In order to run the tests with the security manager, one needs to provide -Dsecurity.manager on the command line. This trigger a profile named ts.security.manager which sets the -secmgr flag to the jboss.args property in maven.

This property with the flag then needs to be used when booting the server which is controlled by arquillian.xml using the following line:

<property name="jbossArguments">${jboss.args}</property>

None of the MP TCKs with the exception is doing that and thus tests are never run with the security manager with the exception of modules that I have set up which are MP FT TCKs and our all encompassing 'microprofile' module where this was done correctly with the initial implementation.

While some require minimal changes, some require more work. For that reason I will be creating issue per MP component.