Fix createLDAPCertStore failing in FIPS mode (#144376) by JVerwolf · Pull Request #144453 · elastic/elasticsearch

JVerwolf · 2026-03-17T22:21:44Z

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance("LDAP", null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail.

The fix catches NSAE(NoSuchAlgorithmException) in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed.

Adds unit tests that reproduce both paths by temporarily manipulating JCA providers.

Closes: #144376
Closes: #144377
Relates: #144431

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance("LDAP", null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail. The fix catches NSAE in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed. Adds unit tests that reproduce both paths by temporarily manipulating JCA providers.

elasticsearchmachine · 2026-03-17T22:22:10Z

Pinging @elastic/es-core-infra (Team:Core/Infra)

elasticsearchmachine · 2026-03-17T22:22:10Z

Hi @JVerwolf, I've created a changelog YAML for you.

coderabbitai · 2026-03-17T22:25:31Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds handling for NoSuchAlgorithmException in createLDAPCertStore so the exception is suppressed when the LDAP CertStore algorithm is unavailable but rethrown when its cause is a NotEntitledException. Introduces NetworkAccessCheckActionsTests with four regression tests covering provider-present, provider-absent, entitlement-denial, and non-entitlement-denial paths. Removes two entries from muted-tests.yml that muted createLDAPCertStore-related tests.

Suggested labels

>test-mute

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR fully addresses both linked issues by fixing NoSuchAlgorithmException handling in FIPS mode and adding comprehensive regression tests.
Out of Scope Changes check	✅ Passed	All changes directly support the linked issue objectives: exception handling logic, regression tests, and unmuting previously failing tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ Update Documentation: Commit on current branch
🛠️ Update Documentation: Create PR

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

slobodanadamovic · 2026-03-18T11:06:14Z

@JVerwolf Thanks for handling this. I'll close my mute PR since it makes no sense to proceed with it.

One small suggestion, can you add >test-fips and >test-fips-140-3 labels in order to trigger FIPS related CI pipelines? This will verify the fix. You may need to merge main after adding labels in order for labels to be effective.

Also, these tests are failing in other branches as well. It would be great to backport this fix to all active ones.

n1v0lg · 2026-03-18T13:10:07Z

@slobodanadamovic @JVerwolf since the PR is still waiting on a review it'd be great to mute the tests in the meantime to avoid blocking other PRs.

Thanks for the fix @JVerwolf!

slobodanadamovic · 2026-03-18T14:04:01Z

@slobodanadamovic @JVerwolf since the PR is still waiting on a review it'd be great to mute the tests in the meantime to avoid blocking other PRs.

Thanks for the fix @JVerwolf!

I can re-open #144431 and merge it if I get 👍 (or do we even require approval for muting tests?)

n1v0lg · 2026-03-18T14:08:39Z

do we even require approval for muting tests

nope mutes go straight to main without approval 👍 (I think automation might even just straight commit them without PRs but perhaps I'm making that part up)
thanks @slobodanadamovic!

JVerwolf · 2026-03-18T14:12:00Z

@slobodanadamovic I don't think you need approval to mute tests, but I gave it a 👍 anyways. Thanks for this!

Question: I don't see the labels you mentioned: >test-fips and >test-fips-140-3 as pre-existing in GH. When I add those, I'm prompted to create a new label. Are you sure that the automation you mentioned exists for this codebase? (Entitlements are a bit out of my wheelhouse, but I'll look in @jdconrad to double check the PR).

slobodanadamovic · 2026-03-18T14:14:27Z

Question: I don't see the labels you mentioned: >test-fips and >test-fips-140-3 as pre-existing in GH. When I add those, I'm prompted to create a new label. Are you sure that the automation you mentioned exists for this codebase? (Entitlements are a bit out of my wheelhouse, but I'll look in @jdconrad to double check the PR).

My bad, they don't have > as prefix. I added them now.

slobodanadamovic · 2026-03-18T14:17:00Z

Keep in mind that we now muted the failing tests on main. You'll need to unmute them after merging the main branch - since they will be skipped.

mark-vieira · 2026-03-18T14:51:48Z

        } catch (InvalidAlgorithmParameterException ex) {
            // Assert we actually hit the class we care about, LDAPCertStore (or its impl)
            assert Arrays.stream(ex.getStackTrace()).anyMatch(e -> e.getClassName().endsWith("LDAPCertStore"));
+        } catch (NoSuchAlgorithmException ex) {


@jdconrad should we consider solving this in a general way? Potentially always checking the thrown exception cause to ensure it's a NotEntitledException?

I was considering seeing if a different exception made more sense, but the problem remains that we need to know if something isn't entitled. I'll think about how to fix this today.

@JVerwolf After reviewing rule options, I do think NoSuchAlgorithmException is still the best one.

@mark-vieira is correct that we should guard this test with an additional check, though, to make sure it was actually a NEE that was thrown, but because the bridge is compile-only, you'll have to use a string comparison.

if (ex.getCause() != null && ex.getCause().getClass().getName().equals("org.elasticsearch.enti +tlement.bridge.NotEntitledException"))

Add a test for the normal (non-FIPS) path where the LDAP CertStore provider is present and InvalidAlgorithmParameterException is caught. Harden the provider removal helper to fail fast with a clear assertion if a provider to be removed is not found in the installed list, rather than silently using position 0 and restoring to the wrong slot.

…elasticsearch into fix/144376-ldap-certstore-fips

jdconrad

Just one minor change request.

jdconrad · 2026-03-18T18:28:37Z

        } catch (InvalidAlgorithmParameterException ex) {
            // Assert we actually hit the class we care about, LDAPCertStore (or its impl)
            assert Arrays.stream(ex.getStackTrace()).anyMatch(e -> e.getClassName().endsWith("LDAPCertStore"));
+        } catch (NoSuchAlgorithmException ex) {


@JVerwolf After reviewing rule options, I do think NoSuchAlgorithmException is still the best one.

@mark-vieira is correct that we should guard this test with an additional check, though, to make sure it was actually a NEE that was thrown, but because the bridge is compile-only, you'll have to use a string comparison.

if (ex.getCause() != null && ex.getCause().getClass().getName().equals("org.elasticsearch.enti +tlement.bridge.NotEntitledException"))

JVerwolf · 2026-03-20T19:48:15Z

I'm running into two (seemingly) unrelated failures that also happen on main:

Failure 1: ./gradlew ":server:test" --tests "org.elasticsearch.index.mapper.TsidExtractingIdFieldMapperTests.testParsedDescriptionWithIndexDimensions {p0=s1=1 p1=false}" -Dtests.seed=18ECDFDC94B74127 -Dtests.locale=hu -Dtests.timezone=Pacific/Fiji -Druntime.java=25 -Dtests.fips.enabled=true
Failure 2: ./gradlew ":server:test" --tests "org.elasticsearch.index.mapper.TsidExtractingIdFieldMapperTests.testParsedDescriptionWithIndexDimensions {p0=2022-01-01T01:00:01Z p1=false}" -Dtests.seed=18ECDFDC94B74127 -Dtests.locale=hu -Dtests.timezone=Pacific/Fiji -Druntime.java=25 -Dtests.fips.enabled=true

JVerwolf · 2026-03-20T20:37:10Z

run elasticsearch-ci/part-1-fips-140-3

JVerwolf · 2026-03-20T21:27:10Z

This PR is blocked on this issue: #144678, as it's preventing a clean CI run.

JVerwolf · 2026-03-24T17:46:29Z

@elasticmachine test serverless

JVerwolf · 2026-03-24T20:00:14Z

Passed in CI but the status failed to report back to GH: https://buildkite.com/elastic/elasticsearch-pull-request/builds/131176. Merging

elasticsearchmachine · 2026-03-24T20:01:19Z

💔 Backport failed

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 144453

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance("LDAP", null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail. The fix catches NSAE in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed. Adds unit tests that reproduce both paths by temporarily manipulating JCA providers. (cherry picked from commit 8234302) # Conflicts: # muted-tests.yml

JVerwolf · 2026-03-24T20:51:27Z

💚 All backports created successfully

Status	Branch	Result
✅	9.3
✅	9.2
✅	8.19

Questions ?

Please refer to the Backport tool documentation

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance("LDAP", null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail. The fix catches NSAE in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed. Adds unit tests that reproduce both paths by temporarily manipulating JCA providers. (cherry picked from commit 8234302) # Conflicts: # muted-tests.yml

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance(LDAP, null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail. The fix catches NSAE in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed. Adds unit tests that reproduce both paths by temporarily manipulating JCA providers. (cherry picked from commit 8234302)

In FIPS environments the LDAP CertStore provider is absent, so CertStore.getInstance("LDAP", null) throws NoSuchAlgorithmException with no cause. The entitlement check handler treated any NSAE as a denial and returned HTTP 403, causing EntitlementsAllowedNonModularIT to fail. The fix catches NSAE in createLDAPCertStore() and re-throws only when getCause() != null, which is the signature of a genuine entitlement denial (the instrumentation creates the exception as new NoSuchAlgorithmException(notEntitledException)). A no-cause NSAE means the provider is simply absent and should be silently swallowed. Adds unit tests that reproduce both paths by temporarily manipulating JCA providers.

JVerwolf requested a review from jdconrad March 17, 2026 22:21

JVerwolf requested a review from a team as a code owner March 17, 2026 22:21

JVerwolf added >bug :Core/Infra/Entitlements Entitlements infrastructure v9.4.0 labels Mar 17, 2026

elasticsearchmachine added the Team:Core/Infra Meta label for core/infra team label Mar 17, 2026

Update docs/changelog/144453.yaml

5cc0207

Merge branch 'main' into fix/144376-ldap-certstore-fips

7882add

[CI] Auto commit changes from spotless

1abd90f

This was referenced Mar 18, 2026

Mute EntitlementsAllowedIT and EntitlementsAllowedNonModularIT #144431

Merged

Refactor SecurityMetricType from enum to record for extensibility #144119

Merged

This comment was marked as off-topic.

Sign in to view

slobodanadamovic added test-fips Trigger CI checks for FIPS test-fips-140-3 labels Mar 18, 2026

Merge branch 'main' into fix/144376-ldap-certstore-fips

71cd687

mark-vieira reviewed Mar 18, 2026

View reviewed changes

JVerwolf added 2 commits March 18, 2026 11:25

Merge branch 'fix/144376-ldap-certstore-fips' of github.com:JVerwolf/…

43f10c9

…elasticsearch into fix/144376-ldap-certstore-fips

jdconrad requested changes Mar 18, 2026

View reviewed changes

fix merge

219927f

JVerwolf added 4 commits March 23, 2026 06:47

Merge branch 'main' into fix/144376-ldap-certstore-fips

f9fa6d0

Merge branch 'main' into fix/144376-ldap-certstore-fips

70432ec

Merge branch 'main' into fix/144376-ldap-certstore-fips

5d3dfe0

Merge branch 'main' into fix/144376-ldap-certstore-fips

ac0f5a7

JVerwolf disabled auto-merge March 24, 2026 19:57

JVerwolf merged commit 8234302 into elastic:main Mar 24, 2026
38 of 48 checks passed

elasticsearchmachine added the backport pending label Mar 24, 2026

JVerwolf mentioned this pull request Mar 24, 2026

[9.3] Fix createLDAPCertStore failing in FIPS mode (#144453) #144890

Merged

This was referenced Mar 24, 2026

[9.2] Fix createLDAPCertStore failing in FIPS mode (#144453) #144891

Merged

[8.19] Fix createLDAPCertStore failing in FIPS mode (#144453) #144892

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix createLDAPCertStore failing in FIPS mode (#144376)#144453

Fix createLDAPCertStore failing in FIPS mode (#144376)#144453
JVerwolf merged 27 commits intoelastic:mainfrom
JVerwolf:fix/144376-ldap-certstore-fips

JVerwolf commented Mar 17, 2026 •

edited

Loading

elasticsearchmachine commented Mar 17, 2026

elasticsearchmachine commented Mar 17, 2026

coderabbitai Bot commented Mar 17, 2026 •

edited

Loading

Reviews paused

Walkthrough

Suggested labels

slobodanadamovic commented Mar 18, 2026 •

edited

Loading

n1v0lg commented Mar 18, 2026

slobodanadamovic commented Mar 18, 2026 •

edited

Loading

n1v0lg commented Mar 18, 2026 •

edited

Loading

This comment was marked as off-topic.

JVerwolf commented Mar 18, 2026

slobodanadamovic commented Mar 18, 2026 •

edited

Loading

slobodanadamovic commented Mar 18, 2026

mark-vieira Mar 18, 2026

jdconrad Mar 18, 2026

jdconrad Mar 18, 2026

jdconrad left a comment

jdconrad Mar 18, 2026

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 24, 2026

Uh oh!

JVerwolf commented Mar 24, 2026

elasticsearchmachine commented Mar 24, 2026

JVerwolf commented Mar 24, 2026

Labels

6 participants

Conversation

JVerwolf commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

elasticsearchmachine commented Mar 17, 2026

elasticsearchmachine commented Mar 17, 2026

coderabbitai Bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Suggested labels

slobodanadamovic commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

n1v0lg commented Mar 18, 2026

slobodanadamovic commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

n1v0lg commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This comment was marked as off-topic.

JVerwolf commented Mar 18, 2026

slobodanadamovic commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

slobodanadamovic commented Mar 18, 2026

mark-vieira Mar 18, 2026

Choose a reason for hiding this comment

jdconrad Mar 18, 2026

Choose a reason for hiding this comment

jdconrad Mar 18, 2026

Choose a reason for hiding this comment

jdconrad left a comment

Choose a reason for hiding this comment

jdconrad Mar 18, 2026

Choose a reason for hiding this comment

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 20, 2026

JVerwolf commented Mar 24, 2026

Uh oh!

JVerwolf commented Mar 24, 2026

elasticsearchmachine commented Mar 24, 2026

💔 Backport failed

JVerwolf commented Mar 24, 2026

💚 All backports created successfully

Questions ?

Labels

6 participants

JVerwolf commented Mar 17, 2026 •

edited

Loading

coderabbitai Bot commented Mar 17, 2026 •

edited

Loading

slobodanadamovic commented Mar 18, 2026 •

edited

Loading

slobodanadamovic commented Mar 18, 2026 •

edited

Loading

n1v0lg commented Mar 18, 2026 •

edited

Loading

slobodanadamovic commented Mar 18, 2026 •

edited

Loading