Chapter 2. Eclipse Temurin features Eclipse Temurin does not contain structural changes from the upstream distribution of OpenJDK. For the list of changes and security fixes that the latest OpenJDK 8 release of Eclipse Temurin includes, see OpenJDK 8u392 Released . 2.1. New features and enhancements Review the following release notes to understand new features and feature enhancements that the Eclipse Temurin 8.0.392 release provides: Improved communication in CORBA The Common Object Request Broker Architecture (CORBA) implementation in OpenJDK now provides the option to limit serialization in stub objects to objects containing the IOR: prefix. Consider the following information: For the following ORB-constrained stub classes, this feature is enabled by default: _DynArrayStub _DynEnumStub _DynFixedStub _DynSequenceStub _DynStructStub _DynUnionStub _DynValueStub _DynAnyStub _DynAnyFactoryStub You can disable this feature for ORB-constrained stub classes by setting the org.omg.DynamicAny.disableIORCheck system property to true . For the following remote service stub classes, this feature is disabled by default: _NamingContextStub _BindingIteratorStub _NamingContextExtStub _ServantActivatorStub _ServantLocatorStub _ServerManagerStub _ActivatorStub _RepositoryStub _InitialNameServiceStub _LocatorStub _ServerStub You can enable this feature for remote service stub classes by setting the org.omg.CORBA.IDL.Stubs.enableIORCheck system property to true . JDK bug system reference ID: JDK-8303384. Default native GSS-API library added on Windows OpenJDK 8.0.392 adds a native Generic Security Service Application Programming Interface (GSS-API) library, sspi_bridge.dll , on the Windows platform. Similar to the provision of native GSS-API libraries on other operating systems, OpenJDK loads the sspi_bridge.dll library only when the sun.security.jgss.native system property is set to true . Alternatively, you can still instruct the JDK to load a third-party native GSS-API library by setting the sun.security.jgss.lib system property to the appropriate path. The sspi_bridge.dll library is for client-side use only and uses the default credentials. Because native GSS support automatically uses cached credentials from the underlying operating system, ensure that you set the javax.security.auth.useSubjectCredsOnly system property to false . Also, because com.sun.security.auth.module.Krb5LoginModule does not call the native Java GSS (JGSS), avoid using Krb5LoginModule in your Java Authentication and Authorization Service (JAAS) configuration. See JDK-6722928 (JDK Bug System) . Certigna root CA certificate added In OpenJDK 8.0.392, the cacerts truststore includes the following Certigna root certificate: Name: Certigna (Dhimyotis) Alias name: certignarootca Distinguished name: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR See JDK-8314960 (JDK Bug System) . Arrays cloned in several JAAS callback classes In releases, in the ChoiceCallback and ConfirmationCallback JAAS classes, when arrays were passed into a constructor or returned, these arrays were not cloned. This behavior allowed an external program to gain access to the internal fields of these classes. In OpenJDK 8.0.392, the JAAS classes return cloned arrays. See JDK-8242330 (JDK Bug System) . 2.2. Deprecated features Review the following release notes to understand pre-existing features that have been either deprecated or removed in Eclipse Temurin 8.0.392: 3DES and RC4 disabled in Kerberos OpenJDK 8.0.392 deprecates and disables the des3-hmac-sha1 and rc4-hmac Kerberos encryption types by default. If you want to re-enable these encryption types, complete either of the following actions: Enable all weak cryptography, including des-cbc-crc and des-cbc-md5 , by setting allow_weak_crypto = true in the krb5.conf configuration file. Explicitly list all preferred encryption types by using the default_tkt_enctypes , default_tgs_enctypes , or permitted_enctypes settings. See JDK-8139348 (JDK Bug System) . SECOM Trust Systems root CA1 certificate removed From OpenJDK 8.0.392 onward, the cacerts truststore no longer includes the SECOM Trust Systems root certificate: Alias name: secomscrootca1 [jdk] Distinguished name: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP See JDK-8295894 (JDK Bug System) . Revised on 2024-05-10 09:07:32 UTC

Commands: