How to allow JAVA Web Start application to access file system on macOS Catalina if it is started by double clicking on JNLP file?

Question

With macOS Catalina we are experiencing the following problem: opening Java Web Start applications behaves differently when application starts by double clicking on JNLP file and when it is started by double clicking on a shortcut installed on a desktop.

In the first case (double click on a downloaded JNLP file) application opens without permissions to access file system - trying to get the directory listing in user's Desktop directory in JAVA code always returns null. There are no prompts presented to the user asking for any permissions to access the file system. This is not an expected behaviour.

In the second case (starting it from desktop shortcut) user is first prompted that application is trying to access the file system and asked for a permission. When user allows application to access files - application reads user's Desktop directory properly. This is the expected behaviour.

Is there a workaround for this? How can we make web start application access file system on Catalina if it is started by double clicking on JNLP file (which is how the application must be started at least for the first time)?

Answer 1

I've run into a similar problem running a legacy .jnlp app. I was able to get around it by simply invoking the application from CLI (iTerm/Terminal/etc.) :

# javaws filename.jnlp

The root cause is that macOS 10.15 (Catalina) now requires non-Apple applications to be specifically granted "Full Disk Access" permission. Check out this and this for details. Using the explanation there, I added /usr/bin/javaws (and other java binaries such as java and appletviewer) to "Full Disk Access", but that didn't resolve the issue.

Based on an older thread, it seems that if the path to the application is not under /Applications/ (in this case, java and javaws are under /System/ and not under /Applications/), then Full Disk Access is not honored. So it's very likely that a fix needs to be provided by Apple to allow running these applications from the UI.