Redis Enterprise DBMS must map the PKI-authenticated identity to an associated user account.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-251227 | RD6X-00-009300 | SV-251227r961044_rule | CCI-000187 | medium |
| Description | ||||
| The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to a DBMS user account for the authenticated identity to be meaningful to the DBMS and useful for authorization decisions. | ||||
| STIG | Date | |||
| Redis Enterprise 6.x Security Technical Implementation Guide | 2024-09-04 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (69) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
+59 more (top 10 by confidence shown)
CCI1 mapping
CCI-000187
1.00
- DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
Details
Check Text (C-251227r961044_chk)
Review the Redis Enterprise configuration to verify user accounts are being mapped directly to unique identifying information within the validated PKI certificate.
To test, have the user log in to the database and verify that the unique certificate to the authenticating user is used or prompted. If user accounts are not being mapped to authenticated identities, this is a finding.
Fix Text (F-54616r804870_fix)
Configure Redis Enterprise settings to meet organizationally defined requirements. Redis Enterprise uses LDAP to map authenticated identity directly to the DBMS user account.
1. Before enabling LDAP in Redis Software, it is important to verify:
- Confirmation of the LDAP groups that correspond to the levels of access on which to authorize. Each LDAP group will be mapped to a Redis Software access control role.
- Confirmation of Redis Software access control role for each LDAP group. If role-based access controls (RBAC) have not already been set up, do so before enabling LDAP.
2. The following LDAP info is needed:
- Server URI, including host, port, and protocol details.
- Certificate details for secure protocols.
- Bind credentials, including Distinguished Name, password, and (optionally) client public and private keys for certificate authentication.
- Authentication query details, whether template or query.
- Authorization query details, whether attribute or query.
- The Distinguished Names of LDAP groups that will be used to authorize access to Redis Software resources.
3. Use Settings | LDAP to enable LDAP access.
4. Map LDAP groups to access control roles.
5. Update database access control lists (ACLs) to authorize role access.
If appropriate roles are already established, update them to include LDAP groups.
For additional information:
https://docs.redislabs.com/latest/rs/security/ldap/