IBM Aspera Console must be configured with a preestablished trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252561	ASP4-CS-040140	SV-252561r831492_rule		Medium

Description
User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges. IBM Aspera Console must use an IdP for authentication for security best practices. The IdP must not be installed on the IBM Aspera Console virtual machine, particularly if it resides on the untrusted zone of the Enclave. Refer to the IBM Aspera Console Admin Guide for data requirements for the SAML assertion including default attribute names, the IBM Aspera Console User Field, and required format within the assertion. For security best practices also ensure that the system hosting IBM Aspera Console uses Network Time Protocol or another system to keep times synchronized with the IdP/SAML Provider providing the SAML assertions. Clock drift between The IBM Aspera Console server and the IdP/SAML Provider will result in expired assertions and the inability to be successfully authenticated into IBM Aspera Console. Satisfies: SRG-NET-000138-ALG-000063, SRG-NET-000138-ALG-000088, SRG-NET-000138-ALG-000089, SRG-NET-000140-ALG-000094, SRG-NET-000147-ALG-000095

Description

User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges. IBM Aspera Console must use an IdP for authentication for security best practices. The IdP must not be installed on the IBM Aspera Console virtual machine, particularly if it resides on the untrusted zone of the Enclave. Refer to the IBM Aspera Console Admin Guide for data requirements for the SAML assertion including default attribute names, the IBM Aspera Console User Field, and required format within the assertion. For security best practices also ensure that the system hosting IBM Aspera Console uses Network Time Protocol or another system to keep times synchronized with the IdP/SAML Provider providing the SAML assertions. Clock drift between The IBM Aspera Console server and the IdP/SAML Provider will result in expired assertions and the inability to be successfully authenticated into IBM Aspera Console. Satisfies: SRG-NET-000138-ALG-000063, SRG-NET-000138-ALG-000088, SRG-NET-000138-ALG-000089, SRG-NET-000140-ALG-000094, SRG-NET-000147-ALG-000095

STIG	Date
IBM Aspera Platform 4.2 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56017r817851_chk )
Using a web browser, navigate to the IBM Aspera Console web page. IBM Aspera Console will automatically redirect to the IdP for authentication if it is configured for SAML authentication. If it does not redirect for authentication via the configured IdP, this is a finding. If redirected to the IdP login page, attempt to authenticate using the IdP with known working credentials to determine if the IdP is providing an appropriate SAML assertion for access. If unable to log in using known working credentials, this is a finding.

Check Text ( C-56017r817851_chk )

Using a web browser, navigate to the IBM Aspera Console web page. IBM Aspera Console will automatically redirect to the IdP for authentication if it is configured for SAML authentication.

If it does not redirect for authentication via the configured IdP, this is a finding.

If redirected to the IdP login page, attempt to authenticate using the IdP with known working credentials to determine if the IdP is providing an appropriate SAML assertion for access.

If unable to log in using known working credentials, this is a finding.

Fix Text (F-55967r817852_fix)
Configure SAML within the IBM Aspera Console to use an existing IdP with the following steps: - Log in to the IBM Aspera Console web page as a user with administrative privilege. - Select the "Accounts" tab. - Select the "SAML" tab. - Enter the IdP SSO Target (Redirect) URL. - Enter the IdP Cert Fingerprint. - Select from the dropdown menu the IdP Cert Fingerprint Algorithm. - Select "Save" at the bottom of the page.

Fix Text (F-55967r817852_fix)

Configure SAML within the IBM Aspera Console to use an existing IdP with the following steps:

- Log in to the IBM Aspera Console web page as a user with administrative privilege.
- Select the "Accounts" tab.
- Select the "SAML" tab.
- Enter the IdP SSO Target (Redirect) URL.
- Enter the IdP Cert Fingerprint.
- Select from the dropdown menu the IdP Cert Fingerprint Algorithm.
- Select "Save" at the bottom of the page.