Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.
Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
Expose management hidden attribute lists through bootstrap environment defaults and keep ACL rendering in the LDIF template. Align management assets with database-readonly naming and drop the MONITOR and AUDITLOG flag suffixes.
Update documentation, migration notes and integration coverage for custom hidden attributes, empty effective lists, audit logging and monitoring.
Load a targeted pwdHistory deny rule only when ppolicy and the data read-only
account are enabled. Continue normal ACL evaluation for other identities so
administrator access, replication and later custom grants remain available.
Add regression scenarios for default permissions, disabled features, replicated
history and password reuse, custom grants and bootstrap fragment replacement.
Document that existing databases require an explicit ACL update.
Add an optional TLS watcher with content fingerprints to ignore duplicate
notifications and unchanged Kubernetes projections.
Use explicit paths under /run/container/tmp for runtime temporary files
and require baseimage 2.1.0. Cover TLS renewal and read-only /tmp.
The replication password was not quoted in olcSyncRepl: a password with
spaces made the bootstrap fail. The default sync repl template now quotes
credentials. slapd can not store an escaped double quote followed by a
space in olcSyncRepl, so passwords with double quotes are rejected with an
explicit error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the
CI/CD tool with osixia/dagger-build (Go 1.26.9).
- Add Dagger integration tests: default bootstrap, alternative schemas,
all compatible modules and schemas with every bootstrap feature on a
3-node replicated cluster with TLS required, backup/restore, simulated
upgrade and upgrade from previous releases.
- Fix bootstrap failing with "Argument list too long" with large schemas:
load them with LDIF include: lines, fail on missing schemas.
- Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so
pwdMinLength is enforced.
- Align the CI workflow with osixia/container-baseimage and add Dependabot.
- Document available schemas and modules and their incompatibilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bertrand Gouny
