<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<p>For future reference, this is really more appropriate for the dev
list.</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 5/17/21 1:16 PM, Scott Coldwell
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:C5F0D4A8-CDA2-44AC-BCF3-C360F0319F6F@intelliworxit.com">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
Hi,
<div class=""><br class="">
</div>
<div class="">We have been using OpenSAML 4.0 (by way of pac4j)
successfully with bouncy castle's FIPS provider only (no other
bc providers on the classpath).</div>
</blockquote>
<p><br>
</p>
<p>Well, it's technically not supported to just replace our
dependencies like that. If you can get it to work, that's fine,
it's your business. But if if breaks, you are largely going to be
on your own... <br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:C5F0D4A8-CDA2-44AC-BCF3-C360F0319F6F@intelliworxit.com">
<div class="">We recently tried to update pac4j to version 5 which
updated OpenSAML to 4.1. OpenSAML 4.1 no longer seems to work
with bc-fips. We get class not found exceptions on startup. <br>
</div>
</blockquote>
<p><br>
</p>
<p>That's probably because in 4.1 we introduced support for ECDH
encryption. That's fundamentally about key derivation. That
class org.bouncycastle.crypto.DerivationParameters is likely
indirectly used by the new support. I know nothing of bc-fips -
I've literally never looked at it - so I don't know why it
wouldn't have that class or in general how it differs from the
standard BC Java library. If bc-fips is not literally just a
FIPS-compliant drop-in replacement for bcprov-jdk15on, then you
may be out of luck.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:C5F0D4A8-CDA2-44AC-BCF3-C360F0319F6F@intelliworxit.com">
<div class=""> Any idea how we can make it work like it did with
OpenSAML 4.0?<br>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>I don't off-hand have any idea. I'm personally curious as to
how/why bc-fips differs from the standard BC library, and I might
have some time to look at that down the road (weeks/months). As a
project we may want to formally evaluate that, at a minimum to
confirm what does and doesn't work. Don't know that we've ever
been asked about FIPS compliance for the Shib IdP.</p>
<p>But that doesn't mean there is any solution forthcoming from us
anytime soon, if ever. You should assume you have to solve this
yourself, if it's solvable.<br>
</p>
<br>
</body>
</html>