Back to Checks
googleworkspace

Login challenges are configured correctly

security_login_challenges_configured
Service: securitySeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The domain-level login challenges configuration has the employee ID challenge disabled. This check is not mapped to CIS 4.1.4.1 because that recommendation also requires Post-SSO verification, a setting not exposed by the Cloud Identity Policy API, so the requirement cannot be evaluated end to end.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When the employee ID login challenge is enabled without proper configuration, it may create a false sense of security or interfere with the login flow. The employee ID challenge is a supplementary verification method that should only be used when specifically required by the organization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_login_challenges_configured

Recommendation

Disable the employee ID login challenge and manually verify that Post-SSO verification is enabled in the Admin Console, as the Post-SSO setting is not exposed by the Policy API.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Login Challenges**
3Under **Login challenges**, uncheck **Use employee ID to keep my users more secure**
4Click **Save**
5Under **Post-SSO verification**, check **Logins using SSO are subject to additional verifications (if appropriate) and 2-Step Verification (if configured)** (this setting cannot be verified via the Policy API)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_login_challenges_configured(Check):
    """Check that login challenges are configured correctly.

    This check verifies that the employee ID login challenge is disabled.

    It is not mapped to CIS 4.1.4.1: that recommendation also requires Post-SSO
    verification, a setting the Cloud Identity Policy API does not expose, so
    the requirement cannot be evaluated end to end and is reported as manual.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            employee_id_enabled = security_client.policies.login_challenge_employee_id

            if employee_id_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Employee ID login challenge is disabled "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"Note: Post-SSO verification status cannot be verified "
                    f"via the Policy API."
                )
            elif employee_id_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Employee ID login challenge uses Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"Note: Post-SSO verification status cannot be verified "
                    f"via the Policy API."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Employee ID login challenge is enabled "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"The employee ID challenge should be disabled per CIS "
                    f"recommendations. Note: Post-SSO verification status "
                    f"cannot be verified via the Policy API."
                )

            findings.append(report)

        return findings

References