diff --git a/src/test/script/openejb/tck/commands/JavaTestCommand.groovy b/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
index 1b698dc..17e5fff 100644
--- a/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
+++ b/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
@@ -239,8 +239,8 @@
                     log.info("Enabling server security manager")
 
                     // -Djava.security.properties=conf/security.properties
-                    containerJavaOpts += "-Djava.security.manager " +
-                            "-Djava.security.policy==${project.basedir}/${openejbHome}/conf/catalina.policy " +
+                    containerJavaOpts += " -Djava.security.manager -Dcts.home=${javaeeCtsHome} -Djava.security.debug=none " +
+                            "-Djava.security.policy=${project.basedir}/${openejbHome}/conf/catalina.policy " +
                             "-Djava.security.properties=${project.basedir}/${openejbHome}/conf/security.properties"
                 }
                 if (options.contains('websocket')) {
diff --git a/src/test/tomee-plume/conf/ProviderConfiguration.xml b/src/test/tomee-plume/conf/ProviderConfiguration.xml
index ff72155..e21cbff 100644
--- a/src/test/tomee-plume/conf/ProviderConfiguration.xml
+++ b/src/test/tomee-plume/conf/ProviderConfiguration.xml
@@ -18,47 +18,47 @@
 -->
 
 <provider-config
-     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-     xmlns="http://java.oracle.com/xml/ns/jaspic"
-     xsi:schemaLocation="http://java.oracle.com/xml/ns/jaspic provider-configuration.xsd">
-   <provider-config-entry>
-        <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProvider</provider-class>
-        <properties version="1.0">
-            <entry key="AuthStatus_SEND_SUCCESS">false</entry>
-            <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
-        </properties>
-        <message-layer>SOAP</message-layer>
-        <app-context-id>null</app-context-id>
-        <reg-description>TestSuite JSR 196 Config Provider</reg-description>
-    </provider-config-entry>
-   <provider-config-entry>
-        <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProvider</provider-class>
-        <properties version="1.0">
-            <entry key="AuthStatus_SEND_SUCCESS">false</entry>
-            <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
-        </properties>
-        <message-layer>SOAP</message-layer>
-        <app-context-id>Catalina/localhost /Hello_web/Hello</app-context-id>
-        <reg-description>TestSuite JSR 196 Config Provider</reg-description>
-    </provider-config-entry>
-    <provider-config-entry>
-        <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProviderServlet</provider-class>
-        <properties version="1.0">
-            <entry key="AuthStatus_SEND_SUCCESS">true</entry>
-            <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
-        </properties>
-        <message-layer>HttpServlet</message-layer>
-        <app-context-id>Catalina/localhost /spitests_servlet_web</app-context-id>
-        <reg-description>Registration for TSAuthConfigProviderServlet using spitests_servlet_web</reg-description>
-    </provider-config-entry>
-    <provider-config-entry>
-        <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProviderServlet</provider-class>
-        <properties version="1.0">
-            <entry key="AuthStatus_SEND_SUCCESS">true</entry>
-            <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
-        </properties>
-        <message-layer>HttpServlet</message-layer>
-        <app-context-id>Catalina/localhost /spitests_servlet_web/WrapperServlet</app-context-id>
-        <reg-description>Registration for TSAuthConfigProviderServlet using spitests_servlet_web</reg-description>
-    </provider-config-entry>
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xmlns="http://java.oracle.com/xml/ns/jaspic"
+  xsi:schemaLocation="http://java.oracle.com/xml/ns/jaspic provider-configuration.xsd">
+  <provider-config-entry>
+    <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProvider</provider-class>
+    <properties version="1.0">
+      <entry key="AuthStatus_SEND_SUCCESS">false</entry>
+      <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
+    </properties>
+    <message-layer>SOAP</message-layer>
+    <app-context-id>null</app-context-id>
+    <reg-description>TestSuite JSR 196 Config Provider</reg-description>
+  </provider-config-entry>
+  <provider-config-entry>
+    <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProvider</provider-class>
+    <properties version="1.0">
+      <entry key="AuthStatus_SEND_SUCCESS">false</entry>
+      <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
+    </properties>
+    <message-layer>SOAP</message-layer>
+    <app-context-id>Catalina/localhost /Hello_web/Hello</app-context-id>
+    <reg-description>TestSuite JSR 196 Config Provider</reg-description>
+  </provider-config-entry>
+  <provider-config-entry>
+    <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProviderServlet</provider-class>
+    <properties version="1.0">
+      <entry key="AuthStatus_SEND_SUCCESS">true</entry>
+      <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
+    </properties>
+    <message-layer>HttpServlet</message-layer>
+    <app-context-id>Catalina/localhost /spitests_servlet_web</app-context-id>
+    <reg-description>Registration for TSAuthConfigProviderServlet using spitests_servlet_web</reg-description>
+  </provider-config-entry>
+  <provider-config-entry>
+    <provider-class>com.sun.ts.tests.jaspic.tssv.config.TSAuthConfigProviderServlet</provider-class>
+    <properties version="1.0">
+      <entry key="AuthStatus_SEND_SUCCESS">true</entry>
+      <entry key="requestPolicy">USER_NAME_PASSWORD</entry>
+    </properties>
+    <message-layer>HttpServlet</message-layer>
+    <app-context-id>Catalina/localhost /spitests_servlet_web/WrapperServlet</app-context-id>
+    <reg-description>Registration for TSAuthConfigProviderServlet using spitests_servlet_web</reg-description>
+  </provider-config-entry>
 </provider-config>
diff --git a/src/test/tomee-plume/conf/catalina.policy b/src/test/tomee-plume/conf/catalina.policy
index c18010f..4fb8777 100644
--- a/src/test/tomee-plume/conf/catalina.policy
+++ b/src/test/tomee-plume/conf/catalina.policy
@@ -62,8 +62,8 @@
 // These permissions apply to the logging API
 // Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
 // update this section accordingly.
-//  grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
-grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
+grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {
+// grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         permission java.io.FilePermission
          "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
 
@@ -90,6 +90,10 @@
         permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
         permission java.util.PropertyPermission "catalina.base", "read";
 
+        // TomEE specific
+        permission java.util.PropertyPermission "tomee.*", "read";
+
+
         // Note: To enable per context logging configuration, permit read access to
         // the appropriate file. Be sure that the logging configuration is
         // secure before enabling such access.
@@ -115,9 +119,14 @@
 
 // If using a per instance lib directory, i.e. ${catalina.base}/lib,
 // then the following permission will need to be uncommented
-// grant codeBase "file:${catalina.base}/lib/-" {
-//         permission java.security.AllPermission;
-// };
+grant codeBase "file:${catalina.base}/lib/-" {
+        permission java.security.AllPermission;
+};
+
+// TomEE webapp for deployment
+grant codeBase "file:${catalina.base}/webapps/tomee/-" {
+    permission java.security.AllPermission;
+};
 
 
 // ========== WEB APPLICATION PERMISSIONS =====================================
@@ -157,6 +166,27 @@
     permission java.util.PropertyPermission "java.vm.vendor", "read";
     permission java.util.PropertyPermission "java.vm.name", "read";
 
+    // TomEE
+    permission java.util.PropertyPermission "tomee.*", "read";
+    permission java.util.PropertyPermission "openejb.*", "read";
+    permission java.util.PropertyPermission "user.name", "read";
+    permission java.util.PropertyPermission "java.io.tmpdir", "read";
+    permission java.io.FilePermission "${catalina.base}/lib/-", "read"; // java ee api class, slf4j, owb, etc
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.loader"; // tomee
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.core"; // tomee
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.realm"; // tomee
+    permission java.lang.RuntimePermission "setContextClassLoader"; // tomee
+    permission java.lang.RuntimePermission "accessDeclaredMembers"; // owb
+    permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; // owb
+    permission java.net.SocketPermission "localhost", "connect,resolve"; // jndi
+    permission java.net.SocketPermission "127.0.0.1", "connect,resolve"; // jndi
+    permission javax.security.auth.AuthPermission "doAsPrivileged"; // tomee security
+    permission javax.security.auth.AuthPermission "modifyPrincipals"; // tomee security
+    permission javax.security.auth.AuthPermission "modifyPrivateCredentials"; // tomee security
+
+    // TomEE for CTS classes in webapps
+    permission java.io.FilePermission "${cts.home}/dist/-", "read";
+
     // Required for OpenJMX
     permission java.lang.RuntimePermission "getAttribute";
 
@@ -169,12 +199,14 @@
     // Precompiled JSPs need access to these packages.
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
-    permission java.lang.RuntimePermission
-     "accessClassInPackage.org.apache.jasper.runtime.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";
 
     // Applications using WebSocket need to be able to access these packages
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
+
+    // TomEE for CTS classes
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.ts.*";
 };
 
 
@@ -259,17 +291,36 @@
 // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
 // };
 
-// ================ Apache TomEE ============== (To be refined)
-grant codeBase "jar:file:${catalina.home}/lib/*!/-" {
-    permission java.security.AllPermission;
+// TomEE for CTS configuration
+grant codeBase "file:${cts.home}/dist/com/sun/ts/tests/jaspic/-" {
+    permission java.io.FilePermission "${catalina.base}/conf/-", "read";
+    permission java.io.FilePermission "${catalina.base}/conf/jaspic-providers.xml", "read,write,delete"; // Tomcat ACF
+    permission java.io.FilePermission "${catalina.base}/conf/jaspic-providers.xml.new", "read,write,delete"; // Tomcat ACF
+    permission java.io.FilePermission "${catalina.base}/conf/jaspic-providers.xml.old", "read,write,delete"; // Tomcat ACF
+    permission java.io.FilePermission "${catalina.base}/temp/-", "read,write";
+    permission java.io.FilePermission "${catalina.base}/logs/-", "read,write";
+    permission java.io.FilePermission "${catalina.base}/work/-", "read,write";
+    permission java.util.PropertyPermission "*", "read,write"; // the log file
+    permission java.security.SecurityPermission "getProperty.authconfigprovider.factory";
+    permission java.security.SecurityPermission "setProperty.authconfigprovider.factory";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.authenticator.jaspic";
+    permission java.util.logging.LoggingPermission "control";
 };
-grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
-    permission java.security.AllPermission;
+grant codeBase "file:${cts.home}/dist/com/sun/ts/tests/servlet/ee/spec/security/permissiondd/servlet_ee_spec_security_permissiondd_web/-" {
+    permission java.util.PropertyPermission "cts.*", "read";
+
+    permission java.security.SecurityPermission "CTSPermission1_name";
+    permission java.security.SecurityPermission "CTSPermission1_name2";
+    permission java.security.SecurityPermission "CTSPermission2_name";
+    permission java.security.SecurityPermission "CTSPermission_second_name";
+
+    permission java.lang.RuntimePermission "loadLibrary.*";
+    permission java.lang.RuntimePermission "queuePrintJob";
+
+    permission java.net.SocketPermission "*", "connect";
+
+    permission java.io.FilePermission "*", "read";
+
+    permission java.util.PropertyPermission "*", "read";
 };
-grant codeBase "file:${catalina.base}/lib/-" {
-    permission java.security.AllPermission;
-};
-grant {
-        // "standard" properties that can be read by anyone
-        permission java.security.AllPermission ;
-};
\ No newline at end of file
+
diff --git a/src/test/tomee-plume/conf/context.xml b/src/test/tomee-plume/conf/context.xml
index 5d42cfe..3c422ef 100644
--- a/src/test/tomee-plume/conf/context.xml
+++ b/src/test/tomee-plume/conf/context.xml
@@ -30,14 +30,6 @@
     -->
 
     <Valve className="org.apache.openejb.cts.TransactionalWorkaroundLeakGuardValve"/>
-    <!-- Rollback this because it causes some other tests to fail because they test the Form authentication and Tomcat
-    Does not allow multiple authenticator valve
-    We need to hear back or to find a way to only add this for jaspic webapp or tests
-
-    <Valve className="org.apache.catalina.authenticator.BasicAuthenticator"
-           jaspicCallbackHandlerClass="org.apache.openejb.cts.CallbackHandlerImpl"
-    />
-    -->
 
     <Environment name="myUrl" value="http://google.com"
                  type="java.net.URL" override="false"/>
diff --git a/src/test/tomee-plume/conf/tomcat-users.xml b/src/test/tomee-plume/conf/tomcat-users.xml
index 7de2b4f..9ce0456 100644
--- a/src/test/tomee-plume/conf/tomcat-users.xml
+++ b/src/test/tomee-plume/conf/tomcat-users.xml
@@ -21,9 +21,9 @@
   <user name="admin" password="admin" roles="manager"/>
   <user name="jave_vi" password="javaee_vi" roles="staff"/>
   <user name="javee_vi" password="javaee_vi" roles="staff"/>
-  <user name="javajoe" password="javajoe" roles="Manager,Employee,guest"/>
+  <user name="javajoe" password="javajoe" roles="Manager,Employee,guest,OTHERROLE"/>
   <user name="javaee" password="javaee" roles="Administrator,Employee,mgr,asadmin"/>
-  <user name="j2ee" password="j2ee" roles="Administrator,Employee,mgr,asadmin,staff"/>
+  <user name="j2ee" password="j2ee" roles="Administrator,Employee,mgr,asadmin,staff,DIRECTOR"/>
 
   <user name="CN=CTS, OU=Java Software, O=Sun Microsystems Inc., L=Burlington, ST=MA, C=US" roles="Administrator"/>
 </tomcat-users>