Ensure SAML SSO uses HTTPS with encrypted assertions and signed requests

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

From the CLI: ; Display the full SAML2 SSO configuration and certificate details by running the command puresso saml2 list --verification-certificate. ; Review the output to confirm that the Array URL and IdP URL fields begin with https://. ; Verify that the Sign Request and Encrypt Assertion attributes are set to True. ; Review the Verification Certificate details to ensure it was issued by a trusted CA and the Valid To date is not expired.

조치 방법

조치 방식: 가이드 또는 인프라 패치

To align with the security recommendations, update your SAML2 SSO configuration to require HTTPS, signed requests, and encrypted assertions using dedicated credentials. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the edit icon for the Configuration. ; Update the Array URL and IdP URL fields to ensure they begin with https://. ; Enable Signed Requests: Slide the Sign Request toggle to the right (blue) and enter your array's signing certificate name in the Signing Credential field.