• jdk.jndi.object.factoriesFilter:
  The value of this system property defines a filter used by the JNDI runtime implementation to control the set of object factory classes which will be allowed to instantiate objects from object references returned by naming/directory systems. The factory class named by the reference instance will be matched against this filter. The filter property supports pattern-based filter syntax with the same format asjdk.serialFilter. Limit patterns specified in the filter property are unused. This property can also be specified as asecurity property. This property is also supported by thedefault LDAP Naming Service Provider.
  The default value allows any object factory class specified by the reference instance to recreate the referenced object.
• jdk.jndi.rmi.object.factoriesFilter:
  The value of this system property defines a filter used by the JDK RMI provider implementation to further restrict the set of object factory classes which will be allowed to instantiate objects from object references returned by RMI systems. The factory class named by thereference instance first will be matched against this specific filter and then against the global filter. The factory class is rejected if any of these two filters reject it, or if none of them allow it. The filter property supports pattern-based filter syntax with the same format asjdk.serialFilter. Limit patterns specified in the filter property are unused.
  The default value allows any object factory class provided by the JDK RMI provider implementation.

Downloading a factory class from alocation specified in the reference can be supported by a custom implementation ofObjectFactoryBuilder. If a location is specified, then unless anObjectFactoryBuilder is installed aConfigurationException is thrown.