Ensure All API Based Integrations Use OAuth Authentication

СреднийУровень 1Ручная проверкаoracle-saas

Описание

All API based integrations with Oracle SaaS Applications must use OAuth 2.0 authentication configured through the Fusion Identity Domain. Basic Authentication, long-lived static passwords, or legacy authentication mechanisms must not be used for API or integration access. Basic Authentication and static credentials present significant risks, including credential theft, replay attacks, and the inability to enforce least-privilege access. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

1. Review all configured SOAP and REST integrations in Fusion Applications and Oracle Integration Cloud. 2. Confirm that integration clients are registered as OAuth clients in the Fusion Identity Domain and that Basic Authentication credentials are not in use. 3. Examine Fusion audit logs to identify API requests authenticated with Basic Authentication. 4. Review OCI IAM Identity Domain authentication logs to confirm that API access tokens are issued via OAuth flows only. 5. Validate that no unscoped or legacy credentials are present in active integrations.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

1. Identify integrations currently using Basic Authentication by reviewing Fusion audit logs and OCI IAM authentication records. 2. Register OAuth clients in the Fusion Identity Domain for each integration, assigning only the required scopes and authorized resources. 3. Reconfigure integrations to use OAuth tokens in place of Basic Authentication credentials. 4. Disable or revoke Basic Authentication credentials in Fusion Applications and IAM domains. 5. Establish a recurring process to review Fusion and IAM logs to detect any attempted Basic Authentication use.

Свойства

Операционные системы: Любая
Теги: oracle-saasidentity
Источник: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.10 Ensure All API Based Integrations Use OAuth Authentication