Invoke-AWSSSOLogin doesn't work when Windows is in FIPS mode

[jwfogt]

Describe the bug

On a Windows laptop with FIPS mode enabled, running the Invoke-AWSSSOLogin commandlet fails with an error:

Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Command should execute.

Current Behavior

Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
At line:1 char:30

• ... ram($Cmdlet, $SessionName) & $Cmdlet -SessionName $SessionName -Force

•                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Invoke-AWSSSOLogin], InvalidOperationException
  • FullyQualifiedErrorId : System.InvalidOperationException,Amazon.PowerShell.Common.InvokeAWSSSOLoginCmdlet

Reproduction Steps

1. Enable FIPS mode in Windows by modifing the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy and seting the Enabled DWORD to 1 (may require reboot if this was not previously set).
2. Attempt to execute the Invoke-AWSSSOLogin commandlet with any valid parameters.

Possible Solution

No response

Additional Information/Context

No response

AWS Tools for PowerShell version used

AWS.Tools.Common 5.0.129

PowerShell version used

Name Value

---

PSVersion 5.1.26100.6899
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.6899
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Operating System and version

Windows 11 Enterprise, version 24H2, build 26100.7392

[afroz429]

Thanks for reporting this issue. AWS .NET SDK seems to be computing SHA1 which appears to be restricted in FIPS mode. There might not be an immediate fix. We will get back to you after team discussion.

https://github.com/aws/aws-sdk-net/blob/fc98638e6dd63bbb017e523208d44762dfdf13c4/sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl%2Bnetstandard/SSOTokenFileCache.cs#L305