Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)

低レベル 2手動レビューwebsphere

説明

SPNEGO authentication supports both constrained and unconstrained delegation. Constrained delegation provides the ability to specify and enforce application trust boundaries on a user's behalf by limiting the flow of the SPENGO tokens only to trusted servers. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

If SPNEGO authentication is configured in the Liberty server make sure that the constrained delegation feature is also enabled in the Liberty configuration. grep -w -R -i 'spnego' ${server.config.dir} grep -w -R -i 'constrainedDelegation' ${server.config.dir}

修正方法

修正方法: ガイダンスまたは IaC パッチ

In ${server.config.dir}/configDropins/overrides/<any file name>.xml, add the constrainedDelegation-1.0 feature to the featureManager element: <feature>constrainedDelegation-1.0</feature>

プロパティ

オペレーティングシステム: すべて
タグ: webspheremanual-review
参照: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.3.2 Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)