I've set up a really simple app using jboss 4.0, entity beans and hypersonic. I have used the cmproster app in the examples as a template for this. The entity beans work fine when accessed via the web module but my client app can't connect - I get the error

javax.naming.NamingException: Could not dereference object [Root exception is javax.naming.CommunicationException [Root exception is java.lang.ClassNotFoundException: ejb.swm22ejb.ResourceHome (no security manager: RMI class loader disabled)]]

which is referring to this code in the client app

Object resourceObjref = initial.lookup("java:comp/env/ResourceBean");
resourceHome = (ResourceHome) PortableRemoteObject.narrow(resourceObjref, ResourceHome.class);

from googling I see that I may need to use security policy and to set up an rmi SecurityManager but how is this being managed in the cmproster app? I can run the client from that with no errors and pretty sure no special policy is being used - I would certainly like o avoid using a policy if poss, so what am I missing?

TIA