changes Mar 11, 2026

View reviewed changes

gnodet added the enhancement label Mar 11, 2026

Conversation

ffang commented May 26, 2024 • edited by gnodet Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Changes

Core Infrastructure

Algorithm Selection (FIPS mode defaults)

WS-Security Policy

Test Infrastructure

Modules Affected

JIRA

Uh oh!

jgoodyear commented May 26, 2024

Uh oh!

ffang commented May 26, 2024

Uh oh!

ffang commented May 26, 2024

Uh oh!

jgoodyear commented May 26, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ffang commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

ffang commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

ffang commented May 27, 2024

Uh oh!

ffang commented May 27, 2024

Uh oh!

jgoodyear commented May 27, 2024

Uh oh!

ffang commented May 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gnodet left a comment

Choose a reason for hiding this comment

Uh oh!

ffang commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ffang commented May 26, 2024 •

edited by gnodet

Loading

jgoodyear commented May 27, 2024 •

edited

Loading

ffang commented May 30, 2024 •

edited

Loading