STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must prohibit the use of cached authenticators after an organization-defined time period.

DISA Rule

SV-250345r961521_rule

Vulnerability Number

V-250345

Group Title

SRG-APP-000400-AS-000246

Rule Version

IBMW-LS-000970

Severity

CAT II

CCI(s)

• CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

10

Fix Recommendation

Edit the server.xml file and define the authCache timeout value as 10 minutes or AO approved value. Also ensure the appSecurity-2.0 feature is enabled.

EXAMPLE:

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

<authCache initialSize="100" maxSize="50000" timeout="10m"/>

Check Contents

Review system security plan and identify the cache timeout parameters for authentication. The value for admin timeout is 10 minutes. However, a case-by-case exception based on operational requirements can be configured with AO acceptance.

As a privileged user with access to server.xml, review the file and verify the authCache timeout parameter is configured for 10 minutes.

grep -i authcache server.xml

EXAMPLE:
<authCache initialSize="100" maxSize="50000" timeout="10m"/>

If the authCache timeout parameter is not configured for 10 minutes, or the AO has not accepted the risk for extending the timeout period specified, this is a finding.

Vulnerability Number

V-250345

Documentable

False

Rule Version

IBMW-LS-000970

Severity Override Guidance

Review system security plan and identify the cache timeout parameters for authentication. The value for admin timeout is 10 minutes. However, a case-by-case exception based on operational requirements can be configured with AO acceptance.

As a privileged user with access to server.xml, review the file and verify the authCache timeout parameter is configured for 10 minutes.

grep -i authcache server.xml

EXAMPLE:
<authCache initialSize="100" maxSize="50000" timeout="10m"/>

If the authCache timeout parameter is not configured for 10 minutes, or the AO has not accepted the risk for extending the timeout period specified, this is a finding.

Check Content Reference

M

Target Key

5424