How anticlimactic

Well, I found the answer, and the internet did not provide it.
The fellow here investigating the problem recalled that a Sun representative, when assisting with the setup of the environment suggested that we have this level of security enabled only if we met one of several conditions. We did not meet any of those conditions, and so this configuration was unnecessary. We reconfigured all our servers to reflect this advice. Or so we thought.
The server on which this was working had the proper configuration. Obviously, the server on which this was problem had an improper configuration.

So, to remedy this problem, a JVM option needed to be removed.
In the Sun Java System Application Server Admin Console, select Configurations -> <the_config_I'm_working_on> -> JVM Settings
Now, select the JVM Options tab.
In our case, we needed to remove an option dealing with security, which referred to a file called "server.properties"
Unfortunately, the change was made before I was able to record it.

So, thus far, the blog sucks.
Regardless, here are the search terms I used in my research:

1. permission required to override getUserPrincipal
2. accesscontrolexception "permission required"
3. accesscontrolexception "permission required" acegisecurity
4. accesscontrolexception ldap
5. "java.security.accesscontrolexception" ldap
6. "permission required to override getUserPrincipal
7. accesscontrolexception
8. security sun application server server.properties
9. security sun application server server.properties "JVM options"
10. security sun application server "server.properties" "JVM options"
11. security sun application server "server.properties" "JVM options" Dcom

And none of these searches pointed me specifically at the problem.
D'oh.
Dough.
Notes on the searches: We were using a file called server.properties. I don't know if that's standard. Also, we suspected there was a problem with our ldap configuration, hence the ldap searches.
HVD.