aws / aws/aws-tools-for-powershell

Invoke-AWSSSOLogin doesn't work when Windows is in FIPS mode

Open
#408 1 comment 0 reactions 0 assignees View on GitHub
bug module/powershell-cmdlets p2 Requires AWS SDK change
Dominant language
C#
Stars
298
Forks
102
Avg merge
7d 17m
Merged PRs (30d)
2

Description

### Describe the bug

On a Windows laptop with FIPS mode enabled, running the Invoke-AWSSSOLogin commandlet fails with an error:

Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

Command should execute.

### Current Behavior

Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
At line:1 char:30
+ ... ram($Cmdlet, $SessionName) & $Cmdlet -SessionName $SessionName -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Invoke-AWSSSOLogin], InvalidOperationException
+ FullyQualifiedErrorId : System.InvalidOperationException,Amazon.PowerShell.Common.InvokeAWSSSOLoginCmdlet

### Reproduction Steps

1. Enable FIPS mode in Windows by modifing the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy and seting the Enabled DWORD to 1 (may require reboot if this was not previously set).
2. Attempt to execute the Invoke-AWSSSOLogin commandlet with any valid parameters.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS Tools for PowerShell version used

AWS.Tools.Common 5.0.129

### PowerShell version used

Name Value
---- -----
PSVersion 5.1.26100.6899
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.6899
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

### Operating System and version

Windows 11 Enterprise, version 24H2, build 26100.7392

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure using Invoke-AWSSSOLogin on Windows 11 with FIPS mode enabled, then trace the cmdlet's authentication and cryptographic path. No source file or test is named in the issue; done means the command executes successfully with valid parameters under FIPS mode, with appropriate regression coverage if the project has an existing test location.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, csharp, powershell
Domain
authentication, cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.