Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)

BajaNivel 2Revisión manualwebsphere

Descripción

SPNEGO authentication supports both constrained and unconstrained delegation. Constrained delegation provides the ability to specify and enforce application trust boundaries on a user's behalf by limiting the flow of the SPENGO tokens only to trusted servers. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

If SPNEGO authentication is configured in the Liberty server make sure that the constrained delegation feature is also enabled in the Liberty configuration. grep -w -R -i 'spnego' ${server.config.dir} grep -w -R -i 'constrainedDelegation' ${server.config.dir}

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

In ${server.config.dir}/configDropins/overrides/<any file name>.xml, add the constrainedDelegation-1.0 feature to the featureManager element: <feature>constrainedDelegation-1.0</feature>

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: webspheremanual-review
Referencia: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.3.2 Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)