RFR: 8296183: jndiprovider.properties contains properties pointing to non-existing classes [v2]

[Anirvan Sarkar]

On Fri, 13 Feb 2026 12:14:28 GMT, Jaikiran Pai <jpai at openjdk.org> wrote:

>> Can I please get a review of this change which removes the unused `src/java.naming/share/classes/com/sun/jndi/ldap/jndiprovider.properties` file? This addresses the issue noted in https://bugs.openjdk.org/browse/JDK-8296183.
>> 
>> This `jndiprovider.properties` file lists 3 properties `java.naming.factory.control`, `java.naming.factory.object` and `java.naming.factory.state`. The semantics of these environment properties are explained in https://docs.oracle.com/javase/jndi/tutorial/beyond/env/provider.html. The classes configured in `com/sun/jndi/ldap/jndiprovider.properties` for each of these properties are non-existent in the JDK. Looking at the version control history of the JDK, these classes haven't been around for several releases (not even in JDK 8). The `jndiprovier.properties` gets looked up by an JDK internal class in the `java.naming` module - `com.sun.naming.internal.ResourceManager`. The `ResourceManager.getFactories(...)` method is the one that gets called to load the classes configured for those 3 environment properties. The javadoc of `ResourceManager.getFactories(...)` says this:
>> 
>> 
>> Retrieves an enumeration of factory classes/object specified by a property.
>> 
>> The property is gotten from the environment and the provider resource file associated with the given context and concatenated.
>> ... The resulting property value is a list of class names.
>> This method then loads each class using the current thread's context class loader and keeps them in a list.
>> Any class that cannot be loaded is ignored.
>> ...
>> 
>> 
>> The implementation of `ResourceManager.getFactories(...)` matches that javadoc. Because the implementation ignores such missing classes, the reference to these non-existent classes in the `com/sun/jndi/ldap/jndiprovider.properties` has gone unnoticed all this while. Manual experiments of exercising this code path does indeed show that a `ClassNotFoundException` gets raised (and ignored) for the classes referenced in that `jnidprovider.properties` file.
>> 
>> The commit in this PR removes the `jndiprovier.properties`. It also removes a javadoc reference to one of these non-existent classes. Given the nature of the change no new tests have been introduced and the existing tests in tier1, tier2 and tier3 continue to pass.
>
> Jaikiran Pai has updated the pull request incrementally with one additional commit since the last revision:
> 
>   add reference to DefaultResponseControlFactory in javadoc

>Looking at the version control history of the JDK, these classes haven't been around for several releases (not even in JDK 8)

It seems these classes were never part of the JDK.
These classes were part of the (legacy?) JNDI/LDAP booster pack `ldapbp.jar` available as a separate download.
The download file is currently `ldap-1_2_4.zip` in the Oracle Java Archive for Java Platform Technologies [1].

Software vendors required `ldapbp.jar` to be added to the `CLASSPATH`.
The very old JNDI tutorial also references `ldapbp.jar` [2].

Booster pack has the following packages:

|          Package           |                     Contents                      |
|----------------------------|---------------------------------------------------|
| com.sun.jndi.ldap.obj      | RMI, CORBA support for LDAP Service Provider for JNDI |
| com.sun.security.sasl.misc | CRAM-MD5, Anonymous, and Plain SASL Drivers       |
| com.sun.jndi.ldap.ctl      | Controls for LDAP Service Provider for JNDI       |

The packages `com.sun.security.sasl.misc` and `com.sun.jndi.ldap.ctl` became obsolete when its support was included in the JDK 5.

I suspect the classes of package `com.sun.jndi.ldap.obj` were not included in JDK, as RFC 2713 & RFC 2714 were not standardized unlike other RFCs related to LDAP.

The booster pack is also available on Maven repository [3].
Do you think any of its dependencies could be impacted by removal of `jndiprovider.properties` file?
Should this removal be mentioned in the release notes? 

If you want to look at the booster pack’s source code, it’s included in GlassFish 5 [4].

[1] : https://www.oracle.com/java/technologies/java-archive-downloads-java-plat-downloads.html#7110-jndi-1.2.1-oth-JPR
[2] : https://docs.oracle.com/javase/jndi/tutorial/objects/storing/index.html
[3] : https://mvnrepository.com/artifact/com.sun/ldapbp
[4] : https://github.com/javaee/glassfish/tree/master/appserver/ldapbp/src/main/java/com/sun/jndi/ldap

-------------

PR Comment: https://git.openjdk.org/jdk/pull/29712#issuecomment-3899500761