Security Checklist

Last modified 18 Oct 2024 14:20 +02:00

Installation

  • Only system administrators and midPoint daemon user have access to midPoint home directory (usually var directory)

  • administrator midPoint user is disabled or its initial password was changed.

  • Personalized system administrator accounts were created.

    • Superuser role or roles granting #all are assigned only to trusted users.

  • Initial roles and security policy was reviewed.

Mappings & Expressions

  • Only system administrators (users with Superuser or similar role) have access to Query Playground, Mapping Playground

  • Only trusted users have edit access to expressions

    • Mappings in Resources, Archetypes, Object Templates

    • Mappings and Queries in Reports

  • Groovy Expressions were reviewed for potential security vulnerabilities

  • Mappings in Expressions were reviewed and modified to provision sanitized values to resources

Flexible Authentication

  • Security Policies were reviewed and customized

    • Emergency login is configured if remote authentication modules are configured

  • If using Security Questions:

    • Security Questions are used only with other authentication mechanism

    • Set of available questions does not lead to easily guessable / searchable answers

Networking

  • MidPoint GUI and REST is accessible only via HTTPS proxy

    • HTTPS Proxy is configured to:

      • add HSTS headers (HTTP Strict Transport Security)

      • add Secure attribute to JSESSIONID cookie

  • If Outbound Firewall is used, make sure outbound traffic is enabled for:

    • midPoint to midPoint communication if cluster is used

    • midPoint to Resource

    • midPoint to Database

Operations

Was this page helpful?
YES NO
Thanks for your feedback