Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.
Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
Expose management hidden attribute lists through bootstrap environment defaults and keep ACL rendering in the LDIF template. Align management assets with database-readonly naming and drop the MONITOR and AUDITLOG flag suffixes.
Update documentation, migration notes and integration coverage for custom hidden attributes, empty effective lists, audit logging and monitoring.
Load a targeted pwdHistory deny rule only when ppolicy and the data read-only
account are enabled. Continue normal ACL evaluation for other identities so
administrator access, replication and later custom grants remain available.
Add regression scenarios for default permissions, disabled features, replicated
history and password reuse, custom grants and bootstrap fragment replacement.
Document that existing databases require an explicit ACL update.
Add an optional TLS watcher with content fingerprints to ignore duplicate
notifications and unchanged Kubernetes projections.
Use explicit paths under /run/container/tmp for runtime temporary files
and require baseimage 2.1.0. Cover TLS renewal and read-only /tmp.
openldap-ctl restore --force deleted existing config and data before
loading the backup: a failing slapadd left OpenLDAP stopped with empty or
partial databases. Existing data is now moved to a hidden
.restore-previous directory in the same volume, removed when the restore
succeeds, and put back otherwise. OpenLDAP is restarted in both cases if
it was running. A leftover .restore-previous directory from an
interrupted restore blocks the next restore.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The replication password was not quoted in olcSyncRepl: a password with
spaces made the bootstrap fail. The default sync repl template now quotes
credentials. slapd can not store an escaped double quote followed by a
space in olcSyncRepl, so passwords with double quotes are rejected with an
explicit error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
openldap-ctl backup --clean removed every file older than N days in the
backup directory, including manual and pre-upgrade backups. It now only
removes backup files, and --clean-prefix limits it to backups starting
with a prefix.
Cron backups are named openldap-cron-<date>-<version> and cleaned with
--clean-prefix openldap-cron-.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the
CI/CD tool with osixia/dagger-build (Go 1.26.9).
- Add Dagger integration tests: default bootstrap, alternative schemas,
all compatible modules and schemas with every bootstrap feature on a
3-node replicated cluster with TLS required, backup/restore, simulated
upgrade and upgrade from previous releases.
- Fix bootstrap failing with "Argument list too long" with large schemas:
load them with LDIF include: lines, fail on missing schemas.
- Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so
pwdMinLength is enforced.
- Align the CI workflow with osixia/container-baseimage and add Dependabot.
- Document available schemas and modules and their incompatibilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A stripped trailing space before a folded line merged
"caseExactIA5Match" and "SYNTAX" in mailStorageDirectory, making
slapadd reject the schema during bootstrap. Regenerated with
openldap-ctl schema2ldif.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Verify that the backup files exist and are valid gzip archives before
stopping OpenLDAP or deleting existing data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first file of each prefix group was not stripped, so a trailing
empty line there split the entry completed by the following files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The RETURN traps overwrote each other and left the generated config
LDIF in /tmp. Use a single temporary directory removed by an EXIT trap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fail with an explicit error when the suffix does not start with dc=
(the root entry was created with an empty dc) and when more than 9
replication hosts are set (the generated rid would exceed 999).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without access to the entry pseudo-attribute the ACL rule had no
effect. Also allow objectClass, ou, o and dc so searches and tree
browsing work.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The password was expanded before eval and parsed again as shell code,
so spaces, $ or ; changed the hashed value or ran extra commands.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
version_lt kept the whole version as a single array element, so the
arithmetic comparison failed and the function always returned false.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the Postfix Book schema in .schema and cn=config LDIF formats, document its incompatibility with virtualMail, and improve debug output and validation during schema conversion and file moves. Update the base image to osixia/baseimage:alpine-2.0.0-rc3 and document the changes for 2.6.15-beta.
Bertrand Gouny
Bertrand
