get method of ModuleClassLoaderLocator requires createClassLoader permission

It can be reproduced with following test: 1) Create properties file for authentication, /PATH/TO/users.properties: jduke=password /PATH/TO/roles.properties: jduke=Admin 2) Run LDAP server on port 10389 with ldif: dn: ou=People,dc=jboss,dc=org objectclass: top objectclass: organizationalUnit ou: People dn: uid=jduke,ou=People,dc=jboss,dc=org objectclass: top objectclass: person objectclass: inetOrgPerson uid: jduke cn: Java Duke sn: Duke employeeNumber: 123456789 userPassword: Password1 3) Configure following security domain in AS: <security-domain name= "LdapAttributeMappingProviderBasic" > <authentication> <login-module code= "UsersRoles" flag= "required" > <module-option name= "rolesProperties" value= "/PATH/TO/roles.properties" /> <module-option name= "usersProperties" value= "/PATH/TO/users.properties" /> </login-module> </authentication> <mapping> <mapping-module code= "LdapAttributes" type= "attribute" > <module-option name= "bindDN" value= "uid=admin,ou=system" /> <module-option name= "bindCredential" value= "secret" /> <module-option name= "baseCtxDN" value= "ou=People,dc=jboss,dc=org" /> <module-option name= "attributeList" value= "sn,employeenumber,description" /> <module-option name= "java.naming.provider.url" value= "ldap: //localhost:10389" /> <module-option name= "baseFilter" value= "uid={0}" /> </mapping-module> </mapping> </security-domain> 4) Start application server with security manager 5) Deploy testing application, see attachment 6) Access http://127.0.0.1:8080/jbeap10878/protected/LdapAttributeMappingProviderServlet?securityDomain=LdapAttributeMappingProviderBasic with user jduke and password password -> Exception is thrown 7) Add permission to META-INF/permissions.xml in testing deployment and access application again