Has your organization been running Java applications for years? You might be facing a serious licensing risk without even knowing it. Java Web Start – a deprecated technology – could trigger unexpected costs and audit findings that impact your entire business.

Learn about Navigating Oracle Java’s Shifting Landscape: A Comprehensive Guide to Licensing Changes

In this guide, you’ll discover how this legacy technology creates license compliance issues and learn practical strategies to protect your organization.

What is Java Web Start?

Sun Microsystems rolled out Java Web Start (JWS) as a development technology in 2001. Using Java applications through the web doesn’t require people to go through a lengthy setup procedure. 

Web Start applications use Java Network Launch Protocol (JNLP) files – XML-based instructions that control how to download, configure, and run the application.

Web Start offered several advantages:

• Simple deployment: Launch applications directly from web browsers with one click
• Automatic updates: Applications check for updates each time they run
• Security sandbox: Applications run in a restricted environment with limited system access
• Platform independence: The same application runs on any system with a compatible Java Runtime Environment (JRE)

Common Applications Using Web Start

Many enterprise systems still use Web Start technology, including:

• Legacy enterprise software: ERP systems, CRM tools, and financial applications
• Administrative interfaces: Management consoles for servers, databases, and network equipment
• Specialized industry applications: Custom applications in healthcare, manufacturing, and financial services
• Internal business tools: Custom-built corporate applications for specific business processes

If your organization has been using Java applications for many years, Web Start technology is likely present somewhere in your environment.

The Timeline of Web Start: Rise and Fall

Understanding Java Web Start’s history is crucial for assessing your compliance risk:

• March 2001: In version 1.3.1 of J2SE, Sun Microsystems launched Java Web Start for users.
• 2010: Oracle bought Sun Microsystems and took over Java development.
• September 2017: Oracle revealed that Java Web Start would be removed from JDK 9.
• January 2019: Oracle launches Java SE 11, the first long-term support (LTS) release without Web Start.
• April 2019:  Oracle requires companies to buy commercial licenses if they want to use Java SE for their business.
• January 2023: Oracle launched a new Java license model using the Employee for Java SE Universal Subscription metric.

The important date for licensing is January 2019. That’s when Oracle released Java SE 11 (build 11.0.1) and took out Web Start from their Java version. But the biggest date for licensing rules is April 16, 2019. That’s when Oracle started new commercial licensing requirements

This means that continuing to use Web Start with Oracle Java versions newer than Java 8 Update 202 (the last public update before the licensing change) can trigger commercial licensing requirements..

Non-Oracle Alternatives for Web Start

When Oracle deprecated Web Start, while the other Java vendors themselves did not replace it, some third-party vendors created add-on alternatives:

1. AdoptOpenJDK/Adoptium: Does not include Web Start in their builds.
2. Amazon Corretto: Does not include Web Start.
3. Azul Zulu: Does not include Web Start in its community edition.
4. IcedTea-Web: An open-source implementation of Web Start that works with OpenJDK distributions.
5. OpenWebStart: A project by Karakun that provides an open-source implementation compatible with modern Java versions.

Of these alternatives, OpenWebStart offers the most promise for organizations that need to continue running Web Start applications. It works with any JDK 8+ installation, including free OpenJDK builds. However, verify that using such alternatives aligns with your application vendors’ support policies.

How Web Start Usage Triggers Oracle Java Licensing Requirements

If your organization continues to use applications that rely on Web Start technology, you face significant licensing challenges with Oracle:

Commercial Licensing Requirement

When Oracle stopped public updates for Java 8 in April 2019, they changed their licensing model. Now, if you use Oracle Java SE after Java 8 Update 202 for work or business, you need to buy a commercial license.

If you’ve upgraded to later Oracle Java versions to receive security updates and still run Web Start applications, you’re likely in a non-compliant state unless you’ve purchased appropriate Oracle Java licenses.

The Employee Licensing Metric Challenge

The situation became more complex in January 2023 when Oracle introduced the Employee for Java SE Universal Subscription metric. Under this model, you must license all employees and contractors, regardless of whether they directly use Java applications.

This creates a multiplier effect where a few Web Start applications can drive licensing requirements across your entire organization. For example, even if only 50 employees use a Web Start app, but your company has 5,000 employees in total, Oracle might say you need licenses for all 5,000 people under Oracle’s interpretation of the new metric.

Oracle’s Audit Focus

Oracle’s License Management Services (LMS) and Global Licensing and Advisory Services (GLAS) teams increasingly target Java licensing in their audit activities. They specifically look for:

1. Oracle Java installations beyond version 8 Update 202
2. Applications that require specific Oracle Java features, like Web Start
3. Organizations that have upgraded Java for security reasons without addressing licensing

Such audits might end up costing the organization a large sum, often reaching hundreds of thousands or millions in bigger companies.

Finding Web Start Usage in Your Environment

Identifying Web Start applications in your environment is the critical first step in addressing this risk. Here are effective approaches:

1. Look for JNLP Files

Web Start applications are launched using JNLP (Java Network Launch Protocol) files with a .jnlp extension. Search for these files across your network using:

• File system searches on workstations and servers
• Network share scans
• Web server content searches
• Application deployment directories

2. Analyze JNLP Content

JNLP files are XML-based and contain valuable information about the application. By examining these files, you can determine:

• The application’s name and vendor
• Required Java version
• Required JAR files and dependencies
• Security permissions requested

This analysis helps prioritize applications for remediation.

3. Inventory Oracle Java Installations

Conduct a thorough inventory of all Oracle Java installations across your environment, focusing on:

• Version and update level
• Installation location
• Associated applications
• Usage patterns

This inventory is essential for understanding your exposure to licensing requirements.

4. Consult with Application Owners and Users

Often, the most direct approach is to consult with:

• Application owners and administrators
• Power users who work with specialized systems
• IT support teams that help users with application issues

These stakeholders can provide valuable insights into which applications rely on Web Start technology.

Remediation Options for Web Start Dependency

Once you’ve identified Web Start applications in your environment, consider these remediation strategies:

1. Rollback to Java 8 Update 202 or Earlier

The easiest way to follow the rules is to go back to Java 8 Update 202 (from January 2019) or an older version, since those still use the old license terms.

• Benefits: Avoids commercial licensing requirements.
• Drawbacks: Security vulnerabilities in older Java versions, diminishing vendor support.

2. Migrate to Alternative Java Distributions

Consider migrating to non-Oracle Java distributions that offer similar functionality:

• OpenJDK: The open-source reference implementation of Java
• AdoptOpenJDK/Adoptium: Community-driven, production-ready OpenJDK builds
• Amazon Corretto: AWS’s distribution with long-term support
• Azul Zulu: Commercial and community editions available. Remember, their OpenJDK builds are free, but the Azul Zulu Enterprise Editions are not free.

When using these alternatives with Web Start applications, you’ll likely need additional components:

• IcedTea-Web: Open-source implementation of Web Start technology
• OpenWebStart: Modern, maintained Web Start implementation compatible with current Java versions

3. Application Replacement or Upgrade

For a long-term solution, consider:

• Upgrading to newer versions of applications that don’t rely on Web Start
• Replacing legacy applications with modern alternatives
• Working with vendors to obtain versions that use different deployment technologies

4. Containerization or Application Virtualization

Another approach is to isolate Web Start applications:

• Deploy applications in containers with specific Java versions.
• Use application virtualization solutions to separate Java dependencies.
• Create dedicated virtual machines for legacy applications.

Note that these steps will not eliminate the Oracle Java commercial licensing requirement. Any Oracle Java above v8u202 anywhere – even in isolated containers or VMs – will trigger a licensing requirement for all employees. 

However, if you can downgrade to an older version and are worried about security implications for the broader environment, then these isolation steps may help with deployment.

5. Purchase Oracle Java Licenses

If the above options aren’t feasible, purchasing appropriate Oracle Java licenses may be necessary:

• Oracle Java SE Universal Subscription: Licensed per employee
• Java SE Desktop Subscription: For desktop deployments (legacy metric – may not be offered by Oracle)
• Java SE Server Subscription: Processor-based licensing for servers (legacy metric – may not be offered by Oracle)

But this choice usually costs a lot and can be hard to keep up with over time.

Frequently Asked Questions

Do All Java Applications Require a Commercial License?

No. Only Oracle’s Java SE distributions after January 2019 (specifically after Java 8 Update 202) require commercial licenses for business use. Oracle OTN licensed Java used strictly for personal, development, or testing purposes may be exempt. Also, later Oracle Java versions that fall under NFTC licensing do not require a commercial license.

Can I Still Download Older Versions of Java That Include Web Start

Yes, Oracle holds on to older Java versions containing the Web Start technology. However, these versions don’t receive security updates and may contain known vulnerabilities.

Will My Web Start Applications Work With OpenJDK?

OpenJDK itself doesn’t include Web Start support. But you can use extra tools like IcedTea-Web or OpenWebStart to get this feature when you use OpenJDK.

How Can I Tell If My Organization Is at Risk of an Oracle Audit?

Some common risk factors are: already being an Oracle customer, having bought Oracle software before, employees downloading Oracle Java from Oracle’s website, being a big company, or recently saying no to Oracle’s sales offers.

What Happens If Web Start Is Discovered During an Oracle Audit?

If Oracle discovers commercial use of Oracle Java SE distributions beyond Java 8 Update 202 during an audit, they will typically demand license fees for all employees under their current licensing metrics, plus back maintenance fees.

Can I Run Multiple Java Versions on the Same System?

Yes, you can install and maintain multiple Java versions on the same system. This approach can help isolate Web Start applications to compliant Java versions while allowing other applications to use newer versions that may be covered by NFTC license rules.

How Do I Determine Which Applications Require Specific Java Versions?

Application requirements should be documented by vendors. For undocumented cases, testing applications with different Java versions in a controlled environment can help determine compatibility.

Conclusion

Java Web Start represents a significant licensing risk for organizations that have upgraded their Oracle Java installations without addressing this legacy technology. The combination of Oracle’s licensing changes, the Employee metric, and aggressive audit practices makes this a high-priority compliance issue.

If users upgrade their Oracle Java to a newer version, Java Web Start can still cause serious licensing issues for organizations. It is urgent to address this issue because of Oracle’s new license conditions, its use of the Employee metric, and the frequent follow-up audits.

By carefully finding all Web Start applications and fixing any issues, you can handle the risk well and keep your applications working safely.

You’re welcome to contact us for a free 1-hour consultation to talk about your Oracle Java licensing issues and create a strategy just for you.