STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

DISA Rule

SV-256323r885580_rule

Vulnerability Number

V-256323

Group Title

SRG-APP-000148

Rule Version

VCSA-70-000059

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000804 - Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
• CCI-001682 - Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

Weight

10

Fix Recommendation

When using the embedded identity provider type, perform the following:

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Identity Sources.

Click "Add".

Select either "Active Directory over LDAP" or "Active Directory (Windows Integrated Authentication)" and configure appropriately.

Note: Windows Integrated Authentication requires that the vCenter server be joined to Active Directory before configuration via Administration >> Single Sign On >> Configuration >> Identity Provider >> Active Directory Domain.

OR

To change the identity provider type to a third-party identity provider such as Microsoft ADFS, perform the following:

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

Click "Change Identity Provider".

Select "Microsoft ADFS" and click "Next".

Enter the ADFS server information and User and Group details and click "Finish".

For additional information on configuring ADFS for use with vCenter, refer to the vSphere documentation.

Check Contents

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

If the identity provider type is "embedded" and there is no identity source of type "Active Directory" (either Windows Integrated Authentication or LDAP), this is a finding.

If the identity provider type is "Microsoft ADFS" or another supported identity provider, this is NOT a finding.

Vulnerability Number

V-256323

Documentable

False

Rule Version

VCSA-70-000059

Severity Override Guidance

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

If the identity provider type is "embedded" and there is no identity source of type "Active Directory" (either Windows Integrated Authentication or LDAP), this is a finding.

If the identity provider type is "Microsoft ADFS" or another supported identity provider, this is NOT a finding.

Check Content Reference

M

Target Key

5517