Make sure the Tomcat user (wwwrun) is a member of the www group and that both the www group and the wwwrun user are LUM-enabled. These steps happen during the install. However, the customer still needs to give the wwwrun user or the www group rights to read the NSS volume. To do this, use the rights program to grant trustee rights to the volume.