Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.
Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
Expose management hidden attribute lists through bootstrap environment defaults and keep ACL rendering in the LDIF template. Align management assets with database-readonly naming and drop the MONITOR and AUDITLOG flag suffixes.
Update documentation, migration notes and integration coverage for custom hidden attributes, empty effective lists, audit logging and monitoring.
The replication password was not quoted in olcSyncRepl: a password with
spaces made the bootstrap fail. The default sync repl template now quotes
credentials. slapd can not store an escaped double quote followed by a
space in olcSyncRepl, so passwords with double quotes are rejected with an
explicit error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
openldap-ctl backup --clean removed every file older than N days in the
backup directory, including manual and pre-upgrade backups. It now only
removes backup files, and --clean-prefix limits it to backups starting
with a prefix.
Cron backups are named openldap-cron-<date>-<version> and cleaned with
--clean-prefix openldap-cron-.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the
CI/CD tool with osixia/dagger-build (Go 1.26.9).
- Add Dagger integration tests: default bootstrap, alternative schemas,
all compatible modules and schemas with every bootstrap feature on a
3-node replicated cluster with TLS required, backup/restore, simulated
upgrade and upgrade from previous releases.
- Fix bootstrap failing with "Argument list too long" with large schemas:
load them with LDIF include: lines, fail on missing schemas.
- Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so
pwdMinLength is enforced.
- Align the CI workflow with osixia/container-baseimage and add Dependabot.
- Document available schemas and modules and their incompatibilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bertrand Gouny
