grant {
  permission java.lang.RuntimePermission "setFactory";

  // ApacheXMLSecurityInitializer
  permission java.util.PropertyPermission "org.apache.xml.security.ignoreLineBreaks", "read,write";

  // needed during initialization of OpenSAML library where xml security algorithms are registered
  // see https://github.com/apache/santuario-java/blob/e79f1fe4192de73a975bc7246aee58ed0703343d/src/main/java/org/apache/xml/security/utils/JavaUtils.java#L205-L220
  // and https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureMarshaller.java;hb=db0eaa64210f0e32d359cd6c57bedd57902bf811#l52
  // which uses it in the opensaml-xmlsec-impl
  permission java.security.SecurityPermission "org.apache.xml.security.register";

  // needed for multiple server implementations used in tests
  permission java.net.SocketPermission "*", "accept,connect";
};