STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Basic Authentication must be disabled.

DISA Rule

SV-250334r1051118_rule

Vulnerability Number

V-250334

Group Title

SRG-APP-000148-AS-000101

Rule Version

IBMW-LS-000381

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Delete basicRegistry settings and re-configure the server.xml file to use a centralized LDAP user store.

SAMPLE:

<featureManager>
<feature>appSecurity-2.0</feature>
<feature>ldapRegistry-3.0</feature>
</featureManager>

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
ldapType="${ldap.vendor.type}"
searchTimeout="8m">
</ldapRegistry>

Check Contents

As a privileged user with local file access to the ${server.config.dir}/server.xml file, search the server.xml for the basicRegistry setting.

grep -i basicregistry server.xml

SAMPLE:
<basicRegistry id="basic" realm="BasicRealm">
<user name="employee0" password="emp0pwd" />
<user name="employee1" password="emp1pwd" />
<user name="manager0" password="mgr0pwd" />
<group name="employeeGroup">
<member name="employee0" />
<member name="employee1" />
</group>
</basicRegistry>

If <basicRegistry> settings are defined in server.xml, this is a finding.

Vulnerability Number

V-250334

Documentable

False

Rule Version

IBMW-LS-000381

Severity Override Guidance

As a privileged user with local file access to the ${server.config.dir}/server.xml file, search the server.xml for the basicRegistry setting.

grep -i basicregistry server.xml

SAMPLE:
<basicRegistry id="basic" realm="BasicRealm">
<user name="employee0" password="emp0pwd" />
<user name="employee1" password="emp1pwd" />
<user name="manager0" password="mgr0pwd" />
<group name="employeeGroup">
<member name="employee0" />
<member name="employee1" />
</group>
</basicRegistry>

If <basicRegistry> settings are defined in server.xml, this is a finding.

Check Content Reference

M

Target Key

5424