From 3a944861b4b57a87cf1afa351a79d92bbd244941 Mon Sep 17 00:00:00 2001 From: Pierre HILBERT Date: Mon, 27 Jul 2026 14:39:03 +0200 Subject: [PATCH 1/2] Exclude Azure Identity Federation code in FIPS mode --- x-pack/libbeat/common/identityfederation/azure.go | 7 +++++++ x-pack/libbeat/common/identityfederation/azure_test.go | 2 ++ 2 files changed, 9 insertions(+) diff --git a/x-pack/libbeat/common/identityfederation/azure.go b/x-pack/libbeat/common/identityfederation/azure.go index 06d9c9715f2a..d989a9501962 100644 --- a/x-pack/libbeat/common/identityfederation/azure.go +++ b/x-pack/libbeat/common/identityfederation/azure.go @@ -2,6 +2,13 @@ // or more contributor license agreements. Licensed under the Elastic License; // you may not use this file except in compliance with the Elastic License. +// Azure identity federation is excluded from FIPS builds because the Azure SDK +// transitively imports golang.org/x/crypto/pkcs12, which uses RC2 and DES — +// algorithms not approved under FIPS 140. See +// https://github.com/Azure/azure-sdk-for-go/issues/24336. +// +//go:build !requirefips + package identityfederation import ( diff --git a/x-pack/libbeat/common/identityfederation/azure_test.go b/x-pack/libbeat/common/identityfederation/azure_test.go index ad301d656478..89600a4e2d24 100644 --- a/x-pack/libbeat/common/identityfederation/azure_test.go +++ b/x-pack/libbeat/common/identityfederation/azure_test.go @@ -2,6 +2,8 @@ // or more contributor license agreements. Licensed under the Elastic License; // you may not use this file except in compliance with the Elastic License. +//go:build !requirefips + package identityfederation import ( From f4942a073560b9d2fdc94deddb90d5f4bd44873e Mon Sep 17 00:00:00 2001 From: Pierre HILBERT Date: Mon, 27 Jul 2026 14:43:21 +0200 Subject: [PATCH 2/2] Add changelog entry --- ...156108-fips-azure-identity-federation.yaml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 changelog/fragments/1785156108-fips-azure-identity-federation.yaml diff --git a/changelog/fragments/1785156108-fips-azure-identity-federation.yaml b/changelog/fragments/1785156108-fips-azure-identity-federation.yaml new file mode 100644 index 000000000000..bb88c63b8baa --- /dev/null +++ b/changelog/fragments/1785156108-fips-azure-identity-federation.yaml @@ -0,0 +1,45 @@ +# REQUIRED +# Kind can be one of: +# - breaking-change: a change to previously-documented behavior +# - deprecation: functionality that is being removed in a later release +# - bug-fix: fixes a problem in a previous version +# - enhancement: extends functionality but does not break or fix existing behavior +# - feature: new functionality +# - known-issue: problems that we are aware of in a given version +# - security: impacts on the security of a product or a user’s deployment. +# - upgrade: important information for someone upgrading from a prior version +# - other: does not fit into any of the other categories +kind: enhancement + +# REQUIRED for all kinds +# Change summary; a 80ish characters long description of the change. +summary: Remove Azure Identity Federation from FIPS builds + +# REQUIRED for breaking-change, deprecation, known-issue +# Long description; in case the summary is not enough to describe the change +# this field accommodate a description without length limits. +# description: + +# REQUIRED for breaking-change, deprecation, known-issue +# impact: + +# REQUIRED for breaking-change, deprecation, known-issue +# action: + +# REQUIRED for all kinds +# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc. +component: heartbeat + +# AUTOMATED +# OPTIONAL to manually add other PR URLs +# PR URL: A link the PR that added the changeset. +# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. +# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. +# Please provide it if you are adding a fragment for a different PR. +# pr: https://github.com/owner/repo/1234 + +# AUTOMATED +# OPTIONAL to manually add other issue URLs +# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of). +# If not present is automatically filled by the tooling with the issue linked to the PR number. +# issue: https://github.com/owner/repo/1234