From 6fe7fe73ce8afd28da7231270d9904a7967b3f03 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Sep 2025 22:32:42 +0000
Subject: [PATCH 1/2] Bump org.apache.zookeeper:zookeeper from 3.9.3 to 3.9.4

Bumps org.apache.zookeeper:zookeeper from 3.9.3 to 3.9.4.

---
updated-dependencies:
- dependency-name: org.apache.zookeeper:zookeeper
  dependency-version: 3.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 81f2087f1aa..8871f055d14 100644
--- a/pom.xml
+++ b/pom.xml
@@ -471,7 +471,7 @@ under the License.
     <antlr4.version>4.13.2</antlr4.version>
 
     <curator.version>5.9.0</curator.version>
-    <zookeeper.version>3.9.3</zookeeper.version>
+    <zookeeper.version>3.9.4</zookeeper.version>
 
     <zonky.embedded-postgres.version>2.1.1</zonky.embedded-postgres.version>
     <zonky.embedded-postgres-binaries.version>17.6.0</zonky.embedded-postgres-binaries.version>

From 9ba3141298bb824dbfb84d963f95a013c84819d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Francesco=20Chicchiricc=C3=B2?= <ilgrosso@apache.org>
Date: Tue, 16 Sep 2025 09:56:43 +0200
Subject: [PATCH 2/2] Disabling zookeeper.fips-mode by default

---
 .../ZookeeperKeymasterClientContext.java      | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperKeymasterClientContext.java b/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperKeymasterClientContext.java
index 5a76d543b3c..0265a3bd1b4 100644
--- a/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperKeymasterClientContext.java
+++ b/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperKeymasterClientContext.java
@@ -33,9 +33,12 @@
 import org.apache.syncope.common.keymaster.client.api.KeymasterProperties;
 import org.apache.syncope.common.keymaster.client.api.ServiceOps;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.auth.DigestLoginModule;
 import org.springframework.boot.autoconfigure.condition.ConditionOutcome;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.boot.autoconfigure.condition.SpringBootCondition;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Bean;
@@ -63,8 +66,20 @@ public ConditionOutcome getMatchOutcome(final ConditionContext context, final An
     }
 
     @Conditional(ZookeeperCondition.class)
+    @ConditionalOnMissingBean
     @Bean
-    public CuratorFramework curatorFramework(final KeymasterProperties props) throws InterruptedException {
+    public ZKClientConfig zkClientConfig() {
+        ZKClientConfig zkClientConfig = new ZKClientConfig();
+        zkClientConfig.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+        return zkClientConfig;
+    }
+
+    @Conditional(ZookeeperCondition.class)
+    @Bean
+    public CuratorFramework curatorFramework(
+            final ZKClientConfig zkClientConfig,
+            final KeymasterProperties props) throws InterruptedException {
+
         if (StringUtils.isNotBlank(props.getUsername()) && StringUtils.isNotBlank(props.getPassword())) {
             javax.security.auth.login.Configuration.setConfiguration(new javax.security.auth.login.Configuration() {
 
@@ -102,7 +117,7 @@ public List<ACL> getAclForPath(final String path) {
                 }
             });
         }
-        CuratorFramework client = clientBuilder.build();
+        CuratorFramework client = clientBuilder.zkClientConfig(zkClientConfig).build();
         client.start();
         client.blockUntilConnected(3, TimeUnit.SECONDS);