Managing java policies

HCL Domino Domino Forum
1

Domino/Notes Version: Domino R14.5.1
Add-on Product (if appropriate, e.g. Verse / Traveler / Nomad / Domino REST API):
Its Version:
Operating System: Linux Alma 10
Client (Notes, Nomad Web, Nomad Mobile, Android/iOS, browser version):

Hi,

I have a Java agent that sends Firebase Cloud messages.

The agent runs in background on the Domino server (R14.5.1 Linux Alma 10), it includes the following jar files:

api-common-2.65.0.jar
failureaccess-1.0.3.jar
firebase-admin-9.10.0.jar
google-api-client-2.7.2.jar
google-auth-library-credentials-1.39.1.jar
google-auth-library-credentials-1.48.0.jar
google-auth-library-oauth2-http-1.48.0.jar
google-http-client-2.1.1.jar
google-http-client-gson-2.1.1.jar
google-http-client-jackson2-2.1.0.jar
grpc-api-1.81.0.jar
gson-2.13.2.jar
guava-33.6.0-jre.jar
httpclient5-5.3.1.jar
httpcore5-5.2.4.jar
httpcore5-h2-5.2.4.jar
jackson-core-2.18.3.jar
opencensus-api-0.31.1.jar
opencensus-contrib-http-util-0.31.1.jar

To let this agent run I had to add the following permissions to the java.policy file on the server:

// default permissions granted to all domains
grant {

[… DEFAULT PERMISSIONS …]

// NEW PERMISSIONS (ADDED):

	permission java.net.NetPermission "getProxySelector";
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.RuntimePermission "getenv.FIREBASE_AUTH_EMULATOR_HOST";
permission java.lang.RuntimePermission "getenv.GOOGLE_CLOUD_UNIVERSE_DOMAIN";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission java.lang.RuntimePermission "getStackWalkerWithClassReference";
permission java.security.AllPermission;

};

probably the last one would be enough but I tried to allow only the necessary ones till I could.

In the java.policy file there is a section:

// Notes java code gets all permissions
grant codeBase “file:${notes.binary}/*” {
permission java.security.AllPermission;
};

that should do the case but it doesn’t.

I wonder why?
How is it possible to allow some or all permissions to a specific agent?
How is it possible to restrict the “permission java.security.AllPermission;” in the section “// default permissions granted to all domains”?

is there a reference about how-to manage java policies in a domino server?

thanks a lot

tommaso

2

Hi Tommaso,

instead of:

grant codeBase “file:${notes.binary}/*” {
permission java.security.AllPermission;
};

you should be doing:

grant {
permission java.security.AllPermission;
};

Some reference for this question:

3

Hi Roberto, that’s what I did. I wonder if it is safe or if it is possible do in a safer way considering that I don’t know which permission is preventing Fire Message to be sent but only this generic error message:

“errorCode=UNKNOWN, message=Unknown error while making a remoterefreshing access token com.google.firebase.messaging.FirebaseMessagingException: Unknown error while making a remote service call: Unexpected error refreshing access token at com.google.firebase.messaging.FirebaseMessagingException.withMessagingError”

thanks

tommaso