They didn't add ldap support explicitly though, AFAICT. They added JNDI support, using a fairly small patch the guy who filed the request wrote for them. JNDI is a standard Java thing, so I'd guess they didn't think too deeply about all of the things it could do (not criticizing them, I'd probably have done the same thing).