Remote JMX invocation failed with ClassNotFoundException: ... (no security manager: RMI class loader disabled

Question

I try to invoke the method of MBean from web application from Tomcat. Target MBean is running under JBoss 4.2.3. Both Tomcat and JBoss applications use the same version of jar with the same class, but on invoking I see the following exception:

Caused by: java.lang.ClassNotFoundException: ...thisClass... (no security manager: RMI class loader disabled)
    at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:375)
    at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:165)
    at java.rmi.server.RMIClassLoader$2.loadClass(RMIClassLoader.java:620)
    at org.jboss.system.JBossRMIClassLoader.loadClass(JBossRMIClassLoader.java:91)
    at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:247)
    at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:197)
    at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1575)
    at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1496)
    at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1732)
    at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1329)
    at java.io.ObjectInputStream.readObject(ObjectInputStream.java:351)
    at java.util.ArrayList.readObject(ArrayList.java:593)
    at sun.reflect.GeneratedMethodAccessor164.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:974)
    at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1849)
    at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1753)
    at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1329)
    at java.io.ObjectInputStream.readObject(ObjectInputStream.java:351)
    at java.util.HashMap.readObject(HashMap.java:1030)
    at sun.reflect.GeneratedMethodAccessor163.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:974)
    at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1849)
    at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1753)
    at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1329)
    at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1667)
    at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1323)
    at java.io.ObjectInputStream.readObject(ObjectInputStream.java:351)
    at java.rmi.MarshalledObject.get(MarshalledObject.java:142)
    at javax.management.remote.rmi.RMIConnectionImpl$6.run(RMIConnectionImpl.java:1513)
    ... 20 more

I think that JBoss doesn't use own class but try to download this class from somewhere and fails with "no security manager: RMI class loader disabled". But how to change this behavior to use local already loaded class. Or maybe I mistake in this guess..?

Answer 1

Dynamic class loading with the -Djava.rmi.server.codebase property is rarely actually needed, it's much simpler to just compile the interfaces plus any serialized class implementations into both the client and server.

Read this answer for more details: RMI Question - Where do clients get a definition for remote classes that have not been added to registry?