We have a Java applet which resides on the web server. It is CORBA based and talks to remote objects. We use Inprise's gatekeeper on the web server.
You don't have to use gatekeeper. You could export your corba servers IOR. (IOR - The object reference.) You then give this IOR to your client applet and do a object_to_string(IOR) on the IOR string. You then use the interface helper class, on which you are doing a bind(), to do a narrow on the IOR. This will bind to the server.
But you will still have to grant the applet rights to open sockets to a machine other that the one it was loaded from.