STIGQter STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must set server token max age no greater than eight hours.

DISA Rule

SV-257562r961521_rule

Vulnerability Number

V-257562

Group Title

SRG-APP-000400-CTR-000960

Rule Version

CNTR-OS-000760

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To set the OAuth server token max age, edit the OAuth server object by executing the following:

oc patch oauth cluster --type merge -p '{"spec":{"tokenConfig":{"accessTokenMaxAgeSeconds": 28800}}}'

To set the OAuth client token max age, edit the OAuth client object by executing the following:

cli in $(oc get oauthclient -oname); do oc patch oauthclient $cli --type=merge -p '{"accessTokenMaxAgeSeconds": 28800}'; done

Check Contents

To check if the OAuth server token max age is configured, execute the following:

oc get oauth cluster -ojsonpath='{.spec.tokenConfig.accessTokenMaxAgeSeconds}'

If the output timeout value on the OAuth server is >"28800" or missing, this is a finding.

Check the OAuth client token value (this can be set on each client also).

Check all clients OAuth client token max age configuration by execute the following:

oc get oauthclients -ojson | jq -r '.items[] | { accessTokenMaxAgeSeconds: .accessTokenMaxAgeSeconds}'

If the output returns a timeout value of >"28800" for any client, this is a finding.

Vulnerability Number

V-257562

Documentable

False

Rule Version

CNTR-OS-000760

Severity Override Guidance

To check if the OAuth server token max age is configured, execute the following:

oc get oauth cluster -ojsonpath='{.spec.tokenConfig.accessTokenMaxAgeSeconds}'

If the output timeout value on the OAuth server is >"28800" or missing, this is a finding.

Check the OAuth client token value (this can be set on each client also).

Check all clients OAuth client token max age configuration by execute the following:

oc get oauthclients -ojson | jq -r '.items[] | { accessTokenMaxAgeSeconds: .accessTokenMaxAgeSeconds}'

If the output returns a timeout value of >"28800" for any client, this is a finding.

Check Content Reference

M

Target Key

5547