Test Account Provisioning Process (OTG-IDENT-003) - Revision history

Jane O'Connor: Final edit

2014-05-14T14:37:00Z

Final edit

Davide Danelon at 16:32, 6 March 2014

2014-03-06T16:32:40Z

Andrew Muller at 16:40, 21 November 2013

2013-11-21T16:40:58Z

Andrew Muller at 13:55, 5 November 2013

2013-11-05T13:55:56Z

Andrew Muller at 06:35, 5 November 2013

2013-11-05T06:35:44Z

Andrew Muller: Created page with "== Summary == The provisioning of accounts presents an opportunity for an attacker to create a valid account without application of the proper identification and authorizatio..."

2013-07-28T14:42:55Z

Created page with "== Summary == The provisioning of accounts presents an opportunity for an attacker to create a valid account without application of the proper identification and authorizatio..."

New page

== Summary ==

The provisioning of accounts presents an opportunity for an attacker to create a valid account without application of the proper identification and authorization process.

== Test objectives ==

Verify which accounts may provision other accounts and of what type

== How to test ==

=== Example ===

== Tools ==

== References ==

== Remediation ==

@@ Line 4: / Line 4: @@
 The provisioning of accounts presents an opportunity for an attacker to create a valid account without application of the proper identification and authorization process.
 == Test objectives ==
-Verify which accounts may provision other accounts and of what type
+Verify which accounts may provision other accounts and of what type.
 == How to test ==
@@ Line 13: / Line 15: @@
 Determine which roles are able to provision users and what sort of accounts they can provision.
-Is there any verification, vetting and authorisation of provisioning requests?
+* Is there any verification, vetting and authorization of provisioning requests?
-Is there any verification, vetting and authorisation of de-provisioning requests?
+* Can an administrator provision other administrators or just users?
-Can an administrator provision other administrators or just users?
+* Can an administrator or other user provision accounts with privileges greater than their own?
-Can an administrator or other user provision accounts with privileges greater than their own?
+* Can an administrator or user de-provision themselves?
-Can an administrator/user deprovision themselves?
+* How are the files or resources owned by the de-provisioned user managed? Are they deleted? Is access transferred?
 === Example ===
-In Wordpress, only a user's name and email address are required to provision the user, which can be done by
+In WordPress, only a user's name and email address are required to provision the user, as shown below:
 [[File:Wordpress_useradd.png|800px]]
-De-provisioning of users requires the administrator to select the users to be de-provisioned, selecting Delete from the dropdown menu (circled) and then applying this action. The administrator is then presented with a dialog box asking what to do with the user's posts (delete or transfer them).
 [[File:Wordpress_authandusers.png|800px]]
 == Tools ==
 While the most thorough and accurate approach to completing this test is to conduct it manually, HTTP proxy tools could be also useful.

← Older revision		Revision as of 16:32, 6 March 2014
Line 35:		Line 35:
	== Tools ==		== Tools ==

−		+	While the most thorough and accurate approach to completing this test is to conduct it manually, HTTP proxy tools could be also useful.
−	~~== References ==~~
−
−
−	~~== Remediation ==~~

← Older revision		Revision as of 16:40, 21 November 2013
Line 1:		Line 1:
		+	{{Template:OWASP Testing Guide v4}}
		+
	== Summary ==		== Summary ==

@@ Line 10: / Line 10: @@
 Determine which roles are able to provision users and what sort of accounts they can provision.
-Can an administrator provision other administrators or just users?
 Is there any verification, vetting and authorisation of provisioning requests?
 Is there any verification, vetting and authorisation of de-provisioning requests?
 === Example ===
 == Tools ==
 == References ==

← Older revision		Revision as of 06:35, 5 November 2013
Line 8:		Line 8:

	== How to test ==		== How to test ==
		+
		+	Determine which roles are able to provision users and what sort of accounts they can provision.
		+	Can an administrator provision other administrators or just users?
		+	Is there any verification, vetting and authorisation of provisioning requests?
		+	Is there any verification, vetting and authorisation of de-provisioning requests?

	=== Example ===		=== Example ===