C Security Errors and Diagnostic Signals

Identify the rejecting boundary and fix the responsible artifact, identity, or configuration with bounded diagnostic data.

Start with the process, protocol, resource, and operation that failed. Retain a safe request identifier and the bounded reason/status. Avoid logging credentials, full subjects, arbitrary keys/values, or complete remote throwable graphs.

Serialization and Executable Failures

Serialization and executable rejection reasons fall into four families. When debugging a failing deployment, identify the family first, then locate the specific row in the table below.

• Missing allowlist — security-config-missing, ClassIdentity package is not allowed, unknown user type, Deserialization of class ... was rejected. The class is not known to the receiver; fix by annotating and regenerating, or by registering with POF.

• Remote execution policy — dynamic-remote-denied-by-mode, method-invocation-denied-by-mode, script-eval-denied-by-mode, lambda-target-not-allowed, class-name-on-denylist, method-on-denylist. A lambda-shaped payload, MIP reflection request, or script request was refused by mode policy, target-interface policy, or by the explicit deny-list.

• Bytecode shape — bytecode-references-gadget, native-method-declared, dynamic-class-forname, invalid-bytecode. Wire-supplied bytecode failed structural or deny-list checks.

• Dynamic class definition — Invalid class definition: missing-magic, invalid-version, invalid-shape, trailing-bytes. The class-definition payload did not pass file-format validation.

Reason or message shape	Subsystem	Typical cause	Fix
Lambda bytecode rejected: site=%s, reason=security-config-missing, denied=%s	Allowlist	An application class arrived as a class-name payload but is not in generated security config or the manual allowlist.	Annotate the producing class with @Remote.Allowed or @PortableType, run the Maven or Gradle generator, and package the generated config.
Lambda bytecode rejected: site=LAMBDA, reason=dynamic-remote-denied-by-mode	Lambda mode gate	A DYNAMIC lambda arrived while coherence.remote.dynamic.unauthenticated resolved to an explicit deny.	Switch to STATIC lambda serialization or explicitly set -Dcoherence.remote.dynamic.unauthenticated=allow.
method-invocation-denied-by-mode	MIP mode gate	A MethodInvocationProcessor arrived while coherence.remote.dynamic.unauthenticated resolved to an explicit deny.	Set -Dcoherence.remote.dynamic.unauthenticated=allow only where reflective method invocation is intentionally exposed, or replace the call with a purpose-built @Remote.Executable processor.
script-eval-denied-by-mode	Script mode gate	A ScriptProcessor arrived while coherence.remote.dynamic.unauthenticated resolved to an explicit deny.	Set -Dcoherence.remote.dynamic.unauthenticated=allow only where remote script evaluation is intentionally exposed, or replace the script with a purpose-built @Remote.Executable processor.
Lambda bytecode rejected: site=%s, reason=lambda-target-not-allowed, denied=%s	Lambda target	A serialized lambda targets a functional interface that is not marked as a lambda target in merged security config. The denied value is the functional interface FQN, not the lambda capture class.	Annotate the functional interface with @Remote.Executable and regenerate security config, or add a manual <class name="..." lambda-target="true"/> entry for that interface.
reason=bytecode-references-gadget	Bytecode scan	Generated or supplied lambda bytecode references a deny-listed gadget class or method.	Remove the reference or use a safe server-side class. Use coherence.lambda.bytecode.allow only for emergency class-reference overrides.
reason=class-name-on-denylist	Bytecode scan / MIP reflection	A static lambda, class-name payload, MIP supplier, or MIP target value names a deny-listed class.	Remove the deny-listed class from the payload path or reflective MIP target.
reason=method-on-denylist	MIP reflection	A MethodInvocationProcessor targets a deny-listed class#method pair.	Remove the reflective method call and use a purpose-built safe server-side processor.
Graal PolyglotException or script error naming a denied Java type	Script HostAccess	A script attempted Java.type(...) or guest-side host access for a deny-listed class such as java.lang.Runtime or java.lang.ProcessBuilder.	Remove the host access from the script. coherence.remote.dynamic.unauthenticated does not bypass the HostAccess hard floor.
reason=native-method-declared	Bytecode scan	Wire-supplied bytecode declares a native method.	Do not send dynamic bytecode that declares native methods.
reason=dynamic-class-forname	Bytecode scan	Wire-supplied bytecode calls Class.forName with a non-constant value.	Resolve the class server-side or remove dynamic class loading from the lambda.
reason=invalid-bytecode	Bytecode scan / Class definition	The supplied class bytes are empty, malformed, or cannot be parsed.	Regenerate the payload with a supported Coherence version and check for transport corruption.
Invalid class definition: missing-magic	Class definition	A class-definition payload does not start with the Java class-file magic number.	Reject the payload source; resend only valid class files.
Invalid class definition: invalid-version	Class definition	A class-definition payload uses an unsupported class-file version.	Build the producing artifact for a Java version supported by the receiving member.
Invalid class definition: invalid-shape	Class definition	A class-definition payload has an unexpected constant-pool, method, or class shape.	Regenerate the payload and verify client/server version compatibility.
Invalid class definition: trailing-bytes	Class definition	A class-definition payload contains bytes after the parsed class file.	Reject the payload source; resend a clean class definition.
ClassIdentity package is not allowed: %s	Class identity / Allowlist	A dynamic class identity names a package not present in generated security config or the runtime allowlist.	Annotate the producing type or package and regenerate security config.
unknown user type: %s. Unregistered POF type ... strict mode	POF strict / Allowlist	A POF payload names a user type that is not registered in the receiver's POF configuration.	Register the class in <pof-config>, annotate it with @PortableType, or add @Remote.Allowed and regenerate security config.
Deserialization of class %s was rejected	JEP-290 filter	The JEP-290 filter rejected a Java-serialization class in a fail-closed path.	Use a registered safe type or add the application type to generated security config or coherence.serialization.allowed.
coh.executable.policy_check{result=would_reject, class=<FQN>, reason=<OperationReason>, role=<SerializationRole>}	Executable policy (shadow)	Compatibility security mode classified a remote executable object that would be rejected by DefaultRemoteExecutablePolicy.enforce(...) in hardened security mode.	Treat each tuple as migration work: annotate the class with @Remote.Executable, regenerate security-config.xml, or add a manual executable="true" entry before setting -Dcoherence.security.mode=hardened.

Policy Telemetry

Serialization gate decisions are visible through SerializationGates MBeans. ObjectNames include the route, gate, result, reason, and mode tuple, for example:

Coherence:type=SerializationGates,route=GRPC,gate=filter,result=rejected,reason=serialization-allowlist-rejected,mode=prod

Lambda bytecode checks also maintain the in-process counter key:

coh.lambda.bytecode_check{result=rejected,reason=dynamic-remote-denied-by-mode,site=lambda}

Use these counters to identify which boundary is rejecting traffic before loosening any runtime property.

Live remote executable enforcement checks in hardened security mode maintain:

coh.executable.policy_check{reason=<OperationReason>, role=<SerializationRole>, result=allowed|rejected, mode=<runtime-mode>}

For Extend InvocationService, the tuple uses reason=INVOKE and role=EXTEND_PROXY. MethodInvocationProcessor and ScriptProcessor use reason=PROCESS_ENTRY and reason=SCRIPT_EVAL, respectively. Remote MapTrigger installation uses reason=TRIGGER and role=EXTEND_PROXY. Topic subscriber filter/extractor installation and persisted replay use reason=EVALUATE_FILTER|EXTRACT and role=TOPICS. Cache data-plane processor, aggregator, filter, extractor, and comparator installs through Extend, REST, and gRPC use reason=PROCESS_ENTRY|AGGREGATE|EVALUATE_FILTER|EXTRACT|COMPARE and role=EXTEND_PROXY|REST|GRPC. Coherence Concurrent executor task and callback installs use reason=CONCURRENT_TASK and role=CONCURRENT. Live tuples may also include sub_reason=policy|mode_gate|denylist|replay_drift; the tag is additive and callers must not assume a closed set. Successful policy checks use sub_reason=policy; mode and deny-list sub-reasons are emitted only for refusals. Topic replay under warn-allow records result=allowed,sub_reason=replay_drift to make migration drift visible.

Remote executable policy shadow checks in compatibility security mode maintain:

coh.executable.policy_check{result=would_reject, class=<FQN>, reason=<OperationReason>, role=<SerializationRole>}

This counter is emitted by DefaultRemoteExecutablePolicy.enforce(...) in compatibility mode. It identifies classes that fail that policy check; a dynamic install may subsequently be allowed by the independent dynamic gate, so a shadow tuple is not proof that the final hardened request will fail. The mode tag is absent from these shadow tuples, while class identifies migration candidates. It does not measure serialization allowlist or lambda bytecode readiness. Test named and dynamic paths with the intended profile and an explicit dynamic setting. Persisted topic replay has its own drift policy; install-time dynamic shadows may include both policy and mode-gate tuples.

Protocol and Operations Symptoms

Symptom	Likely boundary	Next step
TLS handshake or server-name failure	Trust, certificate purpose/name, client certificate, or transport policy	Verify configured provider, real endpoint name, trust and identity material on both ends; do not bypass verification.
HTTP 401 / gRPC UNAUTHENTICATED	Missing/unusable identity or cleartext Basic under hardened policy	Check the acceptor auth method, token type, JAAS entry/module, and required transport.
gRPC PERMISSION_DENIED	Executable or caller policy	Inspect the bounded reason and receiver role; classify code or correct role/resource policy as appropriate.
REST 403 for q	Direct query disabled	Prefer a configured named query, or explicitly approve direct querying and bounds.
REST 404 for a pass-through cache	Resource not published under hardened policy	Declare only the intended REST resource; do not expose all caches to fix a single name.
REST 400 for expressions	Unknown alias or unsafe expression	Use the configured alias/supported query subset and verify URL encoding.
JSON binding/metadata failure	Alias/class policy or malformed input	Configure the actual consuming serializer/marshaller; inspect nested metadata and supported class policy.
XML parser capability failure	Required external-entity protections unavailable	Use a supported provider/runtime and approved resource resolution.
Management/Reporter result=would_reject	Administrative compatibility shadow	Approve exact targets/sources/output roots and retest under hardened policy; these warnings do not increment executable counters.
JMXMP startup failure	Authenticator or process-wide filter initialization	Configure the supported authenticator and review existing/fallback filter behavior.
Peer proof unavailable/required-policy rejection	Provider, authority, capability, or topology readiness	Check the supported provider and all-member prerequisites; never substitute a deterministic test provider.
RAG proxy-not-allowed	JVM selected a proxy for a direct-only import	Use an approved direct import path or another supported ingestion mechanism.
RAG path-not-allowed / unsupported filesystem	Import root or secure traversal requirement	Use protected supported roots/filesystem or another approved import source.