The application server must authenticate users individually prior to using a group authenticator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35302	SRG-APP-000153-AS-000104	SV-46589r1_rule		High

Description
To assure individual accountability and prevent unauthorized access, AS users (and any processes acting on behalf of AS users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

Description

To assure individual accountability and prevent unauthorized access, AS users (and any processes acting on behalf of AS users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure that individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is non-repudiation for actions taken.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43671r1_chk )
Review the AS documentation and configuration to determine if the AS individually authenticates users prior to authenticating via a role or group. Review AS logs to verify user accesses requiring authentication can be traced back to an individual account. If the AS does not authenticate users on an individual basis, this is a finding.

Fix Text (F-39848r1_fix)
Configure the AS to authenticate users individually prior to allowing any group based authentication.