java callout access denied for "java.security.SecurityPermission"

When Iam trying to use BouncyCastleProvider package in java callout code

It's giving me the specified error message in java call out. I think it's a permission issue in apigee JVM. But can't resolve.

Could anyone please help me on this issue

Thanks in advance.

JAVA_ERROR access denied ("java.security.SecurityPermission" "insertProvider")
JAVA_STACKTRACE java.security.AccessControlException: access denied ("java.security.SecurityPermission" "insertProvider") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) at java.security.AccessController.checkPermission(AccessController.java:886) at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) at com.apigee.securitypolicy.InternalSecurityManager.checkPermission(InternalSecurityManager.java:85) at java.lang.SecurityManager.checkSecurityAccess(SecurityManager.java:1759) at java.security.Security.checkInsertProvider(Security.java:862) at java.security.Security.insertProviderAt(Security.java:359) at java.security.Security.addProvider(Security.java:403) at com.edge.verifySignature.VerifyDigitalSignature.verifySign(VerifyDigitalSignature.java:68) at com.edge.verifySignature.VerifyDigitalSignature.execute(VerifyDigitalSignature.java:39) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$ClassLoadWrappedExecution.execute(JavaCalloutStepDefinition.java:171) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution$1.run(JavaCalloutStepDefinition.java:246) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution$1.run(JavaCalloutStepDefinition.java:244) at java.security.AccessController.doPrivileged(Native Method) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$SecurityWrappedExecution.execute(JavaCalloutStepDefinition.java:243) at com.apigee.steps.javacallout.JavaCalloutStepDefinition$CallOutWrapper.execute(JavaCalloutStepDefinition.java:102) at com.apigee.messaging.runtime.steps.StepExecution.execute(StepExecution.java:188) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:81) at com.apigee.flow.execution.AbstractAsyncExecutionStrategy$AsyncExecutionTask.call(AbstractAsyncExecutionStrategy.java:48) at com.apigee.threadpool.CallableWrapperForMDCPreservation.call(CallableWrapperForMDCPreservation.java:26) at com.apigee.threadpool.ThreadPoolManager$QueueAwareCallableTask.call(ThreadPoolManager.java:566) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Suppressed: java.security.AccessControlException: access denied ("java.security.SecurityPermission" "insertProvider.BC") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) at java.security.AccessController.checkPermission(AccessController.java:886) at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) at com.apigee.securitypolicy.InternalSecurityManager.checkPermission(InternalSecurityManager.java:85) at java.lang.SecurityManager.checkSecurityAccess(SecurityManager.java:1759) at java.security.Security.checkInsertProvider(Security.java:865) ... 21 more
0 1 452
1 REPLY 1

https://docs.apigee.com/api-platform/reference/java-permission-reference

Some things in Java when building Apigee Java extensions are not available - see the list.

Specifically, you cannot use insertProvider.

I think there's a good examples how to use bouncy castle here:

https://github.com/DinoChiesa/ApigeeEdge-CustomPolicy-RsaCrypto/blob/47b833e0ce8efca0e23558da619887d...

and here

https://github.com/yuriylesyuk/eidas-x509-for-psd2/blob/master/eidas-certificate-parser/src/main/jav...