[
https://issues.apache.org/jira/browse/NIFI-14048?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17909004#comment-17909004
]
ASF subversion and git services commented on NIFI-14048:
--------------------------------------------------------
Commit e3fff91dd175ed30346520a870db4b9d19237d75 in nifi's branch
refs/heads/main from David Handermann
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=e3fff91dd1 ]
NIFI-14048 Added fallback to RSA for Framework Application Tokens
This closes #9603.
- Added KeyPairGeneratorConfiguration with Security Provider detection for
Ed25519 and fallback to RSA when not found
- Added StandardJWSVerifierFactory supporting either EdDSA for Ed25519 or PS512
for RSA signatures
- Updated KeyGenerationCommand with provided KeyPairGenerator and conditional
JWS Algorithm selection
Signed-off-by: Joseph Witt <[email protected]>
> Ed25519 Not Available in FIPS Mode on RHEL 9
> --------------------------------------------
>
> Key: NIFI-14048
> URL: https://issues.apache.org/jira/browse/NIFI-14048
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework, Security
> Affects Versions: 2.0.0
> Environment: On a Red Hat 9.5 FIPS mode installation, NiFi 2.0 will
> not start since Ed25519 (and Ed448) signatures are disabled in the
> system-wide FIPS crypto policy. We are unable to deviate from this crypto
> policy.
> Reporter: Angela E
> Assignee: David Handermann
> Priority: Major
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> On a Red Hat 9.5 FIPS mode installation, NiFi 2.0 will not start since
> Ed25519 (and Ed448) signatures are disabled in the system-wide FIPS crypto
> policy. We are unable to deviate from this crypto policy.
>
> JSON Web Token change in NiFi 2.0.0-M4 as referenced in:
>
> https://issues.apache.org/jira/browse/NIFI-13424
>
> When attempting to start, NiFi issues this exception:
>
> Factory method 'keyGenerationCommand' threw exception with message:
> java.security.NoSuchAlgorithmException: Ed25519 KeyPairGenerator not available
>
> Recommending an optional setting in nifi.properties to allow the JWT to
> revert to previous PS512 signatures.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
