AccessControlException using JAAS under 1.4. But it works under 1.3

Question

We're building a client/server Java application using Java 1.3.1_02. Client authentication is done by JAAS. When running client and server under 1.3 everything works fine. Now we want to run our application using 1.4.2_02 (still doing the build with 1.3.1_02). Accoding to Java's backwards compatibility this should be no problem. But there is a problem.
The client logs in via JAAS on the server and gets a javax.security.auth.Subject instance, which is then passed again to the server to get the associated permissions (this is done by an Authenticator class):
        Subject subject = login(startupFrame);
        Authenticator authenticator
                = ProxyFactory.getInstance().getAuthenticator();
        Identity.setPermissions(authenticator.getPermissions());The login itself works, the problem is the call of getPermissions. There's an AuthenticatorImpl class on the server whose getPermissions method is to be called. This class is wrapped by an RMIObjectWrapperImpl class which has an invokeMethod method. This method is called via rmi (client->server) by the client and looks like this:
    public final Serializable invokeMethod(final String name,
                                           final String[] typeNames,
                                           final Serializable[] params,
                                           final Authentication authentication) throws ... {
            final Subject subject = new Subject();
            final Set principals = subject.getPrincipals();
            principals.clear();
            principals.addAll(Arrays.asList(new AuthenticatorImpl()
                    .authenticate(authentication)));
            Policy.getPolicy().refresh();
            return (Serializable) Subject.doAsPrivileged(subject, new PrivilegedExceptionAction() {
                public Object run() throws Exception {
                    try {
                        Object result = theMethod.invoke(delegate, params);
                        return result;
                    } catch (Exception e) {
            }, null);The line ... theMethod.invoke(...) calls the following AuthenticatorImpl.getPermissions() via rmi (server->server).
    public PermissionCollection getPermissions() throws ... {
        AccessControlContext acc = AccessController.getContext();
        Subject s = Subject.getSubject(acc);
        Policy p = Policy.getPolicy();
        return p.getPermissions(s, null);
    }When reaching the method's second line (Subject.getSubject) we obtain a java.security.AccessControlException.
Do you have any ideas what's wrong?
We're using a policy file for client and server, but even if we grant all permissions the problem still exists.
If there's an error why doesn't it occur running under 1.3?
Maybe the reason is that in 1.4 JAAS is a part of the JRE and some methods have become deprecated? (Under 1.3 we are using an external jar file containing an older JAAS version, under 1.4 the built-in JAAS classes are used).
Thanks in advance

Answer 1

It now works using 1.4.
What I did is using Subject.doAs instead of Subject.doAsPrivileged.
I'm a beginner in JAAS: Is it in consideration of security aspects ok to use doAs instead of doAsPrivileged here?
And besides this: Isn't it a bug that the behaviour is different in 1.3 and 1.4?
Thanks