Ensure a management SAML SSO configuration is created and enabled

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

From the CLI: ; Run the command puresso saml2 list to display configured SAML providers. ; Review the output to confirm that a SAML provider is present and its enabled status is True. ; Run the command puresso saml2 list --verification-certificate to view the full verification certificate details and verify the certificate issuer and expiry date. ; Test the configuration: Run the command puresso saml2 test [IDP-NAME] to verify the array URL correctness, IdP connectivity, directory service correctness, and verification certificate validity.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To align with the security recommendations, configure the array as a Service Provider (SP), exchange metadata or certificates with your Identity Provider, and rigorously test the configuration before enabling SSO. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the + (Create SAML2 SSO) icon. ; In the Name field, enter a local display name for the SAML2 SSO configuration. ; In the Array URL field, enter the FlashArray URL using HTTPS. ; Enter either the IdP Metadata URL, or manually enter the IdP Entity ID, IdP URL, and click Edit next to Verification Certificate to paste your IdP's PEM- formatted token-signing certificate.