Monday, 19 June 2017

Cache operations impersonation: do as I say (or maybe as she says)

The implementation of cache authorization in Infinispan has traditionally followed the JAAS model of wrapping calls in a PrivilegedAction invoked through Subject.doAs(). This led to the following cumbersome pattern:

Subject.doAs(MY_USER, (PrivilegedAction<Void>) () -> {
cache.put("key", "value");
}

We also provided an implementation which, instead of relying on enabling the SecurityManager, could use a lighter and faster ThreadLocal for storing the Subject:

Security.doAs(MY_USER, (PrivilegedAction<Void>) () -> {
cache.put("key", "value");
}

While this solves the performance issue, it still leads to unreadable code.
This is why, in Infinispan 9.1 we have introduced a new way to perform authorization on caches:

cache.withSubject(MY_USER).put("key", "value");

Obviously, for multiple invocations, you can hold on to the "impersonated" cache and reuse it:
Cache<String, String> myUserCache = cache.withSubject(MY_USER);
myUserCache.put("key", "value");
myUserCache.put("anotherkey", "anothervalue");

We hope this will make your life simpler and your code more readable !

No comments:

Post a Comment