What are EXACT STEPS for giving an applet unrestricted access?

Question

Hello all,
My company has developed a library for Java applications, and it's packaged in a jar file. We recently needed to create an applet to put on our website to demo the library's functionality. However, because it wasn't designed to be used in an applet, we get all kinds of security violations when running it in a web browser (reading system properties, reading Preferences API, reading local files, etc.)
What we want is a really simple way for our potential customers to run this applet and give it permission to do whatever. We're a trustworthy company so they will be willing to accept an applet signed by us. However, they will not be willing (or even know how) to modify security policy files on their local machine.
Can an applet signed by us get these permissions without the end user having to modify their policy file? I tried signing the applet using the techniques from
http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html
but the link may be out-of-date and it didn't work. Frankly I think Sun has failed miserably with regards to applet security - they made it incredibly difficult to do correctly and they provide no documentation on how to do it. Basically every topic in this forum is asking the same question - how do you easily give an applet permission to do what it needs to do?
So here's the question: once and for all, can anyone provide a list of the exact steps necessary to give an applet permissions?

Answer 1

Hello.
"1. Create your code for the applet as usual.
It is not necessary to set any permissions or use security managers in
the code.
2. Install JDK 1.3
Path for use of the following commands: [jdk 1.3 path]\bin\
(commands are keytool, jar, jarsigner)
Password for the keystore is *any* password. Only Sun knows why...
perhaps ;-)
3. Generate key: keytool -genkey -keyalg rsa -alias tstkey
Enter keystore password: *******
What is your first and last name?
[Unknown]: Your Name
What is the name of your organizational unit?
[Unknown]: YourUnit
What is the name of your organization?
[Unknown]: YourOrg
What is the name of your City or Locality?
[Unknown]: YourCity
What is the name of your State or Province?
[Unknown]: YS
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=Your Name, OU=YourUnit, O=YourOrg, L=YourCity, ST=YS, C=US
correct?
[no]: yes
(wait...)
Enter key password for tstkey
(RETURN if same as keystore password):
(press [enter])
4. Export key: keytool -export -alias tstkey -file tstcert.crt
Enter keystore password: *******
Certificate stored in file tstcert.crt
5. Create JAR: jar cvf tst.jar tst.class
Add all classes used in your project by typing the classnames in the
same line.
added manifest
adding: tst.class(in = 849) (out= 536)(deflated 36%)
6. Verify JAR: jar tvf tst.jar
Thu Jul 27 12:58:28 GMT+02:00 2000 META-INF/
68 Thu Jul 27 12:58:28 GMT+02:00 2000 META-INF/MANIFEST.MF
849 Thu Jul 27 12:49:04 GMT+02:00 2000 tst.class
7. Sign JAR: jarsigner tst.jar tstkey
Enter Passphrase for keystore: *******
8. Verifiy Signing: jarsigner -verify -verbose -certs tst.jar
130 Thu Jul 27 13:04:12 GMT+02:00 2000 META-INF/MANIFEST.MF
183 Thu Jul 27 13:04:12 GMT+02:00 2000 META-INF/TSTKEY.SF
920 Thu Jul 27 13:04:12 GMT+02:00 2000 META-INF/TSTKEY.RSA
Thu Jul 27 12:58:28 GMT+02:00 2000 META-INF/
smk 849 Thu Jul 27 12:49:04 GMT+02:00 2000 tst.class
X.509, CN=Your Name, OU=YourUnit, O=YourOrg, L=YourCity, ST=YS, C=US
(tstkey)
s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope
jar verified.
9. Create HTML-File for use of the Applet by the Sun Plugin 1.3
(recommended to use HTML Converter Version 1.3)
10. Place a link to the .crt file (created in step 4) in the HTML-File.
This .crt file has to be opened by the browser and has to be set to
trusted,
as the root CA for testing is not known to the browser. For use with
"real" certificates, this step should not be necessary."
Only one my comment. You should sign all jars that your applet requires.