A Security Configuration Reference

Locate profile-sensitive defaults, explicit feature controls, and the configuration that owns each policy.

This reference describes the controls used by this guide. Match them to the target distribution and supported modules; consult release/patch documentation for another code line. Explicit application configuration can differ from shipped marker-aware defaults. Set startup-resolved policy before starting the relevant process and use the owning recipe to coordinate changes.

Starting with Coherence 26.1.0.0, the hardened column/value applies when coherence.security.mode is unset. Compatibility behavior below requires explicitly selecting coherence.security.mode=compatibility; feature-specific overrides retain their documented precedence.

Application and Execution Controls

Property	Type	Default	Description	See
coherence.mode	enum: eval, dev, development, prod, production	dev	Selects the released runtime/license mode. It does not enable the compatibility-sensitive serialization and remote-execution gates. Blank, unknown, legacy, and legacy-compatibility values fail fast.	Runtime Modes
coherence.security.mode	enum: compatibility, hardened	hardened (starting with 26.1.0.0)	Selects the global security profile. Starting with Coherence 26.1.0.0, unset selects hardened and enables compatibility-sensitive checks. Explicit compatibility preserves the older behavior and shadow telemetry where available. The removed pre-release coherence.security.hardened property is not an alias.	Runtime Modes
coherence.security.subject.validation.ttl	duration	10s	Controls how long Standard security caches a successfully validated subject. Unitless values are milliseconds. Valid values are from 1 through Integer.MAX_VALUE milliseconds; malformed or out-of-range values use the 10-second default with a warning. This operator control is independent of coherence.mode and coherence.security.mode.	Standard Subject Validation Cache
coherence.remote.dynamic.unauthenticated	enum: allow, deny	allow in both profiles in the current integration implementation; confirm target-release policy before publication.	Explicit deny refuses wire-arriving DYNAMIC lambda bytecode, reflective MethodInvocationProcessor, script execution, and dynamic remote installs governed by the shared gate. Dynamic installs may pass without a named executable entry when allowed. Coherence Config also resolves COHERENCE_REMOTE_DYNAMIC_UNAUTHENTICATED. Does not bypass lambda-target checks, bytecode/MIP deny rules, Graal HostAccess, or caller authorization.	Lambda Serialization, MethodInvocationProcessor / ScriptProcessor
coherence.invocation.enabled	boolean	Compatibility: enabled; hardened: disabled, unless XML or this property explicitly overrides.	Controls exposure of the Coherence*Extend InvocationService proxy. An explicit system property overrides operational <invocation-service-proxy><enabled>; explicit XML overrides the profile default. Enabled remote invocation still requires executable classification.	InvocationService
coherence.concurrent.extend.enabled	boolean	security mode compatibility: true; security mode hardened: false	Overrides whether the Coherence Concurrent ConcurrentProxy Extend service is exposed. When unset, the shipped ConcurrentProxy autostart marker resolves to the security-mode-aware default. An explicit cache-config autostart override without the shipped system-property marker wins when the property is absent. This property does not bypass @Remote.Executable enforcement when the proxy is enabled.	Coherence Concurrent Executor
coherence.topics.persisted.policy-drift	enum: reject, warn-allow	security mode compatibility: warn-allow; security mode hardened: reject	Controls persisted topic subscriber filter/extractor policy drift on replay. reject refuses persisted metadata whose class is no longer executable; warn-allow logs a deduped WARN and allows replay for migration. The property is resolved through Coherence Config, so the COHERENCE_TOPICS_PERSISTED_POLICY_DRIFT environment variable alias is also honoured.	Topic Subscriber Filter / Extractor Install
coherence.serialization.allowed	class-fqn-list	empty	Adds exact class names or package wildcards, such as com.acme.*, to the runtime serialization allowlist. It supplements generated security config and does not bypass deny-listed gadget classes.	Generated security-config.xml
coherence.lambda.bytecode.allow	class-fqn-list	empty	Incident-response override for specific class references in the lambda bytecode deny-list. Structural bytecode rules such as native methods still apply.	Error Message Reference
coherence.security-config.skip	boolean	false	Maven plugin switch that skips security-config.xml generation for the current build.	Maven
coherence.lambdas	enum: dynamic, static	dynamic	Lambda serialization mode that has shipped in prior Coherence releases. Set to static when migrating production applications away from DYNAMIC lambda bytecode at the cost of lockstep client/server code-version coordination.	Lambda Serialization

Protocol and Administrative Controls

Property	Default or profile behavior	Configuration note
coherence.serializer.limit.maxContainerBytes	Compatibility: unbounded default; hardened: 64 MiB	Global byte limit default; serializer/service XML can refine it.
coherence.serializer.limit.maxElements	Compatibility: unbounded default; hardened: 262144	Array/collection/object count default for supported consumers.
coherence.serializer.limit.maxMapEntries	Compatibility: unbounded default; hardened: 131072	Map-entry count default for supported consumers.
coherence.grpc.server.secure-transport	optional	Set required to refuse insecure server transport configuration.
coherence.grpc.channels.<name>.secure-transport	optional	Product Java-client named channel policy; use required with a real TLS provider.
coherence.grpc.auth	none	Explicit basic enables gRPC Basic assertion; does not by itself mandate TLS at startup.
coherence.grpc.serializer.allowlist	empty additional set	Additional client-selectable serializer names in hardened operation.
coherence.grpc.channelz	auto	auto is enabled in compatibility and disabled in hardened; explicit enabled/disabled override.
coherence.grpc.error-disclosure	auto	auto is diagnostic in compatibility and safe in hardened; explicit safe/diagnostic override.
coherence.management.http.auth	Compatibility: none; hardened: basic	Shipped marker-aware default; explicit operator method configuration takes precedence.
coherence.metrics.http.auth	Compatibility: none; hardened: basic	Update scrapers before changing profile. Explicit none remains available and warns.
coherence.health.http.mutators.enabled	false	Independent opt-in for supported PUT suspend/resume routes.
coherence.health.http.auth	Enabled mutators: basic when absent/blank	basic, cert, cert+basic supported; none/invalid/missing required identity fail closed.
coherence.management.report.remote.allowed	empty	Exact approved HTTP(S) report-source authorities; profile-sensitive treatment of unapproved sources.
coherence.reporter.output.directory	.	Canonical report output root; hard malformed/traversal checks remain separate.
coherence.management.remote.registryport	unset	Configure static JMX publication to avoid dynamic /stub URL rejection under hardened policy.
coherence.management.remote.authenticator	unset	JMXAuthenticator class for remote management and JMXMP fallback; does not itself configure TLS.
coherence.management.serverfactory	Deployment-specific	Select com.tangosol.net.management.JmxmpServer only when that connector is intended.
coherence.jmxmp.host	127.0.0.1	JMXMP listener address; wider bind is an explicit network exposure decision.
coherence.jmxmp.port	9000	JMXMP listener port; authentication and filter requirements still apply.
coherence.jmxmp.authenticator	unset	Usable JMXAuthenticator required directly or through the documented remote-management fallback.
coherence.security.hostname.verification	Shipped SSL-provider marker: allow with profile-sensitive resolution	Use explicit default-verifier configuration in secure recipes; custom providers/verifiers retain their contracts.
coherence.security.config	DefaultController resource	Location of the DefaultController XML resource, including its signature algorithm configuration.
coherence.security.peer.senior-metadata-proof.required	false	Explicit true fails closed in both security profiles; requires compatible production proof setup.

RAG Component Controls

Property	Default	Configuration note
coherence.rag.security.admin-role	admin	Administrative role required for protected mutations/imports.
coherence.rag.config.write.allowed-properties	model.embedding,model.chat,model.scoring,coherence.rag.default.parser	Allowed runtime write keys; sensitive/protected fields retain deny policy.
coherence.rag.security.huggingface.allowed-models	empty	Empty permits/warns in compatibility and rejects downloads in hardened; configured values constrain both.
coherence.rag.import.allowed-schemes	empty	Explicitly approve each supported import scheme.
coherence.rag.import.file.allowed-roots	empty	Canonical local import roots; filesystem contract and final-entry race still apply.
coherence.rag.import.http.allowed-hosts	empty	Allowed origin hosts; every redirect/address is validated.
coherence.rag.import.http.allow-private-addresses	false	Does not waive host approval or permit link-local metadata destinations.
coherence.rag.import.connect-timeout-ms	10000	Bounded connection timeout.
coherence.rag.import.read-timeout-ms	30000	Bounded response-read timeout.
coherence.rag.import.max-bytes	52428800	Maximum accepted document response bytes.
coherence.rag.import.s3.allowed-buckets	empty	Approved S3 locations; configure scheme and provider IAM separately.
coherence.rag.import.azure.blob.allowed-containers	empty	Approved Azure Blob locations.
coherence.rag.import.gcs.allowed-buckets	empty	Approved Google Cloud Storage locations.
coherence.rag.import.oci.os.allowed-locations	empty	Approved OCI Object Storage locations.

XML and Artifact-Owned Policy

Configuration	Owner	Important boundary
META-INF/coherence/security-config.xml	Each contributing application JAR	Allowed/executable/lambda-target entries are merged; built-in deny rules remain effective.
Serializer <limits>	Operational template and cache service serializer	Missing values inherit; system-property values override the element fallback; custom consumers must implement the policy.
REST <direct-query enabled="true">	Resource query configuration	An empty element does not enable direct querying.
REST <expression-aliases>	Server/global or resource REST configuration	Named sort/projection/aggregator/processor expressions; not caller authorization.
<storage-authorizer>	Backing-map scheme referencing an operational declaration	Absent remains opt-in; auditing/strict-auditing do not supply a business role policy.
subject-proof-required="true"	Operational storage-authorizer declaration	Subject proof is enforced for the configured route under hardened policy with compatible provider prerequisites.
<peer-proof>	Operational security configuration	Provider material and authority configuration; required policy is separate and cannot supply missing trust.
Named JAAS entries	Protected JAAS configuration and module classpath	Endpoint entry names must match the actual HTTP/Coherence/application integration.
Named password providers	Operational provider registry and consuming component	Secret-source lifecycle and failure behavior are provider-specific.