The following info is based on web searching, I’m no expert at Java.
These values mentioned by LG are system-wide in JVM, stored in a file called java.security. On Debian it’s in /etc/java-6-openjdk/security/java.security
Aparently there’s a way to create a separate java.security file to be used by certain applications like Openfire, if you’re willing to modify the init scripts: http://blog.eyallupu.com/2012/11/how-to-overriding-java-security.html
I think they’re in a separate namespace than Openfire properties so they can’t be changed from the web GUI.
EDIT: It looks like the security policy file can be overridden per-user. I’ve found these 2 lines in the default Debian policy:
# The default is to have a single system-wide policy file,
# and a policy file in the user's home directory.
policy.url.1=file:${java.home}/lib/security/java.policy
policy.url.2=file:${user.home}/.java.policy