Ensure SAML SSO uses HTTPS with encrypted assertions and signed requests

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

From the CLI: ; Display the full SAML2 SSO configuration and certificate details by running the command puresso saml2 list --verification-certificate. ; Review the output to confirm that the Array URL and IdP URL fields begin with https://. ; Verify that the Sign Request and Encrypt Assertion attributes are set to True. ; Review the Verification Certificate details to ensure it was issued by a trusted CA and the Valid To date is not expired.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To align with the security recommendations, update your SAML2 SSO configuration to require HTTPS, signed requests, and encrypted assertions using dedicated credentials. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the edit icon for the Configuration. ; Update the Array URL and IdP URL fields to ensure they begin with https://. ; Enable Signed Requests: Slide the Sign Request toggle to the right (blue) and enter your array's signing certificate name in the Signing Credential field.