[id='code-execution-security-authorization_{context}']
= Code execution with security authorization

When you configure security authorization for embedded caches and then construct a `DefaultCacheManager`, it returns a `SecureCache` that checks the security context before invoking any operations.
A `SecureCache` also ensures that applications cannot retrieve lower-level insecure objects such as `DataContainer`.
For this reason, you must execute code with an identity that has the required authorization.

In Java, executing code with a specific identity usually means wrapping the code to be executed within a `PrivilegedAction` as follows:

[source,java]
----
import org.infinispan.security.Security;

Security.doAs(subject, new PrivilegedExceptionAction<Void>() {
public Void run() throws Exception {
    cache.put("key", "value");
}
});
----

With Java 8, you can simplify the preceding call as follows:

[source,java]
----
Security.doAs(mySubject, PrivilegedAction<String>() -> cache.put("key", "value"));
----

The preceding call uses the `Security.doAs()` method instead of `Subject.doAs()`.
You can use either method with {brandname}, however `Security.doAs()` provides better performance.

If you need the current Subject, use the following call to retrieve it from the {brandname} context or from the AccessControlContext:

[source,java]
----
Security.getSubject();
----
