1. In the Edit Tree, go to Environment, then Coherence Clusters.
2. Click the Coherence cluster that you want to edit, then select the Security tab.
3. Turn on the Security Framework Enabled option.
4. Click Save.

keytool -genkey -v -keystore ./keystore.jks -storepass password -alias admin
-keypass password -dname CN=Administrator,O=MyCompany,L=MyCity,ST=MyState

1. In the Edit Tree, go to Environment, then Coherence Clusters.
2. Click the Coherence cluster that you want to edit, then select the Security tab.
3. Make sure the Security Framework Enabled option is enabled.
4. Optional: Turn on the Global Socket Provider option. If you enable this option, Coherence uses the Oracle WebLogic Server's SSL as its global socket provider. For more information about configuring global SSL socket provider for Coherence, see Configuring a Cluster-Side Extend Proxy SSL Socket Provider.
5. In the Client Authentication Mode field, specify the client authentication mode for SSL. The valid values are:
   • none
   • required
   • wanted

   The default value is none.

6. In the Private Key Pass Phrase field, enter the password for the identity.
7. Click Save.

1. In the Edit Tree, go to Environment, then Coherence Clusters, then myCoherenceCluster, then Coherence Caches.
2. Click New.
3. In the Name field, enter a name for the Coherence cache. The name of the cache must exactly match the name of the cache used in an application.
4. Click Create and commit your changes.
5. Define security roles and policies that are scoped to the Coherence cache. See Create a Scoped Role in Oracle WebLogic Remote Console Online Help.
   For example, you can create a policy that allows specific users to access the cache. The users can be selected based on their membership in a global role, or a Coherence-specific scoped role can be created and used to define which users can access the cache. See Overview of Securing WebLogic Resources in Securing Resources Using Roles and Policies for Oracle WebLogic Server.

1. In the Edit Tree, go to Environment, then Coherence Clusters, then myCoherenceCluster, then Coherence Services.
2. Click New.
3. In the Name field, enter a name for the Coherence service. The name of the service must exactly match the name of the service used in an application.

   Note:

   The exact name must include the scope name as a prefix to the service name. The scope name can be explicitly defined in the cache configuration file or, more commonly, taken from the deployment module name. For example, if you deploy a GAR named contacts.gar that defines a service named ContactsService, then the exact service name is contacts:ContactsService.

4. Click Create and commit your changes.
5. Define security roles and policies that are scoped to the Coherence service. See Create a Scoped Role in Oracle WebLogic Remote Console Online Help.
   For example, you can create a policy that allows specific users to access the service. The users can be selected based on their membership in a global role, or a Coherence-specific scoped role can be created and used to define which users can access the service. See Overview of Securing WebLogic Resources in Securing Resources Using Roles and Policies for Oracle WebLogic Server.

An identity transformer associates an identity token with an identity. For local (within Oracle WebLogic Server) extend clients, the default identity transformer cannot be replaced. The default identity transformer passes a token of type weblogic.security.acl.internal.AuthenticatedSubject representing the current Oracle WebLogic Server user.

For remote (outside of Oracle WebLogic Server) extend clients, the identity transformer implementation class must be included as part of the application's classpath and the fully qualified name of the implementation class must be defined in the client operational override file. See Enabling a Custom Identity Transformer. The following example enables the default identity transformer:

...
<security-config>
   <identity-transformer>
      <class-name>
         com.tangosol.net.security.DefaultIdentityTransformer</class-name>
   </identity-transformer>
</security-config>
...

Remote extend clients must execute cache operations within the Subject.doAS method. For example,

Principal principal = new WLSUserImpl("user");
Subject subject = new Subject();
subject.getPrincipals().add(principal);

Subject.doAs(subject, new PrivilegedExceptionAction()
   {
      NamedCache cache = CacheFactory.getCache("mycache");
      ...

• If using WebLogic Remote Console, perform the following steps:
  1. In the Edit Tree, go to Environment, then Coherence Clusters, then myCoherenceCluster, then Coherence Identity Asserter.
  2. In the Class Name field, enter the fully qualified name of the asserter class. For example, to use the default identity asserter, enter com.tangosol.net.security.DefaultIdentityAsserter.
  3. Click Save.
  4. If there are any arguments, open the Identity Asserter Constructor Arguments node and click New to add class constructor arguments.
  5. Click Save and then commit your changes.
• If using WLST, perform the following steps:

  Invoke WLST and connect to the domain. Then, configure an identity asserter. Use the script below as an example:

  In the script below, replace:

  • DOMAIN_HOME with the path to your WebLogic Server domain home.
  • defaultCoherenceCluster with the name of your Coherence cluster.

  readDomain('DOMAIN_HOME')
  cd('CoherenceClusterSystemResource/defaultCoherenceCluster/CoherenceResource/defaultCoherenceCluster/CoherenceClusterParams/NO_NAME_0')
  set('SecurityFrameworkEnabled', 'true')
  cd('CoherenceIdentityAsserter/NO_NAME_0')
  set('ClassName',"com.tangosol.net.security.DefaultIdentityAsserter")
  updateDomain()
  closeDomain()