Ensure SAML SSO uses HTTPS with encrypted assertions and signed requests

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

From the CLI: ; Display the full SAML2 SSO configuration and certificate details by running the command puresso saml2 list --verification-certificate. ; Review the output to confirm that the Array URL and IdP URL fields begin with https://. ; Verify that the Sign Request and Encrypt Assertion attributes are set to True. ; Review the Verification Certificate details to ensure it was issued by a trusted CA and the Valid To date is not expired.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To align with the security recommendations, update your SAML2 SSO configuration to require HTTPS, signed requests, and encrypted assertions using dedicated credentials. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the edit icon for the Configuration. ; Update the Array URL and IdP URL fields to ensure they begin with https://. ; Enable Signed Requests: Slide the Sign Request toggle to the right (blue) and enter your array's signing certificate name in the Signing Credential field.