Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test-IsAdUserPasswordCompromised fails on FIPS enabled system #28

Open
IgorMilavec opened this issue Sep 3, 2019 · 0 comments
Open
Assignees
Labels
bug Something isn't working

Comments

@IgorMilavec
Copy link

Running Test-IsAdUserPasswordCompromised on a system with "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" option enabled produces this error:

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Security.Cryptography.CryptoConfig.CreateFromName(String name, Object[] args)
   at System.Security.Cryptography.MD5.Create()
   at DSInternals.Common.Cryptography.DirectorySecretDecryptor.ComputeMD5(Byte[] key, Byte[] salt, Int32 saltHashRounds)
   at DSInternals.Replication.ReplicationSecretDecryptor.DecryptSecret(Byte[] blob)
   at DSInternals.Common.Data.DSAccount.LoadHashes(DirectoryObject dsObject, DirectorySecretDecryptor pek)
   at DSInternals.Replication.DirectoryReplicationClient.GetAccount(Guid objectGuid)
   at Lithnet.ActiveDirectory.PasswordProtection.PowerShell.TestIsADUserPasswordCompromised.ProcessRecord() in D:\github\lithnet\ad-password-protection\src\PasswordProtectionPS\TestIsADUserPasswordCompromised.cs:line 55
   at System.Management.Automation.CommandProcessor.ProcessRecord()

As this cannot be fixed in your code, I propose to unwrap TargetInvocationException in ProcessRecord() to make the cause for the error more visible.

@ryannewington ryannewington self-assigned this Oct 27, 2019
@ryannewington ryannewington added the bug Something isn't working label Oct 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants