I have written on this elliptical error before, but find that there are a variety of causes for it. This can happen at deploy-time in Glassfish. The com.sun.enterprise.deployment.backend.IASDeploymentException and accompanying stack trace all but entirely mask the true root cause of the problem, so I will describe here at least one thing to check for.
Perhaps you are using bare (not wrapped) document/literal Web Services. Your WebMethod has the @SOAPBinding(parameterStyle=SOAPBinding.ParameterStyle.BARE) annotation. If you attempt to return a List type from this method, you could see the "Unable to create JAXBContext due to the security restriction" error. Say your EJB or servlet signature wants to be this: public List<Product> getProducts(). The problem is in your return because your message won't be unmarshallable.
It seems logical enough to assume this might work, because "xs:list" is a built-in schema type. But if you are using straight dispatch like this:
Dispatch<SOAPMessage> dispatch = service.createDispatch(portQName, SOAPMessage.class, Service.Mode.MESSAGE);
...and not generated types you would get from wsimport and the Service classes, then this won't happen automatically.
Also, schema lists allow only simple element types, so you can't define a list and hope the Products (or whatever your complex custom type is) will automatically make it in.
What you need to do is make a new Schema to act as your return type that sets the "maxOccurs" attribute to unbounded for your custom type:
<include schemaLocation="Product.xsd" />
<element name="products" type="myns:ProductList"/>
<element name="products" type="myns:Product"
maxOccurs="unbounded" nillable="true" />
So now your service implementation method signature looks like this:
public ProductList getProducts()
This will generate a read-only Java type that allows you to get the internal array list of Product objects, and your error will go away and your problem will be solved.
The downside is that you have another schema to maintain. The upside is, that's what we do when we say we want to be bare document/literal, we just want to exchange business documents, and we get to be accountable for our work in our schemas.