Chat now with support
Chat mit Support

Identity Manager 8.2 - Web Application Configuration Guide

About this guide Configuring the Web Portal WebAuthn security keys Starling Two-Factor Authentication Application Governance Module Configuring password questions Password Reset Portal Recommendations for secure operation of web applications

Recommendations for secure operation of web applications

Here are some solutions that have been tried and tested in conjunction with One Identity Manager tools to guarantee secure operation of One Identity web applications. You decide which security measures are appropriate for your individually customized web applications.

Detailed information about this topic

Using HTTPS

Always run the One Identity Manager's web application over the secure communications protocol "Hypertext Transfer Protocol Secure" (HTTPS).

In order for the web application to use the secure communications protocol, you can force the use of the "Secure Sockets Layer" (SSL) when you install the application. For more information for using HTTPS/SSL, see the One Identity Manager Installation Guide.

Disable automatic password storage

Use this setting to prevent auto-filling of your user data on the login page. This setting is made in the Web Designer and can help running of web applications more securely.

Table 19: Configuration parameter for disabling automatic password storage

Configuration parameter

Description

VI_Common_Login_PrefillLoginData

Prevents auto-filling user data on the login page.

To disable automatic password storage

  1. Open the Web Designer.
  2. In the menu bar, select the Edit > Configure project > Web project menu item.
  3. On the Configure Project tab, search for "VI_Common_Login_PrefillLoginData".
  4. In the Allow prefill of login data key, in the Value (custom) column, click .

This sets the default value to "false". This disables automatic password storage.

Disabling the HTTP request method TRACE

The TRACE request allows the path to the web server to be traced and to check that data is transferred there correctly. This allows a trace route to be determined at application level, meaning the path to the web server over various proxies. This method is particularly useful for debugging connections.

IMPORTANT: TRACE should not be enable in a productive environment because it can reduce performance.

To disable the HTTP request method TRACE using Internet Information Services

  • You will find instructions by following this link:

https://docs.microsoft.com/en-us/iis/configuration/system.webserver/tracing/

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen