Is the Security Manager enabled?
According to the J2EE 1.4 specification, the Security Manager is not optional. It must be enabled in the Application Server. Since there is no configuration interface that lets you disable the Security Manager, it can only happen by modifying the domain.xml configuration file in such a way that you remove this line: