TMA-ORACLE-SAAS-1.9
Ensure Basic Authentication Is Blocked for SOAP and REST API Integrations
설명
Organizations must block the use of Basic Authentication for all SOAP and REST API integrations with Oracle SaaS Applications. This can be achieved by disabling Basic Authentication at the Fusion Applications layer and enforcing OAuth 2.0 as the only supported authentication method. Blocking Basic Authentication prevents insecure clients from connecting, even if misconfigured. Combined with monitoring, this ensures that only OAuth tokens are accepted, reducing exposure to replay attacks, credential ... Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
1. Review your Service Request history with Oracle to confirm a request has been submitted to disable Basic Auth for APIs. 2. Confirm Oracle's response/documentation showing that Basic Auth is disabled in the environment. 3. Attempt API calls using Basic Authentication and verify they fail. 4. Use supported authentication (JWT, SAML, OAuth) to confirm the API works with secure methods.
조치 방법
조치 방식: 가이드 또는 인프라 패치
1. Submit a Service Request to Oracle SaaS Operations asking to disable Basic Authentication for APIs in your Fusion instance. 2. Include details of your current integrations (endpoints, methods) that rely on Basic Auth. 3. Confirm with Oracle that Basic Auth has been disabled in your environment. 4. Update all integrations to use supported methods (JWT, OAuth, SAML) per Oracle guidance. 5. Test all APIs to validate they function correctly under the new authentication method.
속성
- 운영 체제
- 모두
- 태그
- oracle-saasidentity
- 참고 자료
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.9 Ensure Basic Authentication Is Blocked for SOAP and REST API Integrations