Ensure a management SAML SSO configuration is created and enabled

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

From the CLI: ; Run the command puresso saml2 list to display configured SAML providers. ; Review the output to confirm that a SAML provider is present and its enabled status is True. ; Run the command puresso saml2 list --verification-certificate to view the full verification certificate details and verify the certificate issuer and expiry date. ; Test the configuration: Run the command puresso saml2 test [IDP-NAME] to verify the array URL correctness, IdP connectivity, directory service correctness, and verification certificate validity.

修正方法

修正方法: ガイダンスまたは IaC パッチ

To align with the security recommendations, configure the array as a Service Provider (SP), exchange metadata or certificates with your Identity Provider, and rigorously test the configuration before enabling SSO. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the + (Create SAML2 SSO) icon. ; In the Name field, enter a local display name for the SAML2 SSO configuration. ; In the Array URL field, enter the FlashArray URL using HTTPS. ; Enter either the IdP Metadata URL, or manually enter the IdP Entity ID, IdP URL, and click Edit next to Verification Certificate to paste your IdP's PEM- formatted token-signing certificate.