I thought I'd try to modify an existing app of mine to use Webstart. I've read the literature on Sun's web site in addition to a couple of other web sites I found doing a search. After quite some time of trying I'm still unable to get my app working. Currently the problem I'm having (I think) is with security. In my JNLP file I set it to "all-permissions" thinking that would bypass any problems in that area. I just want to get a simple example working. It seems that with "all-permissions" I need to learn about jarsigning. What is an appropriate setting for "security" to bypass any checks. I'm using "localhost" / tomcat 4 / Windows 2000. Everything is on my own computer in a test mode. Sun's documentation doesn't list anything else but "all-permissions" in the jnlp docs.
I recently bought a book called Java Deployment with JNLP and Web Start (author's last name: Marinilli). He covers many different forms of deployment, but spends a third of the book covering JNLP and Web Start services. Though I haven't read through the entire thing, and can't directly answer your problem, this might be a good starting point for you.
I had that same problem for a while until I tried signing my jar files. In Sun's documentation (which I agree should tell you other options than just "all permissions"), it explains how to use keytool and jarsigner to create a key then use it to sign a jar file. Once I did that, I got my application to run through Web Start.