Ensure a management SAML SSO configuration is created and enabled

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

From the CLI: ; Run the command puresso saml2 list to display configured SAML providers. ; Review the output to confirm that a SAML provider is present and its enabled status is True. ; Run the command puresso saml2 list --verification-certificate to view the full verification certificate details and verify the certificate issuer and expiry date. ; Test the configuration: Run the command puresso saml2 test [IDP-NAME] to verify the array URL correctness, IdP connectivity, directory service correctness, and verification certificate validity.

조치 방법

조치 방식: 가이드 또는 인프라 패치

To align with the security recommendations, configure the array as a Service Provider (SP), exchange metadata or certificates with your Identity Provider, and rigorously test the configuration before enabling SSO. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the + (Create SAML2 SSO) icon. ; In the Name field, enter a local display name for the SAML2 SSO configuration. ; In the Array URL field, enter the FlashArray URL using HTTPS. ; Enter either the IdP Metadata URL, or manually enter the IdP Entity ID, IdP URL, and click Edit next to Verification Certificate to paste your IdP's PEM- formatted token-signing certificate.