Configuring for FIPS compliance

The FileNet Content Manager container deployment can be configured to be Federal Information Processing Standards (FIPS)-compliant.

The FIPS enablement must be configured, as it is disabled by default.

OpenShift Container Platform (OCP)

In the OCP configuration file install-config.yaml, you must set "fips: true". For more information, see Support for FIPS cryptography.

Red Hat Enterprise Linux (RHEL)

The Linux® hosts must use RHEL 8.2 or higher. On each of the hosts that run FIPS-compliant workloads, you need to enable the FIPS mode.

To enable FIPS on a host, set "fips=1" on the kernel command at installation time. All the cryptographic keys that are generated are FIPS-compliant.

If a host is already installed, you can enable it. For more information, see Switching the system to FIPS mode.

Note: If your organization is entitled to FIPS compliance, RHEL hosts can be configured by default to enable FIPS.

FNCM components

By default, the enablement of the FNCM containers for FIPS is turned off.

FIPS enablement for FNCM components is configured in the custom resource (CR), under the shared_configuration section. 

shared_configuration:
    enable_fips: true
Tip: You cannot enable FIPS on a single capability when the shared configuration enable_fips parameter is set to false.

If you want to disable any component in your deployment, then you must set the disable_fips parameter to true in the component sections of the CR. The following configuration parameters disable FIPS for FileNet Content Manager and Navigator.

ecm_configuration:
    disable_fips: true
navigator_configuration:
    disable_fips: true
Attention:
  • The following database restrictions are known:
    • Due to a dependency on JKS keystores, PostgreSQL JDBC data sources cannot use verify-ca or verify-full SSL options. Use the require SSL mode option.
  • Pay attention to the length of passwords used by the deployment. For example, password lengths in the following secrets need to be at least 16 characters long:
    • ibm-fncm-secret and ibm-ban-secret.

For more information about the CR parameters, see Custom resource configuration parameters.

Note: When FIPS is enabled for the deployment the architecture is set to amd64, so the FNCM pods run only on FIPS-enabled worker nodes.