Configuring the authentication cache in Liberty

You can modify how authenticated users are cached in Liberty.

About this task

In version 22.0.0.11 and later, documentation for the authentication cache, including the distributed authentication cache, is available on the Open Liberty website.

Because the creation of a subject might affect performance, Liberty provides an authentication cache to store a subject after an authentication of a user is successful. The cache is initialized with a set number of entries, which are determined by the initialSize attribute, and has a maximum number of entries, which are determined by the maxSize attribute. If the maximum size is reached, then the earliest entries that were used are removed from the cache. If a user is inactive for longer than period that is specified by the timeout attribute, then the entry for that user is removed from the cache. By default, the cache size is initialized to 50 entries and a maximum of 25000 entries, with a timeout of 600 seconds.

You do not have to configure the values for the authCache element unless you want to change the default values of the authentication cache.

Note:

Any change that is made to the user registry configuration in the server.xml file clears the authentication cache. However, if changes are made to an external user registry, such as LDAP, the authentication cache is unaffected.
You must consider the following effects of the timeout value on your configuration:
- Larger authentication cache timeout values can increase security risks. For example, a user who is revoked can still log in by using a credential that is cached in the authentication cache until the cache is refreshed.
- Smaller authentication cache timeout values can affect performance. When this value is smaller, the Liberty server accesses the user registry or repository more frequently.
- Larger numbers of entries in the authentication cache, which is caused by an increased number of users, increases the memory usage of the authentication cache. Thus, the application server might slow down and affect performance.
You can clear the authentication cache manually by using the DeleteAuthCache MBean and calling the removeAllEntries() method.

Procedure

Enable the appSecurity-2.0 Liberty feature by adding the following code to the server.xml file.
```
 <featureManager>
    <feature>appSecurity-2.0</feature>
 </featureManager>
```
Optional: To change the default options for the authentication cache, add the <authCache> element to the server.xml file. In the following example, the initial size of the authentication cache is changed to 100 entries with a maximum of 50000 entries, and the timeout is changed to 15 minutes.
```
 <authCache initialSize="100" maxSize="50000" timeout="15m"/>
```
Optional: To disable the authentication cache, set the attribute cachEnabled to false in the <authentication> element as follows:
```
 <authentication id="Basic" cacheEnabled="false" />
```
For more information about the <authCache> and <authentication> elements, see Application Security 2.0.