Add license check for FIPS

docs/user/security/fips-140-2.asciidoc

@@ -0,0 +1,63 @@
+[[xpack-security-fips-140-2]]
+=== FIPS 140-2
+
+experimental::[]
+
+The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2), 
+titled "Security Requirements for Cryptographic Modules" is a U.S. government computer security standard
+used to approve cryptographic modules.
+
+{kib} offers a FIPS 140-2 compliant mode and as such can run in a Node.js environment configured with a FIPS 
+140-2 compliant OpenSSL3 provider.
+
+To run {kib} in FIPS mode, you must have the appropriate {subscriptions}[subscription].
+
+[IMPORTANT]
+============================================================================
+The Node bundled with {kib} is not configured for FIPS 140-2. You must configure a FIPS 140-2 compliant OpenSSL3 
+provider. Consult the Node.js documentation to learn how to configure your environment.
+============================================================================
+
+For {kib}, adherence to FIPS 140-2 is ensured by:
+
+* Using FIPS approved / NIST recommended cryptographic algorithms.
+
+* Delegating the implementation of these cryptographic algorithms to a NIST validated cryptographic module
+(available via Node.js configured with an OpenSSL3 provider).
+
+* Allowing the configuration of {kib} in a FIPS 140-2 compliant manner, as documented below. 
+
+==== Configuring {kib} for FIPS 140-2
+
+Apart from setting `xpack.security.experimental.fipsMode.enabled` to `true` in your {kib} config, a number of security related 
+settings need to be reviewed and configured in order to run {kib} successfully in a FIPS 140-2 compliant Node.js 
+environment.
+
+===== Kibana keystore
+
+FIPS 140-2 (via NIST Special Publication 800-132) dictates that encryption keys should at least have an effective 
+strength of 112 bits. As such, the Kibana keystore that stores the application’s secure settings needs to be 
+password protected with a password that satisfies this requirement. This means that the password needs to be 14 bytes 
+long which is equivalent to a 14 character ASCII encoded password, or a 7 character UTF-8 encoded password.
+
+For more information on how to set this password, refer to the <<change-password,keystore documentation>>.
+
+===== TLS keystore and keys
+
+Keystores can be used in a number of General TLS settings in order to conveniently store key and trust material.
+PKCS#12 keystores cannot be used in a FIPS 140-2 compliant Node.js environment. Avoid using these types of keystores. 
+Your FIPS 140-2 provider may provide a compliant keystore implementation that can be used, or you can use PEM encoded 
+files. To use PEM encoded key material, you can use the relevant `\*.key` and `*.certificate` configuration options, 
+and for trust material you can use `*.certificate_authorities`.
+
+As an example, avoid PKCS#12 specific settings such as:
+
+* `server.ssl.keystore.path`
+* `server.ssl.truststore.path`
+* `elasticsearch.ssl.keystore.path`
+* `elasticsearch.ssl.truststore.path`
+
+===== Limitations
+
+Configuring {kib} to run in FIPS mode is still considered to be experimental. Not all features are guaranteed to
+function as expected.

docs/user/security/index.asciidoc

@@ -46,3 +46,4 @@ include::authorization/index.asciidoc[]
 include::authorization/kibana-privileges.asciidoc[]
 include::api-keys/index.asciidoc[]
 include::role-mappings/index.asciidoc[]
+include::fips-140-2.asciidoc[]

packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts

@@ -284,6 +284,7 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>({
     },
     security: {
       registerSecurityDelegate: (api) => deps.security.registerSecurityDelegate(api),
+      fips: deps.security.fips,
     },
     userProfile: {
       registerUserProfileDelegate: (delegate) =>

packages/core/security/core-security-server-internal/src/fips/fips.test.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SecurityServiceConfigType } from '../utils';
+import { isFipsEnabled } from './fips';
+
+describe('fips', () => {
+  describe('#isFipsEnabled', () => {
+    let config: SecurityServiceConfigType;
+
+    beforeAll(() => {
+      config = {};
+    });
+
+    afterEach(() => {
+      config = {};
+    });
+
+    it('should return `true` if config.experimental.fipsMode.enabled is `true`', () => {
+      config = { experimental: { fipsMode: { enabled: true } } };
+
+      expect(isFipsEnabled(config)).toBe(true);
+    });
+
+    it('should return `false` if config.experimental.fipsMode.enabled is `false`', () => {
+      config = { experimental: { fipsMode: { enabled: false } } };
+
+      expect(isFipsEnabled(config)).toBe(false);
+    });
+
+    it('should return `false` if config.experimental.fipsMode.enabled is `undefined`', () => {
+      expect(isFipsEnabled(config)).toBe(false);
+    });
+  });
+});

packages/core/security/core-security-server-internal/src/fips/fips.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SecurityServiceConfigType } from '../utils';
+
+export function isFipsEnabled(config: SecurityServiceConfigType): boolean {
+  return config?.experimental?.fipsMode?.enabled || false;
+}

packages/core/security/core-security-server-internal/src/security_service.test.ts

@@ -45,6 +45,16 @@ describe('SecurityService', () => {
         );
       });
     });
+
+    describe('#fips', () => {
+      describe('#isEnabled', () => {
+        it('should return boolean', () => {
+          const { fips } = service.setup();
+
+          expect(fips.isEnabled()).toBe(false);
+        });
+      });
+    });
   });
 
   describe('#start', () => {

packages/core/security/core-security-server-internal/src/security_service.ts

@@ -9,30 +9,57 @@
 import type { Logger } from '@kbn/logging';
 import type { CoreContext, CoreService } from '@kbn/core-base-server-internal';
 import type { CoreSecurityDelegateContract } from '@kbn/core-security-server';
+import { Observable, Subscription } from 'rxjs';
+import { Config } from '@kbn/config';
+import { isFipsEnabled } from './fips/fips';
 import type {
   InternalSecurityServiceSetup,
   InternalSecurityServiceStart,
 } from './internal_contracts';
-import { getDefaultSecurityImplementation, convertSecurityApi } from './utils';
+import {
+  getDefaultSecurityImplementation,
+  convertSecurityApi,
+  SecurityServiceConfigType,
+} from './utils';
 
 export class SecurityService
   implements CoreService<InternalSecurityServiceSetup, InternalSecurityServiceStart>
 {
   private readonly log: Logger;
   private securityApi?: CoreSecurityDelegateContract;
+  private config$: Observable<Config>;
+  private configSubscription?: Subscription;
+  private config: Config | undefined;
+  private readonly getConfig = () => {
+    if (!this.config) {
+      throw new Error('Config is not available.');
+    }
+    return this.config;
+  };
 
   constructor(coreContext: CoreContext) {
     this.log = coreContext.logger.get('security-service');
+
+    this.config$ = coreContext.configService.getConfig$();
+    this.configSubscription = this.config$.subscribe((config) => {
+      this.config = config;
+    });
   }
 
   public setup(): InternalSecurityServiceSetup {
+    const config = this.getConfig();
+    const securityConfig: SecurityServiceConfigType = config.get(['xpack', 'security']);
+
     return {
       registerSecurityDelegate: (api) => {
         if (this.securityApi) {
           throw new Error('security API can only be registered once');
         }
         this.securityApi = api;
       },
+      fips: {
+        isEnabled: () => isFipsEnabled(securityConfig),
+      },
     };
   }
 
@@ -44,5 +71,10 @@ export class SecurityService
     return convertSecurityApi(apiContract);
   }
 
-  public stop() {}
+  public stop() {
+    if (this.configSubscription) {
+      this.configSubscription.unsubscribe();
+      this.configSubscription = undefined;
+    }
+  }
 }

packages/core/security/core-security-server-internal/src/utils/index.ts

@@ -8,3 +8,11 @@
 
 export { convertSecurityApi } from './convert_security_api';
 export { getDefaultSecurityImplementation } from './default_implementation';
+
+export interface SecurityServiceConfigType {
+  experimental?: {
+    fipsMode?: {
+      enabled: boolean;
+    };
+  };
+}

packages/core/security/core-security-server-internal/tsconfig.json

@@ -20,5 +20,6 @@
     "@kbn/core-http-server",
     "@kbn/logging-mocks",
     "@kbn/core-base-server-mocks",
+    "@kbn/config",
   ]
 }

packages/core/security/core-security-server-mocks/src/security_service.mock.ts

@@ -20,6 +20,7 @@ import { auditServiceMock, type MockedAuditService } from './audit.mock';
 const createSetupMock = () => {
   const mock: jest.Mocked<SecurityServiceSetup> = {
     registerSecurityDelegate: jest.fn(),
+    fips: { isEnabled: jest.fn() },
   };
 
   return mock;
@@ -43,6 +44,7 @@ const createStartMock = (): SecurityStartMock => {
 const createInternalSetupMock = () => {
   const mock: jest.Mocked<InternalSecurityServiceSetup> = {
     registerSecurityDelegate: jest.fn(),
+    fips: { isEnabled: jest.fn() },
   };
 
   return mock;

packages/core/security/core-security-server/index.ts

@@ -26,3 +26,4 @@ export type {
   AuditRequest,
 } from './src/audit_logging/audit_events';
 export type { AuditLogger } from './src/audit_logging/audit_logger';
+export type { CoreFipsService } from './src/fips';

packages/core/security/core-security-server/src/contracts.ts

@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { CoreFipsService } from './fips';
 import type { CoreAuthenticationService } from './authc';
 import type { CoreSecurityDelegateContract } from './api_provider';
 import type { CoreAuditService } from './audit';
@@ -21,6 +22,11 @@ export interface SecurityServiceSetup {
    * @remark this should **exclusively** be used by the security plugin.
    */
   registerSecurityDelegate(api: CoreSecurityDelegateContract): void;
+
+  /**
+   * The {{@link CoreFipsService | FIPS service}}
+   */
+  fips: CoreFipsService;
 }
 
 /**

packages/core/security/core-security-server/src/fips.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/**
+ * Core's FIPS service
+ *
+ * @public
+ */
+export interface CoreFipsService {
+  /**
+   * Check if Kibana is configured to run in FIPS mode
+   */
+  isEnabled(): boolean;
+}

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -388,6 +388,7 @@ kibana_vars=(
     xpack.security.authc.selector.enabled
     xpack.security.cookieName
     xpack.security.encryptionKey
+    xpack.security.experimental.fipsMode.enabled
     xpack.security.loginAssistanceMessage
     xpack.security.loginHelp
     xpack.security.sameSiteCookies

x-pack/packages/security/plugin_types_common/src/licensing/license.ts

@@ -13,6 +13,7 @@ import type { SecurityLicenseFeatures } from './license_features';
 
 export interface SecurityLicense {
   isLicenseAvailable(): boolean;
+  getLicenseType(): string | undefined;
   getUnavailableReason: () => string | undefined;
   isEnabled(): boolean;
   getFeatures(): SecurityLicenseFeatures;

x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts

@@ -83,4 +83,10 @@ export interface SecurityLicenseFeatures {
    * Describes the layout of the login form if it's displayed.
    */
   readonly layout?: LoginLayout;
+
+  /**
+   * Indicates whether we allow FIPS mode
+   */
+
+  readonly allowFips: boolean;
 }

x-pack/plugins/security/common/licensing/index.mock.ts

@@ -14,12 +14,33 @@ import type { SecurityLicense, SecurityLicenseFeatures } from '@kbn/security-plu
 export const licenseMock = {
   create: (
     features: Partial<SecurityLicenseFeatures> | Observable<Partial<SecurityLicenseFeatures>> = {},
-    licenseType: LicenseType = 'basic' // default to basic if this is not specified
+    licenseType: LicenseType = 'basic', // default to basic if this is not specified,
+    isAvailable: Observable<boolean> = of(true)
   ): jest.Mocked<SecurityLicense> => ({
-    isLicenseAvailable: jest.fn().mockReturnValue(true),
+    isLicenseAvailable: jest.fn().mockImplementation(() => {
+      let result = true;
+
+      isAvailable.subscribe((next) => {
+        result = next;
+      });
+
+      return result;
+    }),
+    getLicenseType: jest.fn().mockReturnValue(licenseType),
     getUnavailableReason: jest.fn(),
     isEnabled: jest.fn().mockReturnValue(true),
-    getFeatures: jest.fn().mockReturnValue(features),
+    getFeatures:
+      features instanceof Observable
+        ? jest.fn().mockImplementation(() => {
+            let subbedFeatures: Partial<SecurityLicenseFeatures> = {};
+
+            features.subscribe((next) => {
+              subbedFeatures = next;
+            });
+
+            return subbedFeatures;
+          })
+        : jest.fn().mockReturnValue(features),
     hasAtLeast: jest
       .fn()
       .mockImplementation(