TomEE 1.6.0.2 won't start with security enabled - security

Question

It doesn’t look to me like TomEE+ 1.6.0.2 wiil start with the -security command line option. As a sanity check, I’ve downloaded a clean release and it too fails early in the bootstrap process with the following:
INFO: Creating SecurityService(id=Tomcat Security Service)
java.lang.ClassCircularityError: javax/security/jacc/PolicyContext
at org.apache.openejb.core.security.jacc.BasicJaccProvider.implies(BasicJaccProvider.java:75)
at org.apache.openejb.core.security.JaccProvider$Policy.implies(JaccProvider.java:126)
at java.security.ProtectionDomain.implies(ProtectionDomain.java:272)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:435)
at java.security.AccessController.checkPermission(AccessController.java:884)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.Thread.setContextClassLoader(Thread.java:1467)
at org.apache.openejb.log.LoggerCreator$Get.exec(LoggerCreator.java:87)
at org.apache.openejb.log.LoggerCreator$Get.exec(LoggerCreator.java:98)
at org.apache.openejb.util.JuliLogStream.isFatalEnabled(JuliLogStream.java:37)
at org.apache.openejb.util.Logger.isFatalEnabled(Logger.java:380)
at org.apache.openejb.util.Logger.fatal(Logger.java:530)
at org.apache.openejb.OpenEJB$Instance.<init>(OpenEJB.java:156)
at org.apache.openejb.OpenEJB.init(OpenEJB.java:298)
at org.apache.tomee.catalina.TomcatLoader.initialize(TomcatLoader.java:253)
at org.apache.tomee.catalina.ServerListener.install(ServerListener.java:168)
at org.apache.tomee.catalina.ServerListener.lifecycleEvent(ServerListener.java:55)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:402)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:110)
at org.apache.catalina.startup.Catalina.load(Catalina.java:638)
at org.apache.catalina.startup.Catalina.load(Catalina.java:663)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:483)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:280)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:454)
Is there a configuration issue? What’s the fix?
For context, I’m trying to run in secure mode because I need to retrieve the client certificate on an APR TLS 1.2 connector and it looks like the certificate isn’t provided unless you are running with SecurityManager enabled. Right now getAttribute(“javax.servlet.request.X509Certificate”) return null (yes, I definitely have clientAuth=“required” in server.xml).
For reference, here is the connector from server.xml:
<Connector port="4449" protocol="org.apache.coyote.http11.Http11AprProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="true" sslProtocol="TLSv1.2"
SSLCertificateFile="/etc/unipagos/certs/pay.crt"
SSLCertificateKeyFile="/etc/unipagos/certs/pay.key"
SSLVerifyClient="required"
SSLHonorCipherOrder="true"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"/>
If you know of a way to get the client certificate that works without enabling the SecurityManager, please let me know. This issue is actually blocking a production release.