Details
To assure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated.
A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users.
Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.
Solution
1. Access AC
2. From ‘Domain Structure’, select ‘Security Realms’
3. Select realm to configure (default is ‘myrealm’)
4. Select ‘Providers’ tab -> ‘Authentication’ tab
5. Utilize ‘Change Center’ to create a new change session
6. Click ‘New’. Enter a value in ‘Name’ field and select a valid authentication provider type (e.g., LDAPAuthenticator) in the ‘Type’ dropdown. Click ‘OK’
7. From the list, select the newly created authentication provider and select the ‘Configuration’ tab -> ‘Provider Specific’ tab
8. Set all provider specific values to configure the new authentication provider. Click ‘Save’
9. Continuing from step 4, if the new authentication provider is perimeter-based, click ‘New’. Enter a value in ‘Name’ field and select a valid authentication provider type (e.g., SAML2IdentityAsserter) in the ‘Type’ dropdown. Click ‘OK’
10. From the list, select the newly created authentication identity asserter and select the ‘Configuration’ tab -> ‘Provider Specific’ tab
11. Set all provider specific values to configure the new authentication identity asserter. Click ‘Save’
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.
References
- 800-53|IA-2(5)
- CAT|I
- CCI|CCI-000770
- Rule-ID|SV-235965r628673_rule
- STIG-ID|WBLC-05-000153
- STIG-Legacy|SV-70533
- STIG-Legacy|V-56279
- Vuln-ID|V-235965