From OpenText eDirectory 9.3 onwards, by default FIPS mode is disabled on both NICI and OpenSSL in all the platforms. OpenText eDirectory provides switches to configure the FIPS mode to suit your requirement. When FIPS mode is enabled OpenText eDirectory server, all applications and modules running inside OpenText eDirectory including the OpenSSL will be in FIPS mode. For example, LDAP, HTTP, and all cryptographic operations in EBA. Operating OpenText eDirectory in FIPS mode does not allow communication over SSLv3 and restricts the cipher usage to high strength ciphers. For more information, see Configuring LDAP Objects and Configuring HTTP Server Object in the OpenText™ eDirectory CE 24.4 (v9.3) Administration Guide.
You have to set only one flag to enable the FIPS mode for the OpenText eDirectory. This enables both NICI and OpenSSL.
Execute the following pre-requisites before enabling the NICI FIPS to make NDS login work:
Create - PBKDF2 (Password-Based Key Derivation Function 2) password policy. For more information see Understanding Non-Reversible Password Storage. Then, assign PBKDF2 password policy to all the users.
Set SCRAM as default login sequence. For more information see Password Authentication.
Once PBKDF2 policy is assigned, it is recommended that all the users must change their passwords, before enabling FIPS in NICI.
Enable NICI FIPS once the password of all the users are changed. To enable NICI in FIPS mode, see Using NICI for Configuring System-Level FIPS Mode.
TLS and FIPS in NICI are enabled based on the nici.cfg configuration.
To enable the FIPS mode in OpenText eDirectory for both NICI and OpenSSL:
Windows: FIPS can be enabled on windows, setting the NICI Restriction Level flag to 1 in the windows registry. For more information, see Using NICI for Configuring System-Level FIPS Mode.
Linux: FIPS in NICI are enabled based on the nici.cfg configuration. For more information, see Using NICI for Configuring System-Level FIPS Mode.
NOTE:It is not recommended to disable FIPS, once it is enabled.