Please see the attached test case (build the server first, then the client). You'll have to adjust the Rules files as necessary to pick up your own rip-int.

In the Java to IDL spec, the IDL mapping for a parameter or return type of java.lang.Object is ::java::lang::_Object. Similar mappings exist for java.io.Serializable and Externalizable.

Valid IDL which in the test is generated from rmic -idl might be

    interface Tester {
    
        readonly attribute ::java::lang::_Object _object;
    
    };

That leads to the following class on the IDL client side if using Java:

java/lang/_ObjectHelper

and the client stub for Tester:

...
  public org.omg.CORBA.Any _object ()
  {
    org.omg.CORBA.portable.InputStream $in = null;
    try {
       org.omg.CORBA.portable.OutputStream $out = _request ("_get_object", true);
       $in = _invoke ($out);
       org.omg.CORBA.Any $result = java.lang._ObjectHelper.read ($in);

However, J2SE throws a SecurityException at runtime when loading the java.lang._ObjectHelper class since it's in java.lang.

See the suggested fix.