Java – Do we need terracotta on top of ehcache for clustering

The short answer is Yes.

You should get your application working without Terracotta but with Hibernate first, then once your code works with Hibernate adding ehcache is fairly straight forward (and documented in the install guide here). Once that is done is just a case of adding your Terracotta jars, seting up the terrracotta config file and altering the ehcache config file to point to your terracotta instance.

The terracotta Hibernate express install guide lists the steps you need to take for using Hibernate with terracotta

Strings are immutable. That means once you've created the String, if another process can dump memory, there's no way (aside from reflection) you can get rid of the data before garbage collection kicks in.

With an array, you can explicitly wipe the data after you're done with it. You can overwrite the array with anything you like, and the password won't be present anywhere in the system, even before garbage collection.

So yes, this is a security concern - but even using char[] only reduces the window of opportunity for an attacker, and it's only for this specific type of attack.

As noted in the comments, it's possible that arrays being moved by the garbage collector will leave stray copies of the data in memory. I believe this is implementation-specific - the garbage collector may clear all memory as it goes, to avoid this sort of thing. Even if it does, there's still the time during which the char[] contains the actual characters as an attack window.