--- CNTR-OS-000460
+++ CNTR-OS-000460
@@ -1,193 +1,169 @@
 
 [version]:
 CNTR-OS-000460
 
 [title]:
 OpenShift must use FIPS validated LDAP or OpenIDConnect.
 
 [description]:
 <VulnDiscussion>Passwords need to be protected on entry, in transmission, during authentication, and when stored. If compromised at any of these security points, a nefarious user can use the password along with stolen user account information to gain access or to escalate privileges. The container platform may require account authentication during container platform tasks and before accessing container platform components (e.g., runtime, registry, and keystore).
 
 During any user authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
 
 Satisfies: SRG-APP-000172-CTR-000440, SRG-APP-000024-CTR-000060, SRG-APP-000025-CTR-000065, SRG-APP-000065-CTR-000115, SRG-APP-000151-CTR-000365, SRG-APP-000152-CTR-000370, SRG-APP-000157-CTR-000385, SRG-APP-000163-CTR-000395, SRG-APP-000164-CTR-000400, SRG-APP-000165-CTR-000405, SRG-APP-000166-CTR-000410, SRG-APP-000167-CTR-000415, SRG-APP-000168-CTR-000420, SRG-APP-000169-CTR-000425, SRG-APP-000170-CTR-000430, SRG-APP-000171-CTR-000435, SRG-APP-000173-CTR-000445, SRG-APP-000174-CTR-000450, SRG-APP-000177-CTR-000465, SRG-APP-000317-CTR-000735, SRG-APP-000318-CTR-000740, SRG-APP-000345-CTR-000785, SRG-APP-000391-CTR-000935, SRG-APP-000397-CTR-000955, SRG-APP-000401-CTR-000965, SRG-APP-000402-CTR-000970</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
 
 [reference]:
 DPMS Target Red Hat OpenShift Container Platform 4.12DISADPMS TargetRed Hat OpenShift Container Platform 4.125547
 
 [ident]:
 CCI-000016
 
 [ident]:
 CCI-000017
 
 [ident]:
 CCI-000044
 
 [ident]:
 CCI-000187
 
 [ident]:
-CCI-000192
+CCI-004066
 
 [ident]:
-CCI-000193
-
-[ident]:
-CCI-000194
-
-[ident]:
-CCI-000195
-
-[ident]:
-CCI-000196
+CCI-004062
 
 [ident]:
 CCI-000197
 
 [ident]:
-CCI-000198
+CCI-004061
 
 [ident]:
-CCI-000199
+CCI-000765
 
 [ident]:
-CCI-000200
+CCI-000766
 
 [ident]:
-CCI-000205
+CCI-003627
 
 [ident]:
-CCI-000767
-
-[ident]:
-CCI-000768
-
-[ident]:
-CCI-000795
-
-[ident]:
-CCI-001619
-
-[ident]:
-CCI-001942
+CCI-001941
 
 [ident]:
 CCI-001953
 
 [ident]:
-CCI-001991
+CCI-004068
 
 [ident]:
 CCI-002009
 
 [ident]:
-CCI-002041
-
-[ident]:
-CCI-002142
+CCI-004045
 
 [ident]:
 CCI-002145
 
 [ident]:
 CCI-002238
 
 [fixtext]:
 Configure OpenShift to use an appropriate Identity Provider. Do not use HTPasswd. Use either LDAP(AD), OpenIDConnect or an approved identity provider.
 
 To configure LDAP provider:
 
 1. Create Secret for BIND DN password by executing the following:
 
 oc create secret generic ldap-secret --from-literal=bindPassword=<secret> -n openshift-config 
 
 2. Create config map for LDAP Trust CA by executing the following:
  
 oc create configmap ca-config-map --from-file=ca.crt=/path/to/ca -n openshift-config
 
 3. Create LDAP Auth Config Resource YAML:
 Using the preferred text editor, create a file named ldapidp.yaml using the example content (replacing config values as appropriate).
  
 apiVersion: config.openshift.io/v1
 kind: OAuth
 metadata:
   name: cluster
 spec:
   identityProviders:
   - name: ldapidp 
     mappingMethod: claim 
     type: LDAP
     ldap:
       attributes:
         id: 
         - dn
         email: 
         - mail
         name: 
         - cn
         preferredUsername: 
         - uid
       bindDN: <"bindDN">
       bindPassword: 
         name: ldap-secret
       ca: 
         name: ca-config-map
       insecure: false 
       url: <URL> 
 
 4. Apply LDAP config to cluster by executing the following:
  
 oc apply -f ldapidp.yaml
  
 Note: For more information on configuring an LDAP provider, refer to https://docs.openshift.com/container-platform/4.8/authentication/identity_providers/configuring-ldap-identity-provider.html.
  
 To configure OpenID provider:
  
 1. Create Secret for Client Secret by executing the following:
  
 oc create secret generic idp-secret --from-literal=clientSecret=<secret> -n openshift-config
  
 2. Create config map for OpenID Trust CA by executing the following:
  
 oc create configmap ca-config-map --from-file=ca.crt=/path/to/ca -n openshift-config
 
 3. Create OpenID Auth Config Resource YAML.
 Using your preferred text editor, create a file named oidcidp.yaml using the example content (replacing config values as appropriate).
 
 apiVersion: config.openshift.io/v1
 kind: OAuth
 metadata:
   name: cluster
 spec:
   identityProviders:
   - name: oidcidp
     mappingMethod: claim
     type: OpenID
     openID:
       clientID: <clientID>
       clientSecret:
         name: oidc-idp-secret
       claims:
         preferredUsername:
         - preferred_username
         name:
         - name
         email:
         - email
       ca:
         name: ca-config-map
       issuer: <URL>
  
 4. Apply OpenID config to cluster by executing the following:
  
 oc apply -f ldapidp.yaml
  
 Note: For more information on configuring an OpenID provider, refer to https://docs.openshift.com/container-platform/4.8/authentication/identity_providers/configuring-oidc-identity-provider.html.
 
 [check]:
 Verify the authentication operator is configured to use either an LDAP or a OpenIDConnect provider by executing the following:
 
 oc get oauth cluster -o jsonpath="{.spec.identityProviders[*].type}{'\n'}"
 
 If the output lists any other type besides LDAP or OpenID, this is a finding.
