Create an optional administrator for user/group CRUD and password resets while protecting service accounts, password hashes/history and cn=config. Document the distinct data root, config root, admin and management roles.
Keep conditional history ACLs in their account directories as optional templates, activated by feature scripts after rendering in a temporary copy. Cover read-only sources, admin permissions, readonly history privacy and custom overrides.
Expose management hidden attribute lists through bootstrap environment defaults and keep ACL rendering in the LDIF template. Align management assets with database-readonly naming and drop the MONITOR and AUDITLOG flag suffixes.
Update documentation, migration notes and integration coverage for custom hidden attributes, empty effective lists, audit logging and monitoring.
Load a targeted pwdHistory deny rule only when ppolicy and the data read-only
account are enabled. Continue normal ACL evaluation for other identities so
administrator access, replication and later custom grants remain available.
Add regression scenarios for default permissions, disabled features, replicated
history and password reuse, custom grants and bootstrap fragment replacement.
Document that existing databases require an explicit ACL update.
The replication password was not quoted in olcSyncRepl: a password with
spaces made the bootstrap fail. The default sync repl template now quotes
credentials. slapd can not store an escaped double quote followed by a
space in olcSyncRepl, so passwords with double quotes are rejected with an
explicit error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the
CI/CD tool with osixia/dagger-build (Go 1.26.9).
- Add Dagger integration tests: default bootstrap, alternative schemas,
all compatible modules and schemas with every bootstrap feature on a
3-node replicated cluster with TLS required, backup/restore, simulated
upgrade and upgrade from previous releases.
- Fix bootstrap failing with "Argument list too long" with large schemas:
load them with LDIF include: lines, fail on missing schemas.
- Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so
pwdMinLength is enforced.
- Align the CI workflow with osixia/container-baseimage and add Dependabot.
- Document available schemas and modules and their incompatibilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fail with an explicit error when the suffix does not start with dc=
(the root entry was created with an empty dc) and when more than 9
replication hosts are set (the generated rid would exceed 999).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the Postfix Book schema in .schema and cn=config LDIF formats, document its incompatibility with virtualMail, and improve debug output and validation during schema conversion and file moves. Update the base image to osixia/baseimage:alpine-2.0.0-rc3 and document the changes for 2.6.15-beta.
Bertrand Gouny
