Securing a Coherence Cache

Coherence is a data source and the question is if we can secure it so that only authorized users/applications can access it. A sample custom named cache based solution is already available Here. Based on this example I have streamlined and simplified it's integration a little so that cache configuration is simpler and scope of security provider is taken out of Coherence. The entire project is available at Securing a Coherence Cache. [Part II is at http://ezsaid.blogspot.com/2009/10/integrating-ldap-with-coherence.html]

Following are some simplifications:

1. Add a new XML Element (<entitled>) to enable a cache scheme for security. The configuration will look like the following:

   <distributed-scheme>
              <scheme-name>distributed-scheme</scheme-name>
              <service-name>DistributedCache</service-name>
              <backing-map-scheme>
                  <local-scheme></local-scheme>
              </backing-map-scheme>
              <autostart>true</autostart>
              <entitled>
                  <security-provider>MySecurityProvider</security-provider>
              </entitled>
   </distributed-scheme>

2. A new ConfigurableCacheFactory. It's setConfig looks like:

       public void setConfig(XmlElement xmlConfig) {
          // -- Find all the caches for which entitled is set to true
          // -- Fild all cache names that has the scheme for which
          // -- entitled tag is defined
          // -- Replace the scheme name to a class-scheme with Entitled
          // -- cache
          // -- Find all the cache schemes with entitled set to true
          Map map = findEntitledSchemes(xmlConfig);
          XmlElement csM =
                     xmlConfig.findElement("caching-scheme-mapping");
          Iterator cMs = csM.getElements("cache-mapping");
          XmlElement cM = null;
          while (cMs.hasNext()) {
              cM = (XmlElement) cMs.next();
              String schemeName =
                     cM.findElement("scheme-name").getString();
              if (map.containsKey(schemeName)) {
                  cM.findElement("scheme-name").setString("entitled-scheme");
                  XmlElement iPs = cM.addElement("init-params");               
                  XmlElement iP = iPs.addElement("init-param");
                  iP.addElement("param-name").setString("security-provider");
                  iP.addElement("param-value").setString(map.get(schemeName));
              }
          }
   
          XmlElement rCS =
                     XmlHelper.findElement(xmlConfig, "//caching-schemes");
          XmlElement cS = rCS.addElement("class-scheme");
          cS.addElement("scheme-name").setString("entitled-scheme");
          cS.addElement("class-name").setString(
                                      EntitledNamedCache.class.getName());
          XmlElement iPs = cS.addElement("init-params");
         
          XmlElement iP = iPs.addElement("init-param");
          iP.addElement("param-type").setString("string");
          iP.addElement("param-value").setString("{cache-name}");
         
          XmlElement iP2 = iPs.addElement("init-param");
          iP2.addElement("param-type").setString("string");
          String cache_config =
              System.getProperty("tangosol.coherence.cacheconfig");
          if (cache_config == null) {
              cache_config = FILE_CFG_CACHE;
          }
          iP2.addElement("param-value").setString(cache_config);
   
          XmlElement iP3 = iPs.addElement("init-param");
          iP3.addElement("param-type").setString("string");
          iP3.addElement("param-value").setString("{security-provider}");
         
          super.setConfig(xmlConfig);
      }

3. A new interface to implement. Implement SecurityProvider interface and configure it as a security-provider in the cache configuration.

   public interface SecurityProvider {
      public boolean checkAccess (Subject subject);
   }

And thats all you need. Download the complete code from Securing a Coherence Cache. Enjoy!