The JSR 160 connectors use the following ProtectionDomain constructor in the
class JMXSubjectDomainCombiner:

public ProtectionDomain(CodeSource codesource,
                        PermissionCollection permissions,
                        ClassLoader classloader,
                        Principal[] principals);

This constructor is used to introduce into the current access control context
a protection domain with a null codesource, a null classloader and the set of
principals contained in the authenticated subject.

This allows to define policies like this one:

Grant user "username" access to the MBeanServer operation "getDomains", i.e.

grant principal javax.management.remote.JMXPrincipal "username" {
    permission javax.management.MBeanPermission "*", "getDomains";
};

The problem is that this ProtectionDomain constructor is not present in J2SE 1.3
so a replacement for this constructor must be found in order to make JSR 160
fully compatible with J2SE 1.3.1.