Ensure SAML SSO uses HTTPS with encrypted assertions and signed requests

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

From the CLI: ; Display the full SAML2 SSO configuration and certificate details by running the command puresso saml2 list --verification-certificate. ; Review the output to confirm that the Array URL and IdP URL fields begin with https://. ; Verify that the Sign Request and Encrypt Assertion attributes are set to True. ; Review the Verification Certificate details to ensure it was issued by a trusted CA and the Valid To date is not expired.

修复方式

修复方法: 操作指南或基础设施补丁

To align with the security recommendations, update your SAML2 SSO configuration to require HTTPS, signed requests, and encrypted assertions using dedicated credentials. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the edit icon for the Configuration. ; Update the Array URL and IdP URL fields to ensure they begin with https://. ; Enable Signed Requests: Slide the Sign Request toggle to the right (blue) and enter your array's signing certificate name in the Signing Credential field.