Always run the One Identity Manager's web application over the secure communications protocol "Hypertext Transfer Protocol Secure" (HTTPS).
In order for the web application to use the secure communications protocol, you can force the use of the "Secure Sockets Layer" (SSL) when you install the application. For more information for using HTTPS/SSL, see the One Identity Manager Installation Guide.
The TRACE request allows the path to the web server to be traced and to check that data is transferred there correctly. This allows a trace route to be determined at application level, meaning the path to the web server over various proxies. This method is particularly useful for debugging connections.
IMPORTANT: TRACE should not be enable in a productive environment because it can reduce performance.
To disable the HTTP request method TRACE using Internet Information Services
https://docs.microsoft.com/iis/configuration/system.webserver/tracing/
It is recommended that you disable all unnecessary encryption methods and protocols on the grounds of security. If you disable redundant protocols and methods, older platforms and systems may not be able to establish connections with web applications anymore. Therefore, you must decide which protocols and methods are necessary, based on the platforms required.
NOTE: The software "IIS Crypto" from Nartac Software is recommended for disabling encryption methods and protocols.
For more information about disabling, see here.
Attackers can obtain a lot of information about your servers and network by looking at the response header your server returns.
To give attackers a little information as possible, you can remove the HTTP response header in Windows IIS.
To remove the HTTP response header in Windows IIS
Read the instructions in the following links:
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center
