The application server must ensure that PKI-based authentication maps the authenticated identity to the user account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35325	SRG-APP-000177-AS-000126	SV-46612r1_rule		Medium

Description
The cornerstone of the PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic value that does not contain specific user information. Application servers must provide the capability to utilize and meet requirements of the DoD Enterprise PKI infrastructure for application authentication.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43695r1_chk )
Review AS documentation to ensure the AS provides a PKI integration capability that meets DoD PKI infrastructure requirements. If the AS is not configured to meet this requirement, this is a finding.

Fix Text (F-39872r1_fix)
Configure the AS to utilize the DoD Enterprise PKI infrastructure.