[CI] ActiveDirectoryRealmTests fail in FIPS mode

[droberts195]

All the ActiveDirectoryRealmTests failed in this build of the 7.x branch: https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+7.x+matrix-java-periodic/ES_BUILD_JAVA=openjdk12,ES_RUNTIME_JAVA=java8fips,nodes=general-purpose/241/console

For each test in the suite the error is like this one:

06:20:19 org.elasticsearch.xpack.security.authc.ldap.ActiveDirectoryRealmTests > testAuthenticateCachesSuccessfulAuthentications FAILED
06:20:19     ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.authc.realms.active_directory.testauthenticatecachessuccesfulauthentications.ssl]]; nested: ElasticsearchException[failed to initialize the SSLContext]; nested: KeyManagementException[FIPS mode: only SunJSSE TrustManagers may be used];
06:20:19         at __randomizedtesting.SeedInfo.seed([6330360333BB8644:9993853870276F61]:0)
06:20:19         at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:449)
06:20:19         at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$2(SSLService.java:426)
06:20:19         at java.util.HashMap.forEach(HashMap.java:1289)
06:20:19         at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:426)
06:20:19         at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:121)
06:20:19         at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectoryRealmTests.setupRealm(ActiveDirectoryRealmTests.java:171)
06:20:19         at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectoryRealmTests.testAuthenticateCachesSuccessfulAuthentications(ActiveDirectoryRealmTests.java:226)
06:20:19 
06:20:19         Caused by:
06:20:19         ElasticsearchException[failed to initialize the SSLContext]; nested: KeyManagementException[FIPS mode: only SunJSSE TrustManagers may be used];
06:20:19             at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:409)
06:20:19             at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:386)
06:20:19             at java.util.HashMap.computeIfAbsent(HashMap.java:1127)
06:20:19             at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:446)
06:20:19             ... 6 more
06:20:19 
06:20:19             Caused by:
06:20:19             java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used
06:20:19                 at sun.security.ssl.SSLContextImpl.chooseTrustManager(SSLContextImpl.java:120)
06:20:19                 at sun.security.ssl.SSLContextImpl.engineInit(SSLContextImpl.java:83)
06:20:19                 at javax.net.ssl.SSLContext.init(SSLContext.java:282)
06:20:19                 at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:402)
06:20:19                 ... 9 more

This is reproducible if you use a FIPS JVM:

./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.ldap.ActiveDirectoryRealmTests" -Dtests.seed=6330360333BB8644   -Dtests.security.manager=true   -Dtests.locale=fr-FR   -Dtests.timezone=Antarctica/Davis   -Dcompiler.java=12   -Druntime.java=8FIPS   -Djavax.net.ssl.keyStorePassword=password   -Djavax.net.ssl.trustStorePassword=password

[elasticmachine]

Pinging @elastic/es-security (:Security/Security)

[jkakavas]

This is caused by the

} else {
            builder.put(getFullSettingKey(realmIdentifier, SSLConfigurationSettings.VERIFICATION_MODE_SETTING_REALM),
                    VerificationMode.NONE);
        }

that Albert added in #47179 and we missed it in the review. We can't use VerificationMode.NONE in FIPS 140 jvms, I'll add a conditional to fix this shortly

EDIT: Spoke too fast, this code was there already, Albert just changed the deprecated hostname_verification to verification_mode.

The previous code would set the property:

xpack.security.authc.realms.active_directory.testrealmmapsgroupstoroles.hostname_verification

which would only affect LDAPConnectionSettings, but the current code sets

xpack.security.authc.realms.active_directory.testrealmmapsgroupstoroles.ssl.verification_mode

that will cause a new SSLContext to be build with verification mode None and this is not allowed in FIPS 140.