title: AccessControlException when starting embedded Tomcat from Java Webstart
body: <p>For our <a href="http://kunagi.org" rel="nofollow">Kunagi</a> Java web application we have a signed <code>kunagi.jar</code> file which contains our classes together with classes from embedded Tomcat 6. This runs perfectly when calling <code>java -jar kunagi.jar</code>.</p>
  
  <p>But when starting it with Java WebStart, I get an exception while embedded Tomcat is starting: </p>
  
  <pre><code>java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.deploy)
      at java.security.AccessControlContext.checkPermission(AccessControlContext.java:393)
      at java.security.AccessController.checkPermission(AccessController.java:553)
      at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
      at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1529)
      at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:291)
      at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
      at net.sourceforge.jnlp.runtime.JNLPClassLoader.loadClass(JNLPClassLoader.java:1018)
      at java.lang.Class.getDeclaredMethods0(Native Method)
      at java.lang.Class.privateGetDeclaredMethods(Class.java:2444)
      at java.lang.Class.getMethod0(Class.java:2687)
      at java.lang.Class.getMethod(Class.java:1620)
      at org.apache.catalina.startup.SetPublicIdRule.begin(WebRuleSet.java:639)
      at org.apache.tomcat.util.digester.Digester.startElement(Digester.java:1276)
      ... 33 more
  </code></pre>
  
  <p>Of course <code>kunagi.jar</code> is signed, otherwise it wouldn't even start. It seams Java WebStart enables Java Security globally, which somehow embedded Tomcat "inherits" and fails to initialize.</p>
  
  <p>Here is the JNLP file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;jnlp spec="1.0+" codebase="http://kunagi.org/webstart" href="kunagi.jnlp"&gt;
      &lt;information&gt;
          &lt;title&gt;Kunagi&lt;/title&gt;
          &lt;vendor&gt;Kunagi Team&lt;/vendor&gt;
          &lt;homepage href="http://kunagi.org"/&gt;
          &lt;description&gt;SCRUM Tool&lt;/description&gt;
          &lt;description kind="short"&gt;SCRUM Tool&lt;/description&gt;
          &lt;offline-allowed/&gt;
      &lt;/information&gt;
      &lt;security&gt;
          &lt;all-permissions/&gt;
      &lt;/security&gt;
      &lt;resources&gt;
          &lt;j2se version="1.6+" href="http://java.sun.com/products/autodl/j2se"/&gt;
          &lt;jar href="kunagi.jar" main="true" /&gt;
      &lt;/resources&gt;
      &lt;application-desc name="Kunagi" main-class="katokorbo.Katokorbo"/&gt;
      &lt;update check="always"/&gt;
  &lt;/jnlp&gt;
  </code></pre>
  
  <p>Is there a way to disable security checks for Tomcat inside of Java WebStart? Or how can I configure embedded Tomcat to permit access to <code>org.apache.catalina...</code>?</p>