SRP | If you are using 2019

Please, be aware that the cipher suites described in your debug output doesn't show the cipher suite that was actually used by openssl, ECDHE-RSA-AES256-GCM-SHA384. In fact, they don't include any cipher suite that requires AES 256. It may not be of relevance, but it may be a symptom of any misconfiguration, and can explain why the handshake is failing. As indicated in the Oracle documentation when describing Java 8 supported cipher suites:

Cipher suites that use AES_256 require installation of the JCE Unlimited Strength Jurisdiction Policy Files.

As a consequence, please, be sure you installed and properly configured the JCE Unlimited Strength Jurisdiction Policy Files.

As indicated by @dave_thompson_085 in his excellent comment, only Oracle Java 8 below 8u161 requires adding the unlimited policy, as stated in Appendix C of the aforementioned Oracle documentation.

The JCE Unlimited Strength Jurisdiction Policy Files are bundled into the JDK since JDK 8u151, but the unlimited policy was not defined as the default one since JDK 8u161.

In JDK 8u151 or 8u152, as stated in one of the previous cited links, and explained as well by @dave_thompson_085 - thank you very much again, in order to make the unlimited version of the JCE the one that should be used, you need to define the system property crypto.policy. From the docs:

This release introduces a new feature whereby the JCE jurisdiction policy files used by the JDK can be controlled via a new Security property. In older releases, JCE jurisdiction files had to be downloaded and installed separately to allow unlimited cryptography to be used by the JDK. The download and install steps are no longer necessary. To enable unlimited cryptography, one can use the new crypto.policy Security property. If the new Security property (crypto.policy) is set in the java.security file, or has been set dynamically by using the Security.setProperty() call before the JCE framework has been initialized, that setting will be honored. By default, the property will be undefined. If the property is undefined and the legacy JCE jurisdiction files don't exist in the legacy lib/security directory, then the default cryptographic level will remain at 'limited'. To configure the JDK to use unlimited cryptography, set the crypto.policy to a value of 'unlimited'. See the notes in the java.security file shipping with this release for more information.

The issue is not present in OpenJDK.

As an alternative solution, as suggested in this related SO question, probably using an alternate provider like BouncyCastle could be of help as well.

for amazon, you will need to use API: https://aws.amazon.com/api-gateway/

after that your formula will be:

The value PASSWORD_CLAIM_SIGNATURE is based on following into one base64-encoded string.

• Let K_USER = SHA256_HASH(S_USER)
  Let S_USER = (SRP_B - k * gx)(a + ux)
  Let x = SHA256_HASH(salt + FULL_PASSWORD)
  Let u = SHA256_HASH(SRP_A + SRP_B)
  Let k = SHA256_HASH(N + g)
• When all MFA challenges are answered, Amazon Cognito responds with a DeviceGroupKey and a unique DeviceKey in the NewDeviceMetadataType field.
• For PASSWORD_CLAIM_SECRET_BLOCK, use the value of SECRET_BLOCK.
• For TIMESTAMP, include the current time. (For example, Tue Sep 25 00:09:40 UTC 2018.)

first go to app config

I completely recreated your configuration for minikube on Linux. Your Kubernetes configuration is fine. And I got the same response - 301 Moved Permanently.

After that, I changed these lines in the default.conf file:

Change to rsplit

The PowerShell parser only recognizes 1 param statement per block, so you need to change:

The problem may occur when UniqueID in the restored LDAP data differ from the uid used by the system (for whatever reason).

To verify if that is the problem, check the user entry in the LDAP for the value in the UniqueID attribute.

Then open a shell on the server and check uid used there:

Testing DHE-DSS-AES256-GCM-SHA384...YES

It looks like the server supports only DSS ciphers, which is very unusual. As can be seen from the changelog such ciphers were removed from the default cipher list with OpenSSL 1.1.0. This means one explicitly need to enable the cipher, i.e.