Spring Security usage of sun/reflect/Reflection in transitive dependency of org.springframework.security.ldap.server.ApacheDSContainer

I'am using Spring Boot 2.1.5.RELEASE with preconfigured spring-security 5.1.5.RELEASE It seem that transitive dependency of spring-security-ldap:5.1.5.RELEASE is still using sun. packages which does not cooperate with JDK 12. (org.apache.directory.server.apacheds-core:1.5.5)

Caused by: java.lang.NoClassDefFoundError: sun/reflect/Reflection
    at org.apache.directory.server.core.avltree.ArrayMarshaller.deserialize(ArrayMarshaller.java:153)
    at org.apache.directory.server.core.avltree.ArrayMarshaller.deserialize(ArrayMarshaller.java:43)
    at org.apache.directory.server.core.partition.impl.btree.jdbm.JdbmTable.getDupsContainer(JdbmTable.java:988)
    at org.apache.directory.server.core.partition.impl.btree.jdbm.JdbmTable.get(JdbmTable.java:382)
    at org.apache.directory.server.core.partition.impl.btree.jdbm.JdbmIndex.forwardLookup(JdbmIndex.java:436)
    at org.apache.directory.server.core.partition.impl.btree.jdbm.JdbmStore.getEntryId(JdbmStore.java:904)
    at org.apache.directory.server.xdbm.search.impl.DefaultSearchEngine.cursor(DefaultSearchEngine.java:99)
    at org.apache.directory.server.core.partition.impl.btree.BTreePartition.search(BTreePartition.java:243)
    at org.apache.directory.server.core.schema.SchemaPartitionDao.listSchemas(SchemaPartitionDao.java:208)
    at org.apache.directory.server.core.schema.SchemaPartitionDao.getSchemas(SchemaPartitionDao.java:168)
    at org.apache.directory.server.core.DefaultDirectoryService.initialize(DefaultDirectoryService.java:1548)
    at org.apache.directory.server.core.DefaultDirectoryService.startup(DefaultDirectoryService.java:971)
    at org.springframework.security.ldap.server.ApacheDSContainer.start(ApacheDSContainer.java:229)
    at org.springframework.security.ldap.server.ApacheDSContainer.afterPropertiesSet(ApacheDSContainer.java:149)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1837)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1774)
    ... 64 more

Comment From: jzheaux

That is correct, ApacheDS does not have a GA release that is compatible with JDK 12. The ApacheDS project has been stagnant for some time now.

Alternatively, you can use UnboundIdContainer.

I'm going to close this as answered, but please feel free to reopen if you have a specific request.

Comment From: klr8

FYI: Simply overriding org.apache.directory.server:apacheds-core-avl to version 1.5.7 seems to fix the issue for us. More specifically, we keep all other ApacheDS dependencies on 1.5.5, and simply add the following to the POM:

<dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-core-avl</artifactId>
            <version>1.5.7</version>
            <scope>test</scope>
</dependency>

Comment From: fdaugan

Thanks to @klr8 , the dependency management fixes the issue.

<dependencyManagement>
<dependencies>
    <dependency>
        <groupId>org.apache.directory.server</groupId>
        <artifactId>apacheds-core-avl</artifactId>
        <!-- Needed for JSE12+ compatibility -->
        <version>1.5.7</version>
    </dependency>
</dependencies>
</dependencyManagement>