Server.policy seems to be a problem for many libraries.

Question

I'm trying to play around with an app written with DWR and Hibernate, and the server.policy is getting in the way. I understand the reasons for it, but there should be (in my opinion) an easy way for one of two things to happen:
1) Turn off security altogether, assuming that the environment is "trusted." Most of the servers I've worked with that support security have an option for this; see Websphere, for example, which has a checkbox for security to be on or off.
2) Specify security policies in a server log that would relate the the security exception. For example, on a violation, the server might generate a log that says "for the error at 8/28/2005 @ 10:04 a.m., the security policy 'grant { ... }' would fulfill the requirements."
For libraries that rely on their own reflection capabilities, etc., this sort of thing would be drastically useful, moreso than requiring admins to find out exactly where in their filesystems a given jar is deployed so they can fiddle with security settings, hoping they got the right ones (and enough of them.)

Answer 1

For the first part of your post, please see http://docs.sun.com/source/819-0076/jvm.html#wp1031405
Steps copied from the above link --
To disable the security manager:
Go to the JVM Options page of the Admin Console.
For instructions, see Configuring the JVM Options.
On the JVM Options page, remove this option:
-Djava.security.policy
Click Save.
Restart the server.
Hope this helps.