The application server must authenticate users individually prior to using a group authenticator.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-204748	SRG-APP-000153	SRG-APP-000153-AS-000104	SV-204748r981680_rule	2025-02-11	4

Description
To ensure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is nonrepudiation for actions taken.

Description

To ensure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure individual users are authenticated prior to authenticating via role or group authentication. This is to ensure that there is nonrepudiation for actions taken.

ℹ️ Check
Review the application server documentation and configuration to determine if the application server individually authenticates users prior to authenticating via a role or group. Review application server logs to verify user accesses requiring authentication can be traced back to an individual account. If the application server does not authenticate users on an individual basis, this is a finding.

ℹ️ Check

Review the application server documentation and configuration to determine if the application server individually authenticates users prior to authenticating via a role or group. Review application server logs to verify user accesses requiring authentication can be traced back to an individual account. If the application server does not authenticate users on an individual basis, this is a finding.

✔️ Fix
Configure the application server to authenticate users individually prior to allowing any group-based authentication.