The JNLP nightmare - a summary

Question

our application has the following preconditions:
* one EAR should work on the lab, the validation and the production environment with no security warnings
* we have to use 2 jnlp files
* we use native libraries
the conclusion we've drawn: this isn't possible with java webstart
reason:
1. the application has to be signed. hence the JNLP has to be signed. the current and only way to do this is to create a file JNLP-INF/APPLICATION.JNLP. and this is not a pattern, it's the actual filename. so if you have a start.jnlp, you still need to call the signed one APPLICATION.JNLP. this eliminates the possibility to have 2 jnlp files, since calling the not-signed-one doesn't even create a warning, but it creates an error message
2. the usage of placeholders like "$$codebase" is impossible since the signed jnlp file and the one from the webserver can never be identical. the binary comparison fails because the one from the webserver has eg the resolved hostname while the signed one of course has the placeholders. you could remove the placeholders by hardcoding the urls, but this eliminates the possibility of using the same ear in lab, val and prod environment.
3. since we have to use native libraries, we need to use the <security><all-permissions/></security> tags. this of course forces a certificate validation and because of the above we run into warnings
question: does anyone know a way to create a securitymanager/policy file which allows access to everything without getting a warning when you download a jnlp file? leave the security concerns aside, the question is if it is possible at all.
hope this might help others to not waste hours and hours of research only to find out that webstart is very limited
Edited by: user8995776 on Oct 1, 2010 4:55 AM

Answer 1

thank you, i know that link, been through it already during research.
and thank you for your consideration. i'd be glad if you find something that we missed. here's the jnlp code:
<?xml version="1.0" encoding="utf-8"?>
<jnlp spec="1.0+" codebase="$$codebase" href="$$name">
  <information>
    <title>Title</title>
    <vendor>Vendor</vendor>
    <homepage href="http://www.homepage.com"/>
    <description>Description</description>
    <description kind="short">[PENDING]</description>
    <icon href="$$codebase/../icons/icon.gif"/>
    <icon kind="splash" href="$$codebase/../icons/welcome.png"/>
    <offline-allowed/>
  </information>
  <security>
    <all-permissions/>
  </security>
  <resources>
    <j2se version="1.5+" java-vm-args="-Xmx300m"/>
    <jar href="myapp.jar"/>
    <jar href="log4j-1.2.15.jar"/>
    <jar href="commons-lang-2.4.jar"/>
    <jar href="commons-cli-1.2.jar"/>
    <jar href="jawin-stubs.jar"/>
    <jar href="jawin.jar"/>
    <jar href="jacob.jar"/>
    <nativelib href="jacob.dll.jar"/>
    <jar href="jbossall-client.jar"/>
    <jar href="swing-layout-1.0.jar"/>
    <jar href="ognl-2.6.7.jar"/>
    <nativelib href="jawin.dll.jar"/>
   </resources>
   <application-desc main-class="com.vendor.MainApp">
    <argument>-param</argument>
    <argument>arg</argument>
  </application-desc>
</jnlp> in addition, here's a related bug:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6653241
and the relevant source code part from java itself:
   private static final String SIGNED_JNLP_ENTRY = "JNLP-INF/APPLICATION.JNLP";
    /** Returns true if the JNLP file is propererly signed - otherwise false
     *  Only applications that request unrestricted access needs to be signed
    static private byte[] getSignedJNLPFile(LaunchDesc ld, boolean forceMain)
    throws IOException, JNLPException  {
        if (ld.getResources() == null) return null;
        JARDesc mainJar = ld.getResources().getMainJar(forceMain);
        if (mainJar == null) return null;
        // Lookup main JAR file in cache - should already have been downloaded
        // at this point
        JarFile jarf = null;
        try {
            // pass in false to JarFile ctor so no verification will be done to
            // minimize performance impact
            jarf = new JarFile(DownloadEngine.getCachedResourceFilePath(
                mainJar.getLocation(), mainJar.getVersion()), false);
            JarEntry sjfe = jarf.getJarEntry(SIGNED_JNLP_ENTRY);
            if (sjfe == null) {
                // Search no case sensitive
                Enumeration allnames = jarf.entries();
                while(allnames.hasMoreElements() && sjfe == null) {
                    JarEntry jfe = (JarEntry)allnames.nextElement();
                    if (jfe.getName().equalsIgnoreCase(SIGNED_JNLP_ENTRY)) {
                        sjfe = jfe;
            // No entry found
            if (sjfe == null) {
                return null;
            // Read contents of signed JNLP file into bytearray
            byte[] signedJnlp = new byte[(int)sjfe.getSize()];
            DataInputStream is = new DataInputStream(jarf.getInputStream(sjfe));
            is.readFully(signedJnlp, 0, (int)sjfe.getSize());
            is.close();
            return signedJnlp;
        } finally {
            if (jarf != null) {
                jarf.close();
    }