The admingui is a system app that is deployed as part of domain creation. Its policy is translated into the file generated/policy/admingui/admingui/granted.policy, and it is the policy file that is used during access checking. Changng web.xml will not be sufficient unless you can either redeploy the app, or cause its policy file to be regenerated.
I tried to do the latter in the most obvious way (i.e., by removing the policy file) and that didn't work...so please use policytool to add the grant to granted.policy; at least for now. After I did that, I was able to access the page without authenticating.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=272390