Skip to content

enterprise/endpoints/connectors/agent: fix Apple JWE encryption when FIPS is enabled#18464

Merged
BeryJu merged 1 commit intomainfrom
enterprise/endpoints/agent/fix-apple-jwe-fips
Dec 1, 2025
Merged

enterprise/endpoints/connectors/agent: fix Apple JWE encryption when FIPS is enabled#18464
BeryJu merged 1 commit intomainfrom
enterprise/endpoints/agent/fix-apple-jwe-fips

Conversation

@BeryJu
Copy link
Member

@BeryJu BeryJu commented Dec 1, 2025

Without this change, with FIPS enabled, we'd get this error

Unknown OpenSSL error. This error is commonly encountered
                    when another library is not cleaning up the OpenSSL error
                    stack. If you are using cryptography with another library
                    that uses OpenSSL try disabling it before reporting a bug.
                    Otherwise please file an issue at
                    https://github.com/pyca/cryptography/issues with
                    information on how to reproduce this. (error:030000BE:digital envelope routines:EVP_CIPHER_CTX_copy:not able to copy ctx:../crypto/evp/evp_enc.c:1787:)

This can apparently be caused by OpenSSL version mismatches, which checks out since we run OpenSSL 3.5 with OpenSSL FIPS 3.1.2

this accomplishes the same but doesn't fail...?

…FIPS is enabled

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
@BeryJu BeryJu requested a review from a team as a code owner December 1, 2025 12:07
@netlify
Copy link

netlify bot commented Dec 1, 2025

Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit e38e026
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/692d84ef8c24190007912621
😎 Deploy Preview https://deploy-preview-18464--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link

netlify bot commented Dec 1, 2025

Deploy Preview for authentik-storybook canceled.

Name Link
🔨 Latest commit e38e026
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/692d84ef76d9910008a7de9c

@netlify
Copy link

netlify bot commented Dec 1, 2025

Deploy Preview for authentik-integrations canceled.

Name Link
🔨 Latest commit e38e026
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/692d84effb88490008c5e87b

@codecov
Copy link

codecov bot commented Dec 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.97%. Comparing base (2bb86f6) to head (e38e026).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #18464      +/-   ##
==========================================
- Coverage   93.02%   92.97%   -0.05%     
==========================================
  Files         911      911              
  Lines       49752    49756       +4     
==========================================
- Hits        46281    46261      -20     
- Misses       3471     3495      +24     
Flag Coverage Δ
e2e 45.38% <25.00%> (+0.04%) ⬆️
integration 22.87% <0.00%> (-0.06%) ⬇️
unit 91.19% <100.00%> (+<0.01%) ⬆️
unit-migrate 91.24% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@BeryJu BeryJu merged commit 873a47f into main Dec 1, 2025
94 checks passed
@BeryJu BeryJu deleted the enterprise/endpoints/agent/fix-apple-jwe-fips branch December 1, 2025 12:31
@github-actions
Copy link
Contributor

github-actions bot commented Dec 1, 2025

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-e38e026dda90ba4f51fe17ec11da9604a221cbd3
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-e38e026dda90ba4f51fe17ec11da9604a221cbd3

Afterwards, run the upgrade commands from the latest release notes.

kensternberg-authentik added a commit that referenced this pull request Dec 11, 2025
* main: (53 commits)
  core, web: update translations (#18380)
  web: re-add en.xlf locale (#18469)
  stages/user_write: Fix user attributes are not sanitized under certains conditions (#17890)
  providers/scim: compare users/groups before sending update request (#18456)
  enterprise/endpoints/connectors/agent: fix Apple JWE encryption when FIPS is enabled (#18464)
  website: bump @types/react from 19.2.6 to 19.2.7 in /website (#18357)
  core: bump goauthentik/fips-debian from `ac4c80b` to `de70579` (#18419)
  core: bump github.com/getsentry/sentry-go from 0.39.0 to 0.40.0 (#18416)
  website: bump prettier-plugin-packagejson from 2.5.19 to 2.5.20 in /website (#18460)
  core: bump goauthentik.io/api/v3 from 3.2025120.7 to 3.2025120.11 (#18461)
  website/integrations: add GLPI (#17937)
  website/integrations: small fixes (#18423)
  enterprise: Apple Platform SSO (#15318)
  crypto: only generate managed keypair if non-existent (#18457)
  ci: remove translation-rename (#18444)
  translate: Updates for project authentik and language tr (#18438)
  translate: Updates for project authentik and language fr (#18431)
  translate: Updates for project authentik and language ru (#18442)
  translate: Updates for project authentik and language cs_CZ (#18443)
  translate: Updates for project authentik and language pt (#18437)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant