IBM Support

"Java has discovered application components that could indicate a security concern" when accessing stlinks

Technote (troubleshooting)


Problem

When accessing any application that embeds stlinks, such as iNotes, Quickr, or Portal, the warning "Java has discovered application components that could indicate a security concern" pops up.



Clicking "No" will allow the applet to load. "Yes" will block the applet from running.


Cause

A change in the Java security model starting in 1.6.0_19 will warn the user if there is a mix of code when loading an applet (this is true of Sametime or any other product utilizing mixed code).

See http://www.java.com/en/download/help/error_mixedcode.xml for more information on the security changes.

When the stlinks applet loads there are two pieces of content that are loading, the stlinks.jar and the DebugLevel.class file. In a default install the stlinks.jar file is unsigned and the warning will not appear. However if the unsigned jar has been replaced with the signed stlinks.jar, Java will pop up the warning, since DebugLevel.class is not signed and the stlinks.jar is signed this meets the mixed code condition.


Resolving the problem

In the stlinks folder rename the file DebugLevel.class to DebugLevel.class.1 to prevent it from loading. The debug provided by DebugLevel.class is not necessary unless diagnosing problems with stlinks. If debug is later required this file can be renamed back to DebugLevel.class while troubleshooting, and back again when done troubleshooting to prevent the warning.


The signed stlinks.jar file is necessary in certain cases so reverting to the unsigned file is not recommended unless you are sure you do not need it.

Alternatively you can modify the security feature from the Java Control Panel from within Windows Control Panel.



Changing this value to "Enable - hide warning and run with protections" will prevent the warning from coming up and load as if the user had clicked "No" to the message.

Another workaround is to downgrade to an earlier release of Java.

In some cases it has been found that you still must delete your Java cache to remove the cached debugLevel.class file.

Win XP:

Go under Control Panel -> Java -> Settings -> View Applets

Delete the DebugLevel.class that exists there.

Win 7:

Go under Control Panel -> Java Control Panel -> General -> Temporary Internet Files -> View

Delete the DebugLevel.class that exists there.

Document information

More support for: Lotus End of Support Products
IBM Sametime

Software version: 7.0, 7.5, 7.5.1, 8.0, 8.5

Operating system(s): Windows

Software edition: Entry, Standard

Reference #: 1428715

Modified date: 22 August 2017