Fwd: Need help with OpenSAML 4.x and other library upgrades

[mogasale.tech]

Hi Team,

We have applications that supports FIPS compliance, and runs on Java11,
Spring Security 5.8, OpenSAML 3.4.6 as of today.

While working on migration to Java17 and relevant library upgrades (Spring
6, OpenSAML 4 and others), we realised the issue below with FIPS mode and
OpenSAML.


   - Spring Security 6 has baselined the OpenSAML version to 4.x as the
   OpenSAML 3.x (which we currently have) is already EOL.
      -
      https://docs.spring.io/spring-security/reference/5.8/migration/servlet/saml2.html

      - However, OpenSAML 4.x cannot work with bc-fips due to some hard
   dependencies from Bouncycastle's non-FIPS jar (bcprov-jdk<nn>on). (Note: I
   understand that OpenSAML 3.x never claimed FIPS compliance, however it did
   not break when only bc-fips JCE provider was loaded, that is broken with
   opensaml 4.x). The discussions here are open ended with no resolution.
      - https://groups.google.com/g/pac4j-dev/c/jDeEN-mUwd0
      - https://github.com/elastic/elasticsearch/issues/71983

      - The responses in these forums about FIPS support are not assuring
   either.
      -
      https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1159627167/FIPS
      - https://shibboleth.atlassian.net/browse/OSJ-339

This issue now has below consequences on applications that need to support
FIPS compliance

   - Cannot upgrade to OpenSAML 4.x, hence upgrade to Spring 6 is blocked.
   - Upgrades of multiple libraries to newer versions requiring Jakarta EE
   9+ spec are blocked because Spring 6 upgrade is blocked.

Could you please look into this issue and prioritise the fix as it would
have larger implications on the consuming applications. Any guidance on
possible workarounds, if any, would be helpful as a temporary measure.

We are open to contributing towards the fix if that helps in a
meaningful manner.

Regards,
Rama
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20230815/6baa2e3e/attachment.htm>