Gracefully initialize on FIPS-enforced systems

Created originally on Bitbucket by Anonymous

Because Passlib wires up blocked hash algorithms on initialization it cannot be used on a FIPS-enforced system even when the blocked algorithms won’t actually be used. I ran in to this issue trying to run pgAdmin4, which has a dependency on flask-security, which has a dependency on passlib.

It would be helpful to gracefully handle this situation.

I was able to hack around it by wrapping the calls to create_hex_hash in handlers/digest.py @ line 68 in try/except blocks which catches the exception thrown when attempting to set up the md5 hash. Not suggesting this is remotely a good solution, but it was enough to get me working again:

    #=============================================================================
    # predefined handlers
    #=============================================================================
    try: hex_md4 = create_hex_hash("md4")
    except: print('Failed to create md4 hex hash')

    try: hex_md5 = create_hex_hash("md5"); hex_md5.django_name = "unsalted_md5"
    except: print('Failed to create md5 hex hash')

    try: hex_sha1 = create_hex_hash("sha1")
    except: print('Failed to create sha1 hex hash')

    try: hex_sha256 = create_hex_hash("sha256")
    except: print('Failed to create sha256 hex hash')

    try: hex_sha512 = create_hex_hash("sha512")
    except: print('Failed to create sha512 hex hash')

I then had to hack a few other places that became broken because they expected to find the hex_md5 attribute which was no longer defined:

• Calls to get_crypt_handler @ ~line 652 of context.py
• Update of handlers list @ ~line 663 of context.py
• Ignore checking deprecated schemes @ ~line 783 of context.py

‌