STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use FIPS validated LDAP or OpenIDConnect.

DISA Rule

SV-257543r1015795_rule

Vulnerability Number

V-257543

Group Title

SRG-APP-000172-CTR-000440

Rule Version

CNTR-OS-000460

Severity

CAT I

CCI(s)

• CCI-000016 - Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.
• CCI-000017 - Disable accounts when the accounts have been inactive for the organization-defined time-period.
• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.
• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-003627 - Disable accounts when the accounts have expired.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.
• CCI-002145 - Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.
• CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Configure OpenShift to use an appropriate Identity Provider. Do not use HTPasswd. Use either LDAP(AD), OpenIDConnect or an approved identity provider.

To configure LDAP provider:

1. Create Secret for BIND DN password by executing the following:

oc create secret generic ldap-secret --from-literal=bindPassword=<secret> -n openshift-config

2. Create config map for LDAP Trust CA by executing the following:

oc create configmap ca-config-map --from-file=ca.crt=/path/to/ca -n openshift-config

3. Create LDAP Auth Config Resource YAML:
Using the preferred text editor, create a file named ldapidp.yaml using the example content (replacing config values as appropriate).

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: ldapidp
mappingMethod: claim
type: LDAP
ldap:
attributes:
id:
- dn
email:
- mail
name:
- cn
preferredUsername:
- uid
bindDN: <"bindDN">
bindPassword:
name: ldap-secret
ca:
name: ca-config-map
insecure: false
url: <URL>

4. Apply LDAP config to cluster by executing the following:

oc apply -f ldapidp.yaml

Note: For more information on configuring an LDAP provider, refer to https://docs.openshift.com/container-platform/4.8/authentication/identity_providers/configuring-ldap-identity-provider.html.

To configure OpenID provider:

1. Create Secret for Client Secret by executing the following:

oc create secret generic idp-secret --from-literal=clientSecret=<secret> -n openshift-config

2. Create config map for OpenID Trust CA by executing the following:

oc create configmap ca-config-map --from-file=ca.crt=/path/to/ca -n openshift-config

3. Create OpenID Auth Config Resource YAML.
Using your preferred text editor, create a file named oidcidp.yaml using the example content (replacing config values as appropriate).

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: oidcidp
mappingMethod: claim
type: OpenID
openID:
clientID: <clientID>
clientSecret:
name: oidc-idp-secret
claims:
preferredUsername:
- preferred_username
name:
- name
email:
- email
ca:
name: ca-config-map
issuer: <URL>

4. Apply OpenID config to cluster by executing the following:

oc apply -f ldapidp.yaml

Note: For more information on configuring an OpenID provider, refer to https://docs.openshift.com/container-platform/4.8/authentication/identity_providers/configuring-oidc-identity-provider.html.

Check Contents

Verify the authentication operator is configured to use either an LDAP or a OpenIDConnect provider by executing the following:

oc get oauth cluster -o jsonpath="{.spec.identityProviders[*].type}{'\n'}"

If the output lists any other type besides LDAP or OpenID, this is a finding.

Vulnerability Number

V-257543

Documentable

False

Rule Version

CNTR-OS-000460

Severity Override Guidance

Verify the authentication operator is configured to use either an LDAP or a OpenIDConnect provider by executing the following:

oc get oauth cluster -o jsonpath="{.spec.identityProviders[*].type}{'\n'}"

If the output lists any other type besides LDAP or OpenID, this is a finding.

Check Content Reference

M

Target Key

5547