Hi, I work for Red Hat in the Java team. We have come across a problem with permission resolution for urls using the jar protocol. Please see:
https://bugs.openjdk.java.net/show_bug.cgi?id=100142 for more information, including a standalone test case. Only OpenJDK seems to be affected. Oracle/Sun JDK resolves permissions correctly. Cheers, Deepak