The vCenter Server must separate authentication and authorization for administrators.

An XCCDF Rule

Description

<VulnDiscussion>Many organizations do both authentication and authorization using a centralized directory service such as Active Directory. Attackers who compromise an identity source can often add themselves to authorization groups, and simply log into systems they should not otherwise have access to. Additionally, reliance on central identity systems means that the administrators of those systems are potentially infrastructure administrators, too, as they can add themselves to infrastructure access groups at will. The use of local SSO groups for authorization helps prevent this avenue of attack by allowing the centralized identity source to still authenticate users but moving authorization into vCenter itself.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-258963r934547_rule
Severity: Medium
References: CCI-000366
Updated: 8 months ago

To add groups from an identity provider to the local SSO Administrators group, as an example, do the following:

From the vSphere Client, go to Administration >> Single Sign On >> Groups.

Select the Administrators group and click "Edit".
In the "Add Members" section, select the identity source and type the name of the target user/group in the search bar.

Select the target user/group to add them and click "Save".

Note: A new SSO group or groups can be created as needed and used to provide authorization to vCenter.

To remove identity provider users/groups from a role, do the following:

From the vSphere Client, go to Administration >> Access Control >> Global Permissions.

Select the offending user/group and click "Delete".

Note: If permissions are assigned on a specific object, then the role must be updated where it is assigned (for example, at the cluster level).

The vCenter Server must separate authentication and authorization for administrators.

Description

Remediation - Manual Procedure