Skip Headers

# Understanding Security Permissions

Previous

Next

By default, when you run a TopLink-enabled application in a JVM configured with a nondefault `java.lang.SecurityManager`, the TopLink run time executes certain internal functions by executing a `PrivilegedAction` with `java.security.AccessController` method `doPrivileged`. This ensures that you do not need to grant many permissions to TopLink for it to perform its most common operations. You need only grant certain permissions depending on the types of optional TopLink features you use (see "Permissions Required by TopLink Features").

While using `doPrivileged` method provides enhanced security, it will severely impact overall performance. Alternatively, you can configure TopLink to disable the use of `doPrivileged` method even when a nondefault `SecurityManager` is present (see "Disabling doPrivileged Operation"). In this case, you must grant TopLink all required permissions (see "Permissions Required by TopLink Features" and "Permissions Required When doPrivileged is Disabled").

Note: While enabling the use of `doPriviledged` method enhances TopLink application security, it does not guarantee that secure code cannot be called by application code in ways that the system did not intend. You must consider the use of `doPriviledged` method within the context of your overall application security strategy. For more information, see `http://java.sun.com/security/index.jsp`.

If you run a TopLink-enabled application in a JVM without a nondefault `SecurityManager`, you do not need to grant any permissions.