Default java.naming.referral value cannot be overridden by setting system property

### Jenkins and plugins versions report

Environment

```text
Jenkins: 2.555.1
OS: Linux - 5.14.0-611.54.1.el9_7.x86_64
Java: 21.0.11 - Red Hat, Inc. (OpenJDK 64-Bit Server VM)
---
PrioritySorter:936.v2c01c6b_84449
active-directory:2.41.1
analysis-model-api:14.8.0-976.v5097f60f61a_4
ant:520.vd082ecfb_16a_9
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
apache-httpcomponents-client-5-api:5.6.1-195.v65ffe15189a_d
artifactory:4.0.8
asm-api:9.10.1-216.va_9256d3b_844b_
atlassian-bitbucket-server-integration:6.0.0
audit-trail:436.vc0d1e79fc5a_3
authentication-tokens:1.144.v5ff4a_5ec5c33
basic-branch-build-strategies:317.v85b_331d6cc42
bitbucket:307.va_9f30d0b_8f0d
blackduck-detect:11.0.0
bootstrap5-api:5.3.8-1038.vee76a_fe825ff
bouncycastle-api:2.30.1.84-291.v9f17b_21896e2
branch-api:2.1280.v0d4e5b_b_460ef
build-blocker-plugin:175.vc57a_d7dff5b_4
build-discarder:158.vce570d01ce4c
build-environment:1.7
build-failure-analyzer:3.887.vc872cf1b_7dff
build-monitor-plugin:1034.vd5c4f4d17b_ff
build-name-setter:2.5.1
build-timeout:1.40
buildgraph-view:1.8
built-on-column:1.5
caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81
checks-api:402.vca_263b_f200e3
claim:617.v149399f86b_de
cloudbees-bitbucket-branch-source:937.3.1
cloudbees-disk-usage-simple:256.v20ec4eb_884f1
cloudbees-folder:6.1100.ve9eed61d16c4
command-launcher:134.v025a_5fcf9dea_
commons-collections4-api:4.5.0-8.va_d5448ef9011
commons-compress-api:1.28.0-3
commons-lang3-api:3.20.0-109.ve43756e2d2b_4
commons-text-api:1.15.0-218.va_61573470393
compact-columns:1.222.vcd19e64d7ef5
conditional-buildstep:1.5.0
config-file-provider:1006.vc7366c201f57
console-tail:15.vc54cb_4ca_6981
copyartifact:795.ve8e151429b_27
coverage:3.3240.vb_5a_8809f7523
credentials:1502.v5c95e620ddfe
credentials-binding:725.ve52b_2328a_fde
customizable-header:295.v2544b_ca_19b_97
cvs:502.v02d5a_0c6b_9a_3
dashboard-view:2.558.v96b_901978e47
data-tables-api:2.3.8-1570.v1cb_1cd2a_0fb_c
dependency-check-jenkins-plugin:5.6.3
dependencyanalyzer:0.7
depgraph-view:1.0.5
display-url-api:2.217.va_6b_de84cc74b_
docker-commons:472.vee120e23d3a_c
docker-workflow:634.vedc7242b_eda_7
durable-task:671.v340ff7959010
echarts-api:6.0.0-1287.vfd24c22a_3d00
eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
embeddable-build-status:637.vd878e68178f8
envinject:2.941.v351a_20c0a_3ca_
envinject-api:1.241.vdd714803b_403
extended-read-permission:68.vd270568a_7520
external-monitor-job:223.vb_fddcf42c9b_3
flatpickr-api:4.6.13-32.v60a_51029c136
font-awesome-api:7.2.0-990.vf220b_2a_496f9
forensics-api:4.1891.v5e60f3377506
generic-webhook-trigger:2.4.2
git:5.10.1
git-client:6.6.0
git-server:137.ve0060b_432302
gradle:2.19.1244.v1f9866817fec
groovy:537.v741a_5a_f1b_581
gson-api:2.14.0-201.v8eefe5515533
handy-uri-templates-2-api:2.1.8-38.vcea_5d521d5f3
htmlpublisher:427.1
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
ivy:604.v6dd214d04ef3
jackson-annotations2-api:2.21-7.v4777a_f3a_a_d47
jackson2-api:2.21.2-436.v29efdb_7418ff
jackson3-api:3.1.3-76.vd9b_7cd2e80b_8
jakarta-activation-api:2.1.4-1
jakarta-mail-api:2.1.5-1
jakarta-xml-bind-api:4.0.6-12.vb_1833c1231d3
javadoc:354.vee1a_660b_4990
javancss:1.1
javax-activation-api:1.2.0-8
javax-mail-api:1.6.2-11
jaxb:2.3.9-143.v5979df3304e6
jdepend:1.3.1
jdk-tool:83.v417146707a_3d
jersey2-api:2.48-180.ve47b_264f849b_
jfrog:1.8.0
jira-steps:2.1.185.vf95b_e8a_f13fe
jnr-posix-api:3.1.22-204.v925e2b_09a_42c
job-parameter-summary:0.5
job-restrictions:242.v6edda_c9e4ca_f
jobConfigHistory:1356.ve360da_6c523a_
joda-time-api:2.14.2-193.v422b_efce56e0
jquery:1.12.4-3
jquery3-api:3.7.1-687.v68d468e40b_30
jsch:0.2.16-95.v3eecb_55fa_b_78
json-api:20260522-217.v0b_18b_8cd4672
json-path-api:3.0.0-218.vcd4dd1355de2
jsoup:1.22.2-95.vc5d00f1eb_42d
junit:1403.vd9d1413fd205
kubernetes:4423.vb_59f230b_ce53
kubernetes-client-api:7.3.1-256.v788a_0b_787114
kubernetes-credentials:207.v492f58828b_ed
label-linked-jobs:6.0.1
ldap:807.v7d7de30930cf
lockable-resources:1515.v380548282a_59
m2release:0.16.4
mailer:534.v1b_36f5864073
managed-scripts:1.5.6
mapdb-api:1.0.9-44.va_1e1310c9118
matrix-auth:3.2.10
matrix-project:870.v9db_fcfc2f45b_
maven-info:0.3.2
maven-plugin:3.27
mercurial:1323.ve69d2a_db_8a_b_d
metrics:4.2.37-494.v06f9a_939d33a_
mina-sshd-api-common:2.17.1-187.v0341274c2905
mina-sshd-api-core:2.17.1-187.v0341274c2905
nodelabelparameter:851.vd94e5048d321
okhttp-api:5.3.2-200.vedb_720a_cf1f8
oss-symbols-api:456.v46e634a_63b_99
pam-auth:1.12
parameterized-trigger:893.va_383a_9b_a_4c11
performance:1015.v09ca_52b_3370e
pipeline-agent-build-history:144.v1b_a_42390d9ce
pipeline-build-step:584.vdb_a_2cc3a_d07a_
pipeline-graph-analysis:254.v0f63a_a_447dca_
pipeline-groovy-lib:798.v5cc688825312
pipeline-input-step:551.vdff487c5998c
pipeline-milestone-step:152.v6e22b_8cfc66c
pipeline-model-api:2.2289.v6f731d0a_02da_
pipeline-model-definition:2.2289.v6f731d0a_02da_
pipeline-model-extensions:2.2289.v6f731d0a_02da_
pipeline-rest-api:2.41
pipeline-stage-step:345.va_96187909426
pipeline-stage-tags-metadata:2.2289.v6f731d0a_02da_
pipeline-stage-view:2.41
pipeline-utility-steps:3.810.va_7672d206740
plain-credentials:199.v9f8e1f741799
plugin-usage-plugin:418.v308c3c863d25
plugin-util-api:7.1341.v039f146993d9
postbuildscript:3.4.1-695.vf6b_0b_8053979
powershell:185.v7a_026da_c54ee
prism-api:1.30.0-727.vc475481f034d
project-build-times:1.2.1
project-health-report:1.2
promoted-builds:992.va_00888f21b_74
rebuild:338.va_0a_b_50e29397
resource-disposer:0.25
robot:6.2.1
rocketchatnotifier:2.1.3
run-condition:276.v97298f3a_cd51
scm-api:728.vc30dcf7a_0df5
script-security:1402.v94c9ce464861
simple-theme-plugin:230.v8b_fd91b_b_800c
slave-status:56.v1798df8ff586
snakeyaml-api:2.5-149.v72471e9c6371
snakeyaml-engine-api:3.0.1-5.vd98ea_ff3b_92e
sonar:2.18.2
ssh-agent:396.vcc7d84e622ec
ssh-credentials:372.va_250881b_08cd
ssh-slaves:3.1097.v868116049892
sshd:3.384.vc89b_5e138cf9
stashNotifier:1.555.v8937f80894e4
structs:362.va_b_695ef4fdf9
subversion:1303.vcfd9679fb_c12
test-results-analyzer:309.vda_3a_a_f100542
text-finder:1.33
throttle-concurrents:625.vc8b_e469e9a_b_c
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.284.v1974ea_324382
variant:70.va_d9f17f859e0
view-job-filters:406.va_0ec67147ee2
warnings-ng:13.10097.v277a_958a_b_c09
woodstox-core-api:7.1.1-1.v4d297985f397
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1413.v2ff1a_5e720fa_
workflow-basic-steps:1098.v808b_fd7f8cf4
workflow-cps:4331.v9d06ed4658ff
workflow-durable-task-step:1479.v56e587f413a_7
workflow-job:1571.1580.v18e46842c125
workflow-multibranch:821.vc3b_4ea_780798
workflow-scm-step:466.va_d69e602552b_
workflow-step-api:724.v538c2362b_dfb_
workflow-support:1015.v785e5a_b_b_8b_22
ws-cleanup:0.49
xray-connector:2.6.2
xvfb:1.2

```

### What Operating System are you using (both controller, and any agents involved in the problem)?

Red Hat Enterprise Linux 9

### Reproduction steps

1. Update Jenkins plugins to their latest versions, especially LDAP plugin
2. Restart Jenkins
3. Login to Jenkins using a LDAP account

### Expected Results

Login using LDAP account succeeds, same as before plugin updates.

### Actual Results

After updating LDAP plugin from 807.v7d7de30930cf to 807.809.vd3a_4e5e4ec98 (per Jenkins Security Advisory 2026-05-27) login to Jenkins fails and the following warning with a stack trace is written into jenkins.log:
```
2026-05-28 08:22:18.258+0000 [id=24] WARNING h.i.i.InstallUncaughtExceptionHandler#handleException: Caught unhandled exception with ID a82ac8d3-07c6-4664-accc-f0e171f108a4
javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name ''
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3023)
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
at PluginClassLoader for ldap//org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:348)
Caused: org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s)
at PluginClassLoader for ldap//org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:218)
at PluginClassLoader for ldap//org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:368)
at PluginClassLoader for ldap//org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:314)
at PluginClassLoader for ldap//org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:612)
at PluginClassLoader for ldap//org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:553)
at PluginClassLoader for ldap//org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForMultipleAttributeValues(SpringSecurityLdapTemplate.java:198)
at PluginClassLoader for ldap//org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles(DefaultLdapAuthoritiesPopulator.java:232)
at PluginClassLoader for ldap//hudson.security.LDAPSecurityRealm$AuthoritiesPopulatorImpl.getGroupMembershipRoles(LDAPSecurityRealm.java:1428)
at PluginClassLoader for ldap//org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGrantedAuthorities(DefaultLdapAuthoritiesPopulator.java:211)
at PluginClassLoader for ldap//jenkins.security.plugins.ldap.FromGroupSearchLDAPGroupMembershipStrategy.getGrantedAuthorities(FromGroupSearchLDAPGroupMembershipStrategy.java:81)
at PluginClassLoader for ldap//hudson.security.LDAPSecurityRealm$WrappedAuthoritiesPopulator.getGrantedAuthorities(LDAPSecurityRealm.java:1381)
at PluginClassLoader for ldap//org.springframework.security.ldap.authentication.LdapAuthenticationProvider.loadUserAuthorities(LdapAuthenticationProvider.java:197)
at PluginClassLoader for ldap//org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:82)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182)
at PluginClassLoader for ldap//hudson.security.LDAPSecurityRealm$LDAPAuthenticationManager.authenticate(LDAPSecurityRealm.java:993)
at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:87)
at hudson.security.AuthenticationProcessingFilter2.attemptAuthentication(AuthenticationProcessingFilter2.java:97)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:239)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:229)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:106)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:117)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:63)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at hudson.security.ChainedServletFilter2.doFilter(ChainedServletFilter2.java:111)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:173)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1637)
at org.kohsuke.stapler.UncaughtExceptionFilter.doFilter(UncaughtExceptionFilter.java:26)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1637)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:85)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1637)
at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:31)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1637)
at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:38)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1637)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doHandle(ServletHandler.java:526)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:125)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.security.SecurityHandler.handle(SecurityHandler.java:574)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HandlerWrapper.handle(HandlerWrapper.java:124)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:195)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doHandle(SessionHandler.java:612)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:193)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doHandle(ContextHandler.java:1047)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doScope(ServletHandler.java:483)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doScope(SessionHandler.java:589)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doScope(ContextHandler.java:962)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:123)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.handle(ContextHandler.java:1729)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1581)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.dispatch(HttpChannel.java:733)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.handle(HttpChannel.java:520)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler.handle(ContextHandler.java:3054)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1224)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:621)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.Server.handle(Server.java:197)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:787)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:410)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1805)
at Jenkins Main ClassLoader//org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at Jenkins Main ClassLoader//org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1239)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
at java.base/java.lang.Thread.run(Thread.java:1583)
```

### Anything else?

According to plugin documentation it should be possible to override the new default value introduced with LDAP plugin version 807.809.vd3a_4e5e4ec98 by specifying environment property `java.naming.referral`, via JAVA_OPTS I assume, but based on the commit diff https://github.com/jenkinsci/ldap-plugin/compare/807.v7d7de30930cf...807.809.vd3a_4e5e4ec98 the value is hard coded to `ignore`.

### Are you interested in contributing a fix?

_No response_

Start by comparing the LDAP plugin versions in the reproduction steps and trace authentication through LDAPSecurityRealm, FromGroupSearchLDAPGroupMembershipStrategy, and DefaultLdapAuthoritiesPopulator. Reproduce an LDAP login with the reported configuration and investigate how java.naming.referral is handled around the shown PartialResultException. Done means LDAP login succeeds after the plugin update without the warning or stack trace.

Written by the indexing model from the issue text.