AAI thick client fails to load - Application Error: Cannot grant permissions to unsigned jars. Application requested security permissions, but jars are not signed

Products

• Automation Analytics & Intelligence

Issue/Introduction

When launching the AAI thick client on a computer that is using OpenJDK or Amazon Corretto JDK 1.8.362 with Iced Tea Webstart or OpenWebStart, you may see the error below:

"net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. The application has not been initialized, for more information execute javaws from the command line.
 at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:587)
 at net.sourceforge.jnlp.Launcher.launchApplication(Launcher.java:372)
 at net.sourceforge.jnlp.Launcher.access$200(Launcher.java:70)
 at net.sourceforge.jnlp.Launcher$TgThread.run(Launcher.java:654)
Caused by: net.sourceforge.jnlp.LaunchException: Fatal: Application Error: Cannot grant permissions to unsigned jars. Application requested security permissions, but jars are not signed.
 at net.sourceforge.jnlp.runtime.classloader.SecurityDelegateImpl.getClassLoaderSecurity(SecurityDelegateImpl.java:102)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.setSecurity(JNLPClassLoader.java:387)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.initializeResources(JNLPClassLoader.java:773)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.<init>(JNLPClassLoader.java:350)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.createInstance(JNLPClassLoader.java:423)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.getInstance(JNLPClassLoader.java:495)
 at net.sourceforge.jnlp.runtime.classloader.JNLPClassLoader.getInstance(JNLPClassLoader.java:468)
 at net.sourceforge.jnlp.Launcher.createApplication(Launcher.java:579)
 ... 3 more"

 

 

Environment

Release : 6.4.4

Resolution

To workaround this issue, edit the %JAVA_HOME%\jre\lib\security\java.security file, search for "jdk.jar.disabledAlgorithms", there should be two instance of that.

 

You can either comment out the one that is not already commented out like below:

 

More specifically you can edit the %JAVA_HOME%\jre\lib\security\java.security file and just remove "SHA1 denyAfter 2019-01-01" from the line above, and save the file.

 

For example:

Change the line from:

jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
      DSA keySize < 1024, SHA1 denyAfter 2019-01-01, \
      include jdk.disabled.namedCurves

 

To:

jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
      DSA keySize < 1024, include jdk.disabled.namedCurves

 

Once that is saved, attempt to relaunch the AAI thick client.