Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)

BaixaNível 2Revisão manualwebsphere

Descrição

SPNEGO authentication supports both constrained and unconstrained delegation. Constrained delegation provides the ability to specify and enforce application trust boundaries on a user's behalf by limiting the flow of the SPENGO tokens only to trusted servers. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

If SPNEGO authentication is configured in the Liberty server make sure that the constrained delegation feature is also enabled in the Liberty configuration. grep -w -R -i 'spnego' ${server.config.dir} grep -w -R -i 'constrainedDelegation' ${server.config.dir}

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

In ${server.config.dir}/configDropins/overrides/<any file name>.xml, add the constrainedDelegation-1.0 feature to the featureManager element: <feature>constrainedDelegation-1.0</feature>

Propriedades

Sistemas operacionais: Qualquer
Tags: webspheremanual-review
Referência: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.3.2 Ensure that constrained delegation is configured for SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism)