title: Spring and Hibernate 4 not working with Tomcat 6 security enabled
body: <p>Spring and Hibernate 4 application is deployed and run successfully on Tomcat 6. But, when starting Tomcat 6 with a security manager by below command:</p>
  
  <pre><code>apache-tomcat-6.0.35\bin&gt;catalina start -security
  </code></pre>
  
  <p>Tomcat 6 throws AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)</p>
  
  <p>One solution could be to change catalina.policy permissions. But my app is deployed on 3rd party Tomcat 6 server and don't have rights to change catalina.policy.</p>
  
  <p>Spring-Hibernate 4 integration code:</p>
  
  <pre><code>    &lt;bean id="sessionFactory"
      class="org.springframework.orm.hibernate4.LocalSessionFactoryBean"
      p:dataSource-ref="dataSource" p:configLocation="${hibernate.config}"
      p:packagesToScan="com.vikas.domain" p:namingStrategy-ref="namingStrategy" /&gt;
  
  &lt;tx:annotation-driven transaction-manager="transactionManager" /&gt;
  
  &lt;bean id="transactionManager"
      class="org.springframework.orm.hibernate4.HibernateTransactionManager"
      p:sessionFactory-ref="sessionFactory" /&gt;
  </code></pre>
  
  <p>Please find below error stacktrace on running with security manager:</p>
  
  <pre><code>org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'sessionFactory' defined in ServletContext resource [/WEB-INF/spring/db-config.xml]: Invocation of init method failed; nested exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1482)
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:521)
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458)
  at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:295)
  at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223)
  at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:292)
  at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
  at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:912)
  at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:855)
  at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:770)
  at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:486)
  ... 42 more
  Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)
      at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
      at java.security.AccessController.checkPermission(AccessController.java:546)
      at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
      at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java:594)
      at java.lang.ClassLoader.&lt;init&gt;(ClassLoader.java:202)
      at org.hibernate.service.classloading.internal.ClassLoaderServiceImpl$AggregatedClassLoader.&lt;init&gt;(ClassLoaderServiceImpl.java:246)
      at org.hibernate.service.classloading.internal.ClassLoaderServiceImpl$AggregatedClassLoader.&lt;init&gt;(ClassLoaderServiceImpl.java:242)
      at org.hibernate.service.classloading.internal.ClassLoaderServiceImpl.&lt;init&gt;(ClassLoaderServiceImpl.java:95)
      at org.hibernate.service.classloading.internal.ClassLoaderServiceImpl.&lt;init&gt;(ClassLoaderServiceImpl.java:61)
      at org.hibernate.service.classloading.internal.ClassLoaderServiceImpl.&lt;init&gt;(ClassLoaderServiceImpl.java:57)
      at org.hibernate.service.internal.BootstrapServiceRegistryImpl.&lt;init&gt;(BootstrapServiceRegistryImpl.java:57)
      at org.hibernate.service.ServiceRegistryBuilder.&lt;init&gt;(ServiceRegistryBuilder.java:76)
      at org.hibernate.cfg.Configuration.buildSessionFactory(Configuration.java:1846)
      at org.springframework.orm.hibernate4.LocalSessionFactoryBuilder.buildSessionFactory(LocalSessionFactoryBuilder.java:247)
      at org.springframework.orm.hibernate4.LocalSessionFactoryBean.buildSessionFactory(LocalSessionFactoryBean.java:373)
      at org.springframework.orm.hibernate4.LocalSessionFactoryBean.afterPropertiesSet(LocalSessionFactoryBean.java:358)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$6.run(AbstractAutowireCapableBeanFactory.java:1531)
      at java.security.AccessController.doPrivileged(Native Method)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1529)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1479)
  </code></pre>
  
  <p>How could I fix the exception without changing catalina.policy or any other Tomcat server changes?</p>