# Custom SPI to add or remove policy and local cache issue in cluster mode

**URL:** <https://forum.keycloak.org/t/custom-spi-to-add-or-remove-policy-and-local-cache-issue-in-cluster-mode/1288>\
**Category:** Extending the server\
**Created:** [February 17, 2020, 3:32pm UTC](https://forum.keycloak.org/t/custom-spi-to-add-or-remove-policy-and-local-cache-issue-in-cluster-mode/1288 "2020-02-17T15:32:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![damianofontana85](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/damianofontana85/32/368_2.png) [@damianofontana85](https://forum.keycloak.org/u/damianofontana85)\
**Post date:** [February 17, 2020, 3:32pm UTC](https://forum.keycloak.org/t/custom-spi-to-add-or-remove-policy-and-local-cache-issue-in-cluster-mode/1288/1 "2020-02-17T15:32:19Z")

</div>

Hi everyone,  
we are built a custom SPI to dynamically add and remove user based policy to existing permission.  
We are experiencing issue in Keycloak authorization cache in our 3 machines keycloak cluster.  
Sometimes the cache is not invalidated in every node resulting in authorization failures.  
Here below the piece of code we use for adding a policy to an existing one:

ClientModel clientModel = Optional.ofNullable(realm.getClientByClientId(cliendId))  
.orElseThrow( ()-\>new InternalServerErrorException("CliendId “+cliendId+” in realm “+realm.getName()+” is not present ") ) ;

```
        StoreFactory storeFactory = this.authorization.getStoreFactory();
        ResourceServer resourceServer = storeFactory.getResourceServerStore().findById(clientModel.getId());

        Optional.ofNullable(storeFactory.getResourceStore().findByName(resourceName, resourceServer.getId()))
                .orElseThrow( ()->new InternalServerErrorException("Resource Temple "+resourceName+" forn CliendId "+cliendId+" in realm "+realm.getName()+" is not present ") ) ;

        PolicyStore policyStore = storeFactory.getPolicyStore();

        Policy permission = Optional.ofNullable(policyStore.findByName(permissionName, resourceServer.getId()))
                .orElseThrow( ()->new InternalServerErrorException("Permission "+permissionName+" in client "+cliendId+" is not present ") ) ;

        String policyName = "share_"+resourceName+"_"+toUser;

        if(policyStore.findByName(policyName, resourceServer.getId())!=null)
               throw new ConflictException("Policy "+policyName+" in client" + cliendId + "' already exists.");

```

// add a policy to give access to the user  
Policy sharePolicy = policyStore.create(getSharePolicy(policyName,user.getId()), resourceServer);  
permission.addAssociatedPolicy(sharePolicy);

Any idea?

---

<div class="post-metadata">

**Author:** ![reste85](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@reste85](https://forum.keycloak.org/u/reste85)\
**Post date:** [February 19, 2020, 9:59am UTC](https://forum.keycloak.org/t/custom-spi-to-add-or-remove-policy-and-local-cache-issue-in-cluster-mode/1288/2 "2020-02-19T09:59:46Z")

</div>

+1 for this. We’re encountering this problem with Keycloak 6.0.1 version. Could you please provide help to us? @pedroigor