J2EE restricts components from creating threads.
The LDAP provider uses threads for connection management.
The J2EE restriction would disallow a component from using LDAP
unless the container grants the component permission to create threads,
which is against the recommendations of the J2EE spec.

The container should be able to grant permission to the LDAP provider
for creating threads without granting this in general to the component.
The fix is to put doPrivileged around thread creation.