The use of SecurityManager has long been a challenging prospect due
in part to the configuration complexities involved with granting permissions.
In order to ensure that permission grant requests will be properly enforceable within the runtime, the
Java EE platform specification must ensure that all EE components/technologies are capable of running
with SecurityManager enabled. This will be communicated in terms of CTS compliance requirements
for passing of all test suites with SecurityManager enabled.
Continued improvement in SecurityManager useability will facilitate a more secure platform for Java
EE applications in the cloud and in the enterprise.
In order to achieve portable application deployments across multiple EE 7 based platforms, we
need to begin to address some of the challenges for SecurityManager use.
One area in which the challenges of configuring SecurityManager and application portability
overlap is in the communication and configuration of additional permissions required or desired by a
Some applications will want to request permissions that are beyond those granted to all applications by
By standardizing the way in which applications communicate their desire for specific permissions, we
have an opportunity to simplify the configuration process for implicitly granting permissions to the