The key thing is that one of the directory services you can use via JNDI is "java", which is a process-local configuration store present by default in enterpris

The key thing is that one of the directory services you can use via JNDI is "java", which is a process-local configuration store present by default in enterprise (Java EE) applications. An enterprise web server can run multiple "applications" at once, and each one gets its own configuration in the java directory service. So, if you have defined a configuration variable app-name-for-logging, then you can look up: java:comp/env/app-name-for-logging to get the value. If you are writing a generic logging utility which works across many applications, it might be useful to use this to choose the log file, or just include it in the log output. The easiest implementation of this was just to allow generic JNDI lookups, which includes LDAP. What i can't explain is why anyone would legitimately use this feature to make JNDI lookups. It should have been scoped to only lookups in java:comp/env, not arbitrary ones.