Basic Auth Enforcement Posture

This page describes the nowisor-basic-auth-enforcement-posture check (new in pack v1.1.0). It reads glide.authenticate.basic_auth.restriction.enforce, .enforcement_date and .default_decision and reports where you are in the tracking-to-enforcement rollout.

What this finding means

Basic Auth restriction has two phases: tracking (record only) and enforcing (block non-allow-listed Basic Auth). This check reads the enforcement state:

• enforce = true — enforcement is live; healthy posture, no finding.
• enforce = false, enforcement date in the future — tracking mode. The finding surfaces the days-remaining countdown to the enforcement date: your window to validate integrations before they are blocked. (Medium.)
• enforce = false, enforcement date already passed — enforcement was deferred or overridden after the vendor date; the MFA-bypass surface persists with no scheduled closure. (High.)
• enforce = false, no date — tracking with no scheduled enforcement.

The finding also reports default_decision verbatim — the action applied to accounts that defer to the system default.

Why it matters

Until enforcement is on, single-factor Basic Auth remains accepted on inbound APIs for accounts that should be using stronger authentication — the exact MFA bypass the feature exists to close. But flipping enforcement without validation causes outages: integrations that rely on Basic Auth will get HTTP 401. The countdown is the planning signal; a past-due date with enforcement still off is the warning that the rollout stalled.

How to remediate

Before the enforcement date, validate every inbound integration that may use Basic Auth so it does not 401 at cutover: Discovery, Service Graph Connectors, Intune / JAMF / SCCM, IntegrationHub REST steps, and any custom scripted REST / SOAP integrations. Migrate integration accounts to OAuth or mark them web-service-access-only and allow-list them, then set glide.authenticate.basic_auth.restriction.enforce = true. Do not let the enforcement date pass with enforce still false.

Verified against ServiceNow Zurich Patch 6 (dev265147), 2026-06-11.