title: TomEE 1.6.0.2 won't start with security enabled
body: <p>It doesn’t look to me like TomEE+ 1.6.0.2 wiil start with the -security command line option. As a sanity check, I’ve downloaded a clean release and it too fails early in the bootstrap process with the following:</p>
  
  <pre><code>INFO: Creating SecurityService(id=Tomcat Security Service)
  java.lang.ClassCircularityError: javax/security/jacc/PolicyContext
  at org.apache.openejb.core.security.jacc.BasicJaccProvider.implies(BasicJaccProvider.java:75)
  at org.apache.openejb.core.security.JaccProvider$Policy.implies(JaccProvider.java:126)
  at java.security.ProtectionDomain.implies(ProtectionDomain.java:272)
  at java.security.AccessControlContext.checkPermission(AccessControlContext.java:435)
  at java.security.AccessController.checkPermission(AccessController.java:884)
  at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
  at java.lang.Thread.setContextClassLoader(Thread.java:1467)
  at org.apache.openejb.log.LoggerCreator$Get.exec(LoggerCreator.java:87)
  at org.apache.openejb.log.LoggerCreator$Get.exec(LoggerCreator.java:98)
  at org.apache.openejb.util.JuliLogStream.isFatalEnabled(JuliLogStream.java:37)
  at org.apache.openejb.util.Logger.isFatalEnabled(Logger.java:380)
  at org.apache.openejb.util.Logger.fatal(Logger.java:530)
  at org.apache.openejb.OpenEJB$Instance.&lt;init&gt;(OpenEJB.java:156)
  at org.apache.openejb.OpenEJB.init(OpenEJB.java:298)
  at org.apache.tomee.catalina.TomcatLoader.initialize(TomcatLoader.java:253)
  at org.apache.tomee.catalina.ServerListener.install(ServerListener.java:168)
  at org.apache.tomee.catalina.ServerListener.lifecycleEvent(ServerListener.java:55)
  at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
  at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
  at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:402)
  at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:110)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:638)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:663)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:483)
  at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:280)
  at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:454)
  </code></pre>
  
  <p>Is there a configuration issue? What’s the fix? </p>
  
  <p>For context, I’m trying to run in secure mode because I need to retrieve the client certificate on an APR TLS 1.2 connector and it looks like the certificate isn’t provided unless you are running with SecurityManager enabled. Right now getAttribute(“javax.servlet.request.X509Certificate”) return null (yes, I definitely have clientAuth=“required” in server.xml). </p>
  
  <p>For reference, here is the connector from server.xml:</p>
  
  <pre><code>&lt;Connector port="4449" protocol="org.apache.coyote.http11.Http11AprProtocol"
             maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
             clientAuth="true" sslProtocol="TLSv1.2"
             SSLCertificateFile="/etc/unipagos/certs/pay.crt"
             SSLCertificateKeyFile="/etc/unipagos/certs/pay.key"
             SSLVerifyClient="required"
             SSLHonorCipherOrder="true"
             ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"/&gt;
  </code></pre>
  
  <p>If you know of a way to get the client certificate that works without enabling the SecurityManager, please let me know. This issue is actually blocking a production release.</p>