{"record":{"id":"8191d977a301bf73","repo":"quarkusio/quarkus","slug":"jndi-has-been-disabled-enable-it-with-quarkus-nam","errorCode":null,"errorMessage":"JNDI has been disabled, enable it with quarkus.naming.enable-jndi=true","messagePattern":"JNDI has been disabled, enable it with quarkus\\.naming\\.enable-jndi=true","errorType":"exception","errorClass":"NamingException","httpStatus":null,"severity":"error","filePath":"independent-projects/bootstrap/runner/src/main/java/io/quarkus/bootstrap/naming/DisabledInitialContext.java","lineNumber":41,"sourceCode":"/**\n * Initial context that won't allow you to actually do anything.\n * <p>\n * Used by Quarkus to disable JNDI.\n */\npublic class DisabledInitialContext extends InitialLdapContext {\n\n    public static final String MESSAGE = \"JNDI has been disabled, enable it with quarkus.naming.enable-jndi=true\";\n\n    public DisabledInitialContext() throws NamingException {\n    }\n\n    public DisabledInitialContext(Hashtable<?, ?> environment, Control[] connCtls) throws NamingException {\n        super(environment, connCtls);\n    }\n\n    @Override\n    public ExtendedResponse extendedOperation(ExtendedRequest request) throws NamingException {\n        throw new NamingException(MESSAGE);\n    }\n\n    @Override\n    public LdapContext newInstance(Control[] reqCtls) throws NamingException {\n        throw new NamingException(MESSAGE);\n    }\n\n    @Override\n    public void reconnect(Control[] connCtls) throws NamingException {\n        throw new NamingException(MESSAGE);\n    }\n\n    @Override\n    public Control[] getConnectControls() throws NamingException {\n        throw new NamingException(MESSAGE);\n    }\n\n    @Override","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/bootstrap/runner/src/main/java/io/quarkus/bootstrap/naming/DisabledInitialContext.java#L23-L59","documentation":"DisabledInitialContext is Quarkus's secure-by-default LDAP InitialLdapContext in which all JNDI operations throw a NamingException stating that JNDI is disabled unless quarkus.naming.enable-jndi=true. extendedOperation specifically rejects LDAP extended operations. This is an intentional security guard against JNDI injection, not a malfunction.","triggerScenarios":"Calling extendedOperation(ExtendedRequest) on the disabled LdapContext while the application runs with quarkus.naming.enable-jndi=false (the default).","commonSituations":"Application code performing LDAP extended operations (e.g. password modify, StartTLS) that worked on plain LDAP clients but now runs under Quarkus's hardened context; security-hardened deployments where JNDI was left disabled.","solutions":["If JNDI/LDAP is genuinely required, set quarkus.naming.enable-jndi=true in application.properties","Replace the extended operation with an API not relying on JNDI extended requests","Restrict enabling JNDI to trusted input only — re-enable only where LDAP payloads are validated","Document/audit the change since enabling JNDI relaxes a security default"],"exampleFix":"# before (default)\n# quarkus.naming.enable-jndi is unset => disabled\n# after: application.properties\nquarkus.naming.enable-jndi=true","handlingStrategy":"try-catch","validationCode":"boolean jndiEnabled = Boolean.parseBoolean(\n    System.getProperty(\"quarkus.naming.enable-jndi\",\n    ConfigProvider.getConfig().getValue(\"quarkus.naming.enable-jndi\", String.class)));\nif (!jndiEnabled) throw new IllegalStateException(\"LDAP extended ops require quarkus.naming.enable-jndi=true\");","typeGuard":null,"tryCatchPattern":"try {\n    ctx.extendedOperation(request);\n} catch (NamingException e) {\n    if (e.getMessage().contains(\"JNDI has been disabled\")) {\n        log.error(\"Enable quarkus.naming.enable-jndi=true or avoid extended operations\");\n    }\n}","preventionTips":["Gate LDAP-dependent code paths behind a config check for quarkus.naming.enable-jndi","Document that Quarkus disables JNDI by default","Validate LDAP inputs before enabling JNDI (injection risk)","Prefer non-JNDI APIs where available"],"tags":["jndi","ldap","security"],"backgroundTag":"jndi-disabled","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}