Java Naming and Directory Interface (JNDI)

• is a Java API that allows clients to discover and lookup data and objects via a name. These objects can be stored in different naming or directory services, such as:
  • Remote Method Invocation (RMI)
  • Common Object Request Broker Architecture (CORBA)
  • Lightweight Directory Access Protocol (LDAP)
  • Domain Name Service (DNS)
  • etc

JNDI - When is it Used?

The most common use case is to set up a database connection pool on a Java EE application server. Any application that’s deployed on that server can gain access to the connections they need using the JNDI name java:comp/env/FooBarPool without having to know the details about the connection.

This has several advantages:

1. If you have a deployment sequence where apps move from devl->int->test->prod environments, you can use the same JNDI name in each environment and hide the actual database being used. Applications don’t have to change as they migrate between environments.
2. You can minimize the number of folks who need to know the credentials for accessing a production database. Only the Java EE app server needs to know if you use JNDI.

JNDI - Architecture

The JDK includes the Service Provider Interfaces (SPI) for the following naming/directory services:

1. Lightweight Directory Access Protocol (LDAP)
2. Common Object Request Broker Architecture (CORBA) Common Object Services (COS) name service
3. Java Remote Method Invocation (RMI) Registry
4. Domain Name Service (DNS)

Other service providers can be downloaded from the JNDI page or obtained from other vendors.

JNDI - Code Example

Let’s consider a simple Java API, such as InitialContext.lookup(String name)

String jndiUrl = "jndi:ldap://ldap-server.com:386"
new javax.naming.InitialContext().lookup(jndiUrl);

JNDI - Subpages

• JNDI - com.sun.jndi.ldap.object.trustURLCodebase com.sun.jndi.rmi.object.trustURLCodebase
• JNDI - Exploitation／Hack／Vulnerability／Injections
• JNDI - Java Objects Serialization／Serialize／Serializing & Deserialization／Deserialize／Deserializing into Directory
• JNDI - LDAP Attack Vector (Entry Poisoning)
• JNDI - ObjectFactory and DirObjectFactory

JNDI - Resources

• https://docs.oracle.com/javase/tutorial/jndi/overview/index.html