Java security in XPages

Once you push the boundaries of XPages (which are very elastic) you sooner or later will run into Java security. The Java security settings live in the file
[notes program]/jvm/lib/security/java.policy. The text file (don't edit it in Symphony, use gEdit or Notepad) defines a series of grant codebase "somelocation" { Java Permission } entries that govern what code located at a specific location is allowed to do and what not. The general rule: it must be allowed, otherwise it is forbidden. The basis entry grant { ... } defines what all Java classes can do. You definitely want to be very stingy here. Lazy developers (like me) add to this file:
grant { permission java.security.AllPermission; };
... which is of course a big No No for a production environment (but a big Yes Yes for a productive dev environment - waiting for the howls). When you are ready to deploy your Java infested enhanced nsf, you need to update the java.policy file on your target machine (waiting for another howl) - unless you were smart and packaged your Java into an extension library which has the right level of security and is easy to deploy). The syntax is easy (but not necessarily logical for us mere mortals):
grant codeBase "xspnsf://server:0/yourdatabase.nsf/-" {
permission java.security.AllPermission;
};
Jim clarifies: you only need to change yourdatabase.nsf, the other parts are static, directory separators are / regardless of platform, the location is relative to the data directory and the whole codeBase value must be lower case (regardless of your file names). Of course you can limit the permission to what you actually need. Finding out what that is when you use ready baked libraries can be a little tedious and warrants its own future post.