Upgrading Windows Confluence to a version with bundled Java 17 does not add the necessary Java Options

Issue Summary

After upgrading Confluence on Windows to a version that bundles Java 17, the Confluence installer does not update the required options under "Java 9 Options", causing various Java-related errors.

Steps to Reproduce

1. Install Confluence 7.13.7
   • Select custom with Install paths to say C:\Confluence / C:\ConfluenceHome
   • Do not install as service
   • Do not start Confluence at the end of the Installation wizard
2. Once the install wizard completes, open up a command prompt with Administrative privileges and run the following:

   cd C:\Confluence\bin
   service.bat install confluence
   

3. In Windows Explorer, right click on C:\Confluence and click Properties
   • Click on the Security tab
   • Click Edit and Add NETWORK SERVICE with Full Control
   • Repeat the above for the C:\ConfluenceHome directory
4. Start the Confluence windows service
   • Complete the rest of the install wizard
5. Once completed, shutdown Confluence 7.13.7
6. Upgrade to Confluence 8.5.1 using Windows installer
   • Do not start Confluence at the end of the installation

The issue could also be reproduced if the installer installed the service with service.bat subsequently run to remove and re-install the Confluence service

Expected Results

The Windows Tomcat/Java properties should have all the relevant Java 17 flags automatically populated during the upgrade.

Actual Results

The Java 17 options are not included, resulting in impacts to Confluence's functionality. Current known symptoms are listed below.

Known Symptoms

1. Confluence fails to load following an upgrade

The atlassian-confluence.log shows an error for the post upgrade landing page (pulp):

2023-09-22 06:32:58,424 ERROR [http-nio-8090-exec-1] [ContainerBase.[Standalone].[localhost].[/]] log Unhandled exception occurred whilst decorating page
 -- url: /pulp/pulp-render.action | userName: admin | traceId: a03f56a8c76b8f5c
java.lang.RuntimeException: javax.servlet.ServletException: org.apache.velocity.exception.VelocityException: ASTIdentifier() : exception invoking method for identifier 'rawOffset' in class sun.util.calendar.ZoneInfo
	at com.opensymphony.sitemesh.webapp.decorator.BaseWebAppDecorator.render(BaseWebAppDecorator.java:37)
	at com.opensymphony.sitemesh.webapp.SiteMeshFilter.doFilter(SiteMeshFilter.java:92)
	at com.atlassian.confluence.util.profiling.ProfilingSiteMeshFilter.doFilter(ProfilingSiteMeshFilter.java:48)
...
Caused by: org.apache.velocity.exception.VelocityException: ASTIdentifier() : exception invoking method for identifier 'rawOffset' in class sun.util.calendar.ZoneInfo
	at org.apache.velocity.runtime.parser.node.ASTIdentifier.execute(ASTIdentifier.java:264)
	at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
...
	at org.apache.velocity.Template.merge(Template.java:328)
	at org.apache.velocity.Template.merge(Template.java:235)
	at com.atlassian.confluence.util.velocity.VelocityUtils.renderTemplateWithoutSwallowingErrors(VelocityUtils.java:70)
	at com.atlassian.confluence.util.velocity.VelocityUtils.renderTemplateWithoutSwallowingErrors(VelocityUtils.java:76)
	at com.atlassian.confluence.util.profiling.ConfluenceSitemeshDecorator$StreamingResponseWritingStrategy.renderToResponse(ConfluenceSitemeshDecorator.java:328)
	... 266 more
Caused by: java.lang.IllegalAccessException: class org.apache.velocity.runtime.parser.node.PropertyExecutor cannot access class sun.util.calendar.ZoneInfo (in module java.base) because module java.base does not export sun.util.calendar to unnamed module @3374643b
	at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Unknown Source)
	at java.base/java.lang.reflect.AccessibleObject.checkAccess(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.apache.velocity.runtime.parser.node.PropertyExecutor.execute(PropertyExecutor.java:142)
	at org.apache.velocity.util.introspection.UberspectImpl$VelGetterImpl.invoke(UberspectImpl.java:529)
	at org.apache.velocity.runtime.parser.node.ASTIdentifier.execute(ASTIdentifier.java:198)
	... 292 more

2. Confluence throws an error when logging in with a user from an LDAP Directory

When attempting to log into Confluence with a LDAP user, the below exception is thrown in the atlassian-confluence.log file:

...
java.lang.NoClassDefFoundError: Could not initialize class org.springframework.ldap.core.support.LdapContextSource
...
Could not initialize class org.springframework.ldap.core.support.LdapContextSource
...
...cannot access class com.sun.jndi.ldap.LdapCtxFactory (in module java.naming) because module java.naming does not export com.sun.jndi.ldap to unnamed module
...

3. Confluence's Font Health Check Fails

Logging into Confluence as an administrator will present the Font Health Check failing in the UI, along with the below warning logged in the atlassian-confluence.log file:

2023-09-14 12:30:32,501 WARN [Caesium-1-1] [troubleshooting.healthcheck.concurrent.SupportHealthCheckProcess] lambda$getCompletedStatuses$0 Health check 'Fonts' failed with severity 'warning': 'System fonts are not available. Please make sure correct font packages are installed.'

Workaround

1. Open up Windows services.msc
   • Locate the Confluence service, right click on it and click Properties - copy the Service name to the clipboard
2. Open up a command prompt with Administrative Privileges and run the following:
   substitute SERVICE_NAME_FROM_ABOVE with the service name from above

   cd /d <Confluence-Install-Directory>\bin
   tomcat9w.exe //ES//SERVICE_NAME_FROM_ABOVE
   

   • A Tomcat window should open, click on the Java tab
   • Replace the entire Java 9 options text box with this exact text:

     --add-opens=java.base/java.lang=ALL-UNNAMED
     --add-opens=java.base/java.lang.reflect=ALL-UNNAMED
     --add-opens=java.base/java.net=ALL-UNNAMED
     --add-opens=java.base/java.io=ALL-UNNAMED
     --add-opens=java.base/java.util=ALL-UNNAMED
     --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED
     --add-opens=java.base/sun.net.www.protocol.jar=ALL-UNNAMED
     --add-opens=java.base/sun.net.www.protocol.http=ALL-UNNAMED
     --add-opens=java.base/sun.net.www.protocol.https=ALL-UNNAMED
     --add-opens=java.base/sun.util.locale=ALL-UNNAMED
     --add-opens=java.management/javax.management=ALL-UNNAMED
     --add-exports=java.base/sun.security.action=ALL-UNNAMED
     --add-exports=java.base/sun.util.calendar=ALL-UNNAMED
     --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED
     --add-exports=java.xml/com.sun.org.apache.xml.internal.utils=ALL-UNNAMED
     --add-exports=java.desktop/sun.font=ALL-UNNAMED
     --add-exports=java.base/sun.security.util=ALL-UNNAMED
     

3. Save and restart the Confluence windows Service

To ensure that future fixed versions of Confluence (i.e. 8.5.4+, 8.6.2+, 8.7.1+) upgrades pick up the Confluence Service name:

4. Create the following directory if it does not already exist

<Confluence-Install-Directory>\.install4j

e.g. C:\Program Files\Atlassian\Confluence\.install4j

5. Edit (or create a new file if it does not already exist):

<Confluence-Install-Directory>\.install4j\installation.id

e.g. C:\Program Files\Atlassian\Confluence\.install4j\installation.id

• Ensure the contents of the installation.id file contains the Service name in Workaround / Step (1) above, e.g.

  Confluence101123012345
  

Future fixed versions of Confluence upgrades will then be able to read the Confluence service name from <Confluence-Install-Directory>\.install4j\installation.id and update the JVM flags as required.