SubjectDomainCombiner has compatibility support for javax.security.auth.Policy in its combineJavaxPolicy method.

The implementation of this method, however, constructs new ProtectionDomains using the 2-arg constructor, which results in a static permission collection that does not consult Policy. In other words, the sole permissions granted to the ProtectionDomain are those in the ProtectionDomain instance itself (Policy is not consulted).

The implementation should construct new ProtectionDomains using the 4-arg constructor. This allows dynamic permissions (from Policy) to be granted to the ProtectionDomain instance.