I am getting an IllegalAccessException trying to invoke a public
method on an HttpSession object. I would try to invoke the method in a
regular Servlet and it won't allow reflection permission. Please tell
me how to modify my security settings so I have access to reflection.
The weblogic policy file looks like this:

(BTW, when I call System.getSecurityManager() it returns NULL)

  permission java.util.PropertyPermission "*", "read,write";
  permission javax.xml.parsers.SAXParserFactory "write";
};

//
// Modify the URLs in the two lines below to point to the location of 
// additional classes you want to use with WebLogic Server. These
could
// include classes you develop or third-party classes you want to use.
// You can copy this grant entry and modify the URLs for additional 
// class locations.  
// 
grant codeBase "file:/c:/classes/-" {
  permission java.io.FilePermission "c:${/}classes${/}-",
"read,write,delete,execute";
  permission java.net.SocketPermission "localhost:1-9000",
"connect,accept,listen,resolve";
  permission java.awt.AWTPermission "accessClipboard";
  permission java.awt.AWTPermission "accessEventQueue";
  permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
  permission java.io.SerializablePermission
"enableSubclassImplementation";
  permission java.io.SerializablePermission "enableSubstitution";
  permission java.lang.RuntimePermission "accessClassInPackage.*";
  permission java.lang.RuntimePermission "accessDeclaredMembers.*";
  permission java.lang.RuntimePermission "createClassLoader";
  permission java.lang.RuntimePermission "createSecurityManager";
  permission java.lang.RuntimePermission "defineClassInPackage.*";
  permission java.lang.RuntimePermission "exitVM";
  permission java.lang.RuntimePermission "getClassLoader";
  permission java.lang.RuntimePermission "createClassLoader";
  permission java.lang.RuntimePermission "getProtectionDomain";
  permission java.lang.RuntimePermission "loadLibrary.*";
  permission java.lang.RuntimePermission "modifyThread";
  permission java.lang.RuntimePermission "modifyThreadGroup";
  permission java.lang.RuntimePermission "readFileDescriptor";
  permission java.lang.RuntimePermission "setContextClassLoader";
  permission java.lang.RuntimePermission "setFactory";
  permission java.lang.RuntimePermission "setIO";
  permission java.lang.RuntimePermission "setProtectionDomain";
  permission java.lang.RuntimePermission "setSecurityManager";
  permission java.lang.RuntimePermission "writeFileDescriptor";
  permission java.lang.reflect.ReflectPermission
"suppressAccessChecks";
  permission java.net.NetPermission "requestPasswordAuthentication";
  permission java.net.NetPermission "setDefaultAuthenticator";
  permission java.security.SecurityPermission "getPolicy";
  permission java.security.SecurityPermission "setPolicy";
  permission java.util.PropertyPermission "*", "read,write";
};


grant codeBase "file:${java.home}/lib/ext/-" {
	permission java.security.AllPermission;
};

grant { 
  // Permission "enableSubstitution" needed to run the WebLogic
console
  permission java.io.SerializablePermission "enableSubstitution";
  // Permission "modifyThreadGroup" required to run the WebLogic
Server
  permission java.lang.RuntimePermission "modifyThreadGroup";
  permission java.lang.RuntimePermission "setContextClassLoader"; 
  // Permission "setIO" needed to start a server from the WebLogic
console
  permission java.lang.RuntimePermission "setIO";
  // Permission "getClassLoader" needed for many EJB clients
  permission java.lang.RuntimePermission "getClassLoader";

  permission java.lang.RuntimePermission "stopThread";
  permission java.net.SocketPermission "localhost:1024-", "listen";
  permission java.util.PropertyPermission "java.version", "read";
  permission java.util.PropertyPermission "java.vendor", "read";
  permission java.util.PropertyPermission "java.vendor.url", "read";
  permission java.util.PropertyPermission "java.class.version",
"read";
  permission java.util.PropertyPermission "os.name", "read";
  permission java.util.PropertyPermission "os.version", "read";
  permission java.util.PropertyPermission "os.arch", "read";
  permission java.util.PropertyPermission "file.separator", "read";
  permission java.util.PropertyPermission "path.separator", "read";
  permission java.util.PropertyPermission "line.separator", "read";
  permission java.util.PropertyPermission
"java.specification.version", "read";
  permission java.util.PropertyPermission "java.specification.vendor",
"read";
  permission java.util.PropertyPermission "java.specification.name",
"read";
  permission java.util.PropertyPermission
"java.vm.specification.version", "read";
  permission java.util.PropertyPermission
"java.vm.specification.vendor", "read";
  permission java.util.PropertyPermission
"java.vm.specification.name", "read";
  permission java.util.PropertyPermission "java.vm.version", "read";
  permission java.util.PropertyPermission "java.vm.vendor", "read";
  permission java.util.PropertyPermission "java.vm.name", "read";
};

Ranger wrote:

> I am getting an IllegalAccessException trying to invoke a public
> method on an HttpSession object. I would try to invoke the method in a
> regular Servlet and it won't allow reflection permission. 

Your code would help.

Are you using session.getClass().getMethod() ? Then you get your hands on 
the method of the (probably) non-public Session implementation class. 
Rather use Http.Session.class.getMethod().

Also, do you use #setAccessible(true) ? Shouldn't matter with public 
methods, though.

Matthias
-- 
Matthias Ernst
Software Engineer

CoreMedia - Smart Content Technology

Matthias Ernst <matthias.ernst@coremedia.com> wrote in message news:<bgb97r$mq73m$1@ID-133822.news.uni-berlin.de>...
> Ranger wrote:
> 
> > I am getting an IllegalAccessException trying to invoke a public
> > method on an HttpSession object. I would try to invoke the method in a
> > regular Servlet and it won't allow reflection permission. 
> 
> Your code would help.
> 
> Are you using session.getClass().getMethod() ? Then you get your hands on 
> the method of the (probably) non-public Session implementation class. 
> Rather use Http.Session.class.getMethod().
> 
> Also, do you use #setAccessible(true) ? Shouldn't matter with public 
> methods, though.
> 
> Matthias

Matthias, 

You're absolutely right. I was calling getMethod on the actual class
implementing HttpSession, which was probably some class the vendor
made private. I followed your advice and used
HttpSession.class.getMethod() and it works as intended. Many thanks
for your time!