aws / aws/aws-tools-for-powershell
Invoke-AWSSSOLogin doesn't work when Windows is in FIPS mode
- Dominant language
- C#
- Stars
- 298
- Forks
- 102
- Avg merge
- 7d 17m
- Merged PRs (30d)
- 2
Description
### Describe the bug
On a Windows laptop with FIPS mode enabled, running the Invoke-AWSSSOLogin commandlet fails with an error:
Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
Command should execute.
### Current Behavior
Invoke-AWSSSOLogin : This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
At line:1 char:30
+ ... ram($Cmdlet, $SessionName) & $Cmdlet -SessionName $SessionName -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Invoke-AWSSSOLogin], InvalidOperationException
+ FullyQualifiedErrorId : System.InvalidOperationException,Amazon.PowerShell.Common.InvokeAWSSSOLoginCmdlet
### Reproduction Steps
1. Enable FIPS mode in Windows by modifing the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy and seting the Enabled DWORD to 1 (may require reboot if this was not previously set).
2. Attempt to execute the Invoke-AWSSSOLogin commandlet with any valid parameters.
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS Tools for PowerShell version used
AWS.Tools.Common 5.0.129
### PowerShell version used
Name Value
---- -----
PSVersion 5.1.26100.6899
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.6899
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
### Operating System and version
Windows 11 Enterprise, version 24H2, build 26100.7392
Contributor guide
Research direction
Start by reproducing the failure using Invoke-AWSSSOLogin on Windows 11 with FIPS mode enabled, then trace the cmdlet's authentication and cryptographic path. No source file or test is named in the issue; done means the command executes successfully with valid parameters under FIPS mode, with appropriate regression coverage if the project has an existing test location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, csharp, powershell
- Domain
- authentication, cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100