The MQ Appliance messaging server must accept FICAM-approved third-party credentials.

From IBM MQ Appliance V9.0 AS Security Technical Implementation Guide

Part of SRG-APP-000404-AS-000249

Associated with: CCI-002011 CCI-002014

SV-89561r1_rule The MQ Appliance messaging server must accept FICAM-approved third-party credentials.

Vulnerability discussion

Access may be denied to legitimate users if FICAM-approved third-party credentials are not accepted.This requirement typically applies to organizational information systems that are accessible to non-federal government agencies and other partners. This allows federal government relying parties to trust such credentials at their approved assurance levels.Third-party credentials are those credentials issued by non-federal government entities approved by the Federal Identity, Credential, and Access Management (FICAM) Trust Framework Solutions initiative.Satisfies: SRG-APP-000404-AS-000249, SRG-APP-000405-AS-000250

Check content

Log on to the WebGUI as a privileged user. Click on the "MQ Console" icon. Click "Add" widget at the top right of the screen. Select queue manager intended for OCSP from the drop-down list. Select "Authentication Information". Verify that the authentication type is "OCSP". Click on the "Properties" button. Click "OCSP" on the side bar to verify that the OCSP responder URL is correct. If either the authentication type is not "OCSP" or the OCSP responder URL in not correct, this is a finding.

Fix text

Log on to the WebGUI as a privileged user. Click on the "MQ Console" icon. Click "Add" widget at the top right of the screen. Select a queue manager from the drop-down list. Select "Authentication Information". Click the "+" (plus sign) to define the authentication method authentication for this queue manager. Specify an "Authinfo" name (e.g., USE.OCSP). Select "OCSP" as the "Authinfo" type. Specify an OCSP responder URL. Click "Create". In the "Local Queue Managers" widget, select the OCSP queue manager you just configured. Click "More..." then select "Refresh Security... "

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer