Adding Permissions to the Java Policy File

The Presentation Client requires more privileges to access your system than are normally given to an applet running in a browser. For the Presentation Client to function correctly in a browser, you must grant it one extra permission in your Java Policy file, without which the tabbing functionality does not work correctly on some forms.

The java.policy file is installed on each user's machine by the Java Plugin. There are several ways to update the policy file:

The name of the policy file is java.policy and is normally located in the {java.home}\lib\security directory, where {java.home} refers to the directory into which the JDK or JRE is installed.

Note: java.home refers to the value of the system property named "java.home", which specifies the directory into which the JDK was installed.

The system policy file is meant to grant system-wide code permissions. The java.policy file installed with the JDK grants all permissions to standard extensions, allows anyone to listen on unprivileged ports, and allows any code to read the "standard" properties that are not security-sensitive, such as the "os.name" and "file.separator" properties.

The user policy file is by default located at:

user.home/.java.policy (Solaris)
user.home\.java.policy (Windows)

Note: user.home refers to the value of the system property named "user.home", which specifies the user's home directory.

There is a tool 'Policytool' supplied with the Java Plugin. It is suggested that you run this program to update the policy files. First run the Policytool.exe from the bin directory. By default, it tries to load the user.home\.java.policy file. If this does not exist, an error appears.

If you do not have a user.home\.java.policy file, perform the following:

  1. Dismiss the error message.

  2. Select File > Open > browse to your java.home\lib\security\java.policy file, and open it.

  3. Double-click the 'CodeBase <ALL>' entry in the list.

    A dialog box is displayed.

  4. Click Add Permission.

    A dialog box is displayed.

  5. Select AWTPermission from the Permission list box.

    This writes 'java.awt.AWT Permission' to the right-hand column.

  6. Enter 'replaceKeyboardFocusManager' in the field below.

    It is not possible to select this Permission.

  7. Click OK.

  8. Click Done.

  9. Select File > Save to save the changes.

The required permission to be added is called “replaceKeyboardFocusManager”. At a minimum, the entry to the policy file should be:

grant {permission java.awt.AWTPermission "replaceKeyboardFocusManager";};

It is recommended that a “codeBase” declaration be added to make the permission more specific to your site and the Component Enabler files. For example, the following statement grants the required permission only to files that reside in the PresentationClient virtual directory on the server named MyServer:

grant codeBase "http://MyServer/PresentationClient" {permission
java.awt.AWTPermission "replaceKeyboardFocusManager";};

If the value of the <enable> sub node beneath the <attRecord> node is 'true', the Presentation Client sends transaction data to the Automated Test Tool for recording. In this case, the following permissions must also be added to the Java policy file:

grant {
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.RuntimePermission "getenv.*";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};

Once the policy file is updated and saved, tabbing functions correctly on all forms when running the Presentation Client in a browser.