OK, shamefully, it looks like I missed out swapping the security attribute whitelistEnabled="true"
to whitelistEnabled="false"
in:
/opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/connectionswwCell01/LotusConnections-config/opensocial-config.xml
Here:
<security whitelistEnabled="false" featureAdminEnabled="true">
More details in this slide: How to add your own OpenSocial Gadgets to IBM Connections.
Of course, in a production system, you'll have to checkout the opensocial config using wsadmin.sh
, edit, checkin & restart.