Ensure SAML SSO uses HTTPS with encrypted assertions and signed requests

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Display the full SAML2 SSO configuration and certificate details by running the command puresso saml2 list --verification-certificate. ; Review the output to confirm that the Array URL and IdP URL fields begin with https://. ; Verify that the Sign Request and Encrypt Assertion attributes are set to True. ; Review the Verification Certificate details to ensure it was issued by a trusted CA and the Valid To date is not expired.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, update your SAML2 SSO configuration to require HTTPS, signed requests, and encrypted assertions using dedicated credentials. From the GUI: ; Navigate to Settings > Access > Users and Policies and scroll to the SAML2 SSO pane. ; Click the edit icon for the Configuration. ; Update the Array URL and IdP URL fields to ensure they begin with https://. ; Enable Signed Requests: Slide the Sign Request toggle to the right (blue) and enter your array's signing certificate name in the Signing Credential field.