Java Security

I am trying to set a security property for a portlet deployed in a pluto/tomcat container. The portlet fails with a security permission exception.

This is how I start the jsvc daemon:

jsvc.exec -Djava.security.manager -Djava.security.debug=access -Djava.security.policy=/opt/luminis/webapps/luminis/WEB-INF/config/server.policy

This is how I configured server.policy (eventually I will restrict it to a codebase and more specific permission):

grant {
permission java.security.AllPermission;
};

I have tried several types of permissions, locations of the policy, editing the default security policy, nothing works.

The only thing that worked so far was disabling the security manager. Then the portlet renders with no errors.

Is there a setting that I am missing? Thank you.