WebSphere Java Security Issue :
<p>5I haven't worked on Websphere earlier and now stuck with the Security Issue.</p>

<ul>
<li>I have deployed a War file in WebSphere. 
Path : C:\IBM\WebSphere\AppServer\profiles\AppSrv01\installedApps\ip-0AC30DDBNode01Cell\DMS_war.ear</li>
<li>From UI, when we click on specific button it loads a JSP file, which in turn tries to read an xml file ( stored in WEB-INF/classes/mcc.xml).</li>
<li>The jsp file is not able to READ the xml file.</li>
</ul>

<p>Please help in how to add the security/permission WebSphere.
Also I'm not sure in which file we have to do this.( app.policy,java.policy,was.policy)</p>

<p>Log</p>

<blockquote>
  <p>com.ibm.ws.webcontainer.servlet.ServletWrapper service SRVE0068E: Uncaught exception created in one of the service methods of the servlet /awc/pcmgr/pcmgr.jsp in application DMS_war. <strong>Exception created : java.security.AccessControlException: Access denied (java.io.FilePermission C:\IBM\WebSphere\AppServer\profiles\AppSrv01\installedApps\ip-0AC30DDBNode01Cell\DMS_war.ear\DMS.war\WEB-INF\classes\mcc.xml read)</strong>
      at java.security.AccessController.checkPermission(AccessController.java:108)
      at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
      at java.lang.SecurityManager.checkRead(SecurityManager.java:871)</p>
</blockquote>

<p>So far I tried everything , heres the latest <strong>was.policy</strong> file. (location : META-INF/)</p>

<pre><code>//
// Template policy file for enterprise application.
// Extra permissions can be added if required by the enterprise application.
//
// NOTE: Syntax errors in the policy files will cause the enterprise application FAIL to start.
//       Extreme care should be taken when editing these policy files. It is advised to use
//       the policytool provided by the JDK for editing the policy files
//       (WAS_HOME/java/jre/bin/policytool). 
//

grant codeBase "file:${application}" {
permission java.security.AllPermission;
};

grant codeBase "file:${jars}" {
};

grant codeBase "file:${connectorComponent}" {
};

grant codeBase "file:${webComponent}" {
};

grant codeBase "file:${ejbComponent}" {
};
</code></pre>

<p><strong>UPDATE</strong> : 
This is how existing code reads XML file</p>

<pre><code>SAXBuilder builder  = new SAXBuilder();
Document   doc      = builder.build(getServletContext().getRealPath("/WEB-INF/classes/mcc.xml")); 
// Use doc to get properties defined in file
</code></pre>

<p>Thanks</p>