diff --git a/plugin/security/src/main/plugin-metadata/plugin-security.policy b/plugin/security/src/main/plugin-metadata/plugin-security.policy
index 84f4eb5ca10..857c2f6e472 100644
--- a/plugin/security/src/main/plugin-metadata/plugin-security.policy
+++ b/plugin/security/src/main/plugin-metadata/plugin-security.policy
@@ -5,6 +5,7 @@ grant {
   permission java.util.PropertyPermission "*", "read,write";
 
   // needed because of SAML (cf. o.e.x.s.s.RestorableContextClassLoader)
+  permission java.lang.RuntimePermission "getClassLoader";
   permission java.lang.RuntimePermission "setContextClassLoader";
 
   // needed for multiple server implementations used in tests