When running under a security manager and UseJBossWebLoader=false, the tomcat class loader does not attempt to use the original URL like the jboss UnifiedClassLoader does when creating a CodeSource. The result is that permissions for the jbossweb-tomcat55.sar codebase are not valid for the classes loaded from its nested jars. An example problem that results is that the compilation of jsp pages fails because the jasper classes have a CodeSource under the tmp/deploy directory.

A workaround is to unpack the jasper-compiler.jar and jasper-compiler-jdt.jar inside of the jbossweb-tomcat55.sar directory.