From 19dcae272987921986489560c7b07ae12ec4ce0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Z?=
 <56592390+pawelziel@users.noreply.github.com>
Date: Wed, 16 Sep 2026 10:13:48 +0200
Subject: [PATCH] Updated config template to allow FIPS mode

Updated config template:
 - disable (weak) PKCS5S2 password storage scheme
 - set (strong) wrapping for Crypto Manager
to allow installation in FIPS 140-3 compliant environment.
---
 opendj-server-legacy/resource/config/config.ldif | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/opendj-server-legacy/resource/config/config.ldif b/opendj-server-legacy/resource/config/config.ldif
index ccf0fbf3ca..b8ccee2dc4 100644
--- a/opendj-server-legacy/resource/config/config.ldif
+++ b/opendj-server-legacy/resource/config/config.ldif
@@ -106,6 +106,7 @@ objectClass: ds-cfg-crypto-manager
 cn: Crypto Manager
 ds-cfg-ssl-cert-nickname: ads-certificate
 ds-cfg-ssl-encryption: false
+ds-cfg-key-wrapping-transformation: RSA/ECB/PKCS1Padding
 
 dn: cn=Account Status Notification Handlers,cn=config
 objectClass: top
@@ -1176,7 +1177,7 @@ objectClass: ds-cfg-password-storage-scheme
 objectClass: ds-cfg-pkcs5s2-password-storage-scheme
 cn: PKCS5S2
 ds-cfg-java-class: org.opends.server.extensions.PKCS5S2PasswordStorageScheme
-ds-cfg-enabled: true
+ds-cfg-enabled: false
 
 dn: cn=SHA-1,cn=Password Storage Schemes,cn=config
 objectClass: top