Help with which permissions to go into policy file

Question

I posted this question in Java Web Start & JNLP forum, but realize it may be more appropriate here.
I am writing my first policy file. I am trying to devise a "system" whereby the users/developers within my organization can use Java Web Start to access each other's applications from our intranet. Previously we were either copying the applications and running them locally or else mapping network drives, but they were running from command line (with no sandbox issues?) either way.
The application that I am testing Java Web Start with tries to make a database connection. Even with my jarfile signed and my application requesting "all-permissions" and the user granting the permission when prompted, the database connection was always failing. I started looking into the solution of having each user (within my organization) append some "grants" into their user policy file.
Since these users have already been "trusting" each other's programs enough to run them from the command line, they wouldn't mind an "automatically" having the same level of trust via JWS. But I don't know enough about permissions to know how to specify the correct permissions and know that I am not dangerously widening the permissions.
How do I write grant clauses into a policy file that say "anything run from our intranet web server can do anything a command-line program could do" ? I tried this:
grant codeBase "http://our_intranet_webserver/-" {
  permission java.security.AllPermission;
};...but the database connection still fails. But when I add this:
grant codeBase "file:/C:/Program Files/Java Web Start/-"{
  permission java.net.SocketPermission "*", "connect";
(the codebase would refer to the local Java Web Start program itself)...the database connection succeeds. (When I replace SocketPermission with AllPermission, the connection fails. I don't understand that.) BUT if I go granting general permissions to Java Web Start, wouldn't that grant apply to every Java-Web-Start-deployed application on the Web, not just our stuff?
Thanks for any help or advice on the matter,
/Mel

Answer 1

(When I replace SocketPermission with AllPermission, the connection fails. I don't
understand that.) This problem is solved. It is not true. I currently have a policy file that says:
grant codeBase "http://our_intranet_webserver/-" {
  permission java.security.AllPermission;
grant codeBase "file:/C:/Program Files/Java Web Start/-"{
  permission java.security.AllPermission;
};and the db connection does not fail. If I remove the first grant clause, leaving only AllPermissions to Java Web Start, the db connection does not fail.
BUT if I go granting general permissions to Java Web Start, wouldn't that grant apply to
every Java-Web-Start-deployed application on the Web, not just our stuff?This is still my problem. Why should I have to grant Java Web Start permissions (regardless of all or some) when I only want to grant them to a subset of codebases from which Java Web Start can run programs (specifically our intranet webserver)? I think this question has gone back to being more appropriate for the JWS Forum.
Thank you,
/Mel