BREAKING: v2 requires newly issued licenses — licenses from earlier releases are rejected. Migration: generate and install a license for v2 before starting the upgraded service.
BREAKING: Entry storage uses the v2 data model — tools that read the former database layout directly no longer work. Migration: let IdentityScribe migrate existing data during the upgrade and update direct readers to the uuid, dn, etag, createdAt, and updatedAt fields or, preferably, a supported channel.
BREAKING: Event timestamps use ISO 8601 UTC fields — consumers expecting createTimestamp or modifyTimestamp no longer find those properties. Migration: read createdAt and updatedAt and treat stored timestamps as UTC.
BREAKING: The checkpoint idle setting was renamed — the old key no longer controls checkpoint timing. Migration: replace ldap.idlePeriodForCheckpoint with ldap.idlePeriod; the default is 5 seconds.
Added
Stored entries expose UUID and distinguished-name fields — Direct database readers can access both identifiers without decoding entry data.
Operational attribute names adapt to the source directory — Product detection resolves the names used for entryUUID, createTimestamp, modifyTimestamp, and eTag.
Object-class attributes are always observed — objectClass and structuralObjectClass remain available to synchronization and searches.
Entry metadata and attribute values are stored separately — Dedicated attribute-value storage holds each entry’s data.
ETags use a longer hash — The extra hash bytes reduce the chance of collisions.
Distinguished-name lookups ignore case — Entries resolve even when the requested DN uses different casing.
Commit tracking survives transaction ID rollover — Long-running installations no longer risk collisions when database transaction identifiers wrap.
Continuous search no longer depends on modifyTimestamp or revision — This avoids sending a change notification for every update to an entry.
Attribute sets can be precomputed — Operators can define sets that reduce work when returning search results.
Partial-match attributes can use index coverage — Configured attributes accelerate substring and approximate searches.
LDAP is available as a data-access channel — Clients can query IdentityScribe through the LDAP protocol.
Local searches require complete observed data — IdentityScribe executes a search locally only when every filtered, sorted, and requested attribute is observed.
LDAP paging and sorting controls are supported — Clients can use Simple Paged Results, Server Side Sorting, and Virtual List View.
LDAP subordinate-subtree scope is supported — subordinate_subtree (3) includes descendants at any depth but not the base entry itself, as described in draft-sermersheim-ldap-subordinate-scope.
Approximate and extensible DN filters are supported — These extend the existing and, or, not, equality, substring, greaterOrEqual, lessOrEqual, and present filters:
approximate matches a close value; for example, (givenName~=John) can match John or Jon.
extensible dn match includes the entry DN in matching; for example, (ou:dn:=Engineering) matches an ou value of Engineering beneath the base DN.
ETags change with observed attribute values — Any change to an observed value produces a new etag.
Operations unavailable locally forward to the source LDAP server — Clients keep access to upstream capabilities.
Prometheus exposes detailed service metrics — Operators can collect them from the Prometheus endpoint.
Read-only channel instances can run without transcription — For load balancing and similar deployments, start IdentityScribe with one of these options:
the --readonly (-r) flag
IDENTITY_SCRIBE_READONLY=1, IDENTITY_SCRIBE_READONLY=true, or IDENTITY_SCRIBE_READONLY=yes environment variable
IDENTITY_SCRIBE_TRANSCRIBE_ENABLED=0, IDENTITY_SCRIBE_TRANSCRIBE_ENABLED=false, or IDENTITY_SCRIBE_TRANSCRIBE_ENABLED=no environment variable
Fixed
Empty operations no longer create events — History contains only events with an actual change.
Automatic storage ranges no longer skip a boundary — Generated ranges now include the correct records.
Renaming an entry updates its naming attributes — The new distinguished name and naming values stay consistent.
Every environment setting accepts both supported input forms — Use an IDENTITY_SCRIBE_<...> environment variable or a -D<...> command-line property; for example, IDENTITY_SCRIBE_READONLY=1 identity-scribe or identity-scribe -DREADONLY=1.
Licenses work with clustered LDAP servers — A license remains valid across nodes in the same LDAP cluster.
