Adding Access Manager Permissions to the Server Policy File

If Security Manager is enabled, add the Access Manager 7.1 permissions to the server policy file for the web container on which Access Manager will be deployed. The name of the server policy depends on the web container you are using.

Example 12–1 Access Manager Permissions in the Server Policy File

The following permissions apply to all Access Manager web containers.

// ADDITIONS FOR Access Manager
grant {
  permission java.net.SocketPermission "*", "connect,accept,resolve";
  permission java.util.PropertyPermission "*", "read, write";
  permission java.lang.RuntimePermission "modifyThreadGroup";
  permission java.lang.RuntimePermission "setFactory";
  permission java.lang.RuntimePermission "accessClassInPackage.*";
  permission java.util.logging.LoggingPermission "control";
  permission java.lang.RuntimePermission "shutdownHooks";
  permission javax.security.auth.AuthPermission "getLoginConfiguration";
  permission javax.security.auth.AuthPermission "setLoginConfiguration";
  permission javax.security.auth.AuthPermission "modifyPrincipals";
  permission javax.security.auth.AuthPermission "createLoginContext.*";
  permission java.io.FilePermission "<<ALL FILES>>", "execute,delete";
  permission java.util.PropertyPermission "java.util.logging.config.class", "write";
  permission java.security.SecurityPermission "removeProvider.SUN";
  permission java.security.SecurityPermission "insertProvider.SUN";
  permission javax.security.auth.AuthPermission "doAs";
  permission java.util.PropertyPermission "java.security.krb5.realm", "write";
  permission java.util.PropertyPermission "java.security.krb5.kdc", "write";
  permission java.util.PropertyPermission "java.security.auth.login.config", "write";
  permission java.util.PropertyPermission "user.language", "write";
  permission javax.security.auth.kerberos.ServicePermission "*", "accept";
  permission javax.net.ssl.SSLPermission "setHostnameVerifier";
  permission java.security.SecurityPermission "putProviderProperty.IAIK";
  permission java.security.SecurityPermission "removeProvider.IAIK";
  permission java.security.SecurityPermission "insertProvider.IAIK";
  permission java.security.SecurityPermission "getProperty.ocsp.*";
    };
// END OF ADDITIONS FOR Access Manager

Modifying the Server Policy File For Specific Applications

You can also specify that the permissions apply only to a specific application in a specific web container. For example, the following statement grants security permissions only to Access Manager deployed on Sun Java System Application Server. For other web containers, refer to the respective web container documentation for more information.

Example 12–2 Additions to the Server Policy File For Sun Java System Application Server

// ADDITIONS FOR Access Manager on Sun Java System Application Server
grant codeBase "file:\${com.sun.aas.instanceRoot}/applications/j2ee-modules/amserver/-" 
{

... // Permissions from the previous example 

}

Also, if you deploy Access Manager using a name other than amserver, change that name in the grant statement.