Many organizations still depend on mature LDAP client libraries that were designed long before modern distributed tracing, structured logging, and production observability became standard. Replacing these libraries is often unrealistic: they sit on critical authentication, authorization, and identity-management paths where API compatibility and operational stability matter more than novelty. Leaving them unchanged, however, makes failures harder to diagnose and support.

This session presents the ongoing modernization of jldap, a long-lived Java LDAP client library originally developed by Novell and maintained in the OpenLDAP ecosystem, and the work required to make LDAP client activity visible through OpenTelemetry auto-instrumentation.

Starting from the jldap 4.6 code base, we incrementally modernized core infrastructure while preserving API compatibility for existing applications. The work included migrating the build system to Maven, introducing CI-based validation, replacing custom debugging facilities with structured SLF4J logging, and improving runtime diagnostics around socket creation, TLS establishment, and connection lifecycle management.

A major focus of the effort was operational reliability. We will discuss failure modes exposed during modernization, including background thread exception handling, TLS handshake behavior, socket timeout propagation, synchronization edge cases, and protocol-processing defects. For each category, we examine the root cause, the implemented solution, and the testing strategy used to preserve compatibility.

Along the way, we encountered protocol and interoperability issues involving controls, extended operations, LDIF processing, schema parsing, TLS certificate validation, and response handling. These examples illustrate how seemingly small correctness issues can have significant operational impact in directory-enabled applications.

The second half of the session focuses on observability. We extended the OpenTelemetry Java Agent with instrumentation for jldap and JNDI LDAP operations, enabling LDAP activity to appear automatically in distributed traces without application code changes. The talk explains how LDAP operations map to spans, which attributes provide operational value, and how to balance troubleshooting needs against cardinality and privacy concerns. We also discuss deployment controls that allow tracing to be introduced gradually across production environments.

Finally, we will open a community discussion on whether Mark Wahl's LDAP Session Tracking Control draft could be extended with a W3C Trace Context-compatible representation for propagating trace context into LDAP server processing. We will invite feedback from client and server implementers on interoperability, privacy, operational safety, and whether a community draft plus reference implementation would be useful.

Attendees will learn:

- A practical approach to modernizing a mature LDAP client library while maintaining API compatibility.

- Techniques for improving reliability in LDAP connection and protocol handling code.

- How OpenTelemetry auto-instrumentation can be extended to support LDAP operations.

- Effective span and attribute design for directory-service tracing.

- Open questions around trace-context propagation between LDAP clients and servers.