Check: Exch-1-205
Exchange 2010 Client Access Server STIG:
Exch-1-205
(in version v1 r9)
Title
Forms-based Authentication must not be enabled. (Cat II impact)
Discussion
Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD require authentication using DoD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based login should be used by the OWA web site. Because the DoD requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other pre-authenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled. If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.
Check Content
Open the Exchange Management Shell and enter the following command: Get-OwaVirtualDirectory | Select Name, Identity, FormsAuthentication If the value of 'FormsAuthentication' is not set to 'False', this is a finding.
Fix Text
Open the Exchange Management Shell and enter the following command: Set-OwaVirtualDirectory -Identity <'IdentityName'> -FormsAuthentication $false
Additional Identifiers
Rule ID: SV-44008r1_rule
Vulnerability ID: V-33588
Group Title: Exch-1-205
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |