STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use FIPS-validated SHA-1 or higher hash function to provide replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-257542r960993_rule

Vulnerability Number

V-257542

Group Title

SRG-APP-000156-CTR-000380

Rule Version

CNTR-OS-000440

Severity

CAT II

CCI(s)

• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Weight

10

Fix Recommendation

Configure OpenShift to use an OpenIDConnect Identity Provider. Note: This STIG was written for OIC; do not use HTPasswd. Only use an approved identity provider.

Steps to configure OpenID provider:

1. Create Secret for Client Secret by executing the following:

oc create secret generic idp-secret --from-literal=clientSecret=<secret> -n openshift-config

2. Create config map for OpenID Trust CA by executing the following:

oc create configmap ca-config-map --from-file=ca.crt=/path/to/ca -n openshift-config

3. Create OpenID Auth Config Resource YAML.
Using the preferred text editor, create a file named oidcidp.yaml using the example content (replacing config values as appropriate).

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: oidcidp
mappingMethod: claim
type: OpenID
openID:
clientID: ...
clientSecret:
name: idp-secret
claims:
preferredUsername:
- preferred_username
name:
- name
email:
- email
issuer: https://www.idp-issuer.com

4. Apply OpenID config to cluster by executing the following:

oc apply -f ldapidp.yaml

Note: For more information on configuring an OpenID provider, refer to https://docs.openshift.com/container-platform/4.8/authentication/identity_providers/configuring-oidc-identity-provider.html.

Check Contents

Verify the authentication operator is configured to use a secure transport to an OpenIDConnect provider:

oc get oauth cluster -o jsonpath="{.spec.identityProviders[*]}{'\n'}"

If the transport is not secure (ex. HTTPS), this is a finding.

Vulnerability Number

V-257542

Documentable

False

Rule Version

CNTR-OS-000440

Severity Override Guidance

Verify the authentication operator is configured to use a secure transport to an OpenIDConnect provider:

oc get oauth cluster -o jsonpath="{.spec.identityProviders[*]}{'\n'}"

If the transport is not secure (ex. HTTPS), this is a finding.

Check Content Reference

M

Target Key

5547