Version History

All versions All versions forward

Version v2.6.0 (2025-07-21)

Added

Scheduled reconciliation keeps stored entries aligned with LDAP — IdentityScribe periodically verifies entries against the source directory.
- Set either interval or cron to schedule the maintenance task. See the Configuration Reference for options and defaults.
- One reconciliation runs after the initial sync and continuous search start, regardless of the schedule, to catch deletions that occurred during downtime.
- Enable scheduled reconciliation if:
  - Your LDAP server has unreliable persistent-search delete notifications.
  - You need periodic consistency checks for compliance.
  - You experience frequent network partitions.
- New Prometheus metrics for reconciliation:
  - scribe_reconciliation_entries_verified_total (counter): Number of entries verified as present in LDAP during reconciliation.
  - scribe_reconciliation_entries_deleted_total (counter): Number of entries deleted (synthetic deletes emitted) during reconciliation.
  - scribe_reconciliation_duration_seconds (summary/timer): Total time taken for a full reconciliation run.
  - scribe_reconciliation_last_run_timestamp_seconds (gauge): Unix timestamp of the last completed reconciliation run.
Maintenance tasks can run on a schedule — See the Configuration Reference for options and defaults.
- These services support maintenance tasks:
  - Database: perform routine storage upkeep after startup.
    - New Prometheus metrics for database maintenance:
      - database_maintenance_duration_seconds (timer): Duration of each maintenance run.
      - database_maintenance_failed_total (counter): Number of failed maintenance runs.
      - database_maintenance_last_run_timestamp_seconds (gauge): Unix timestamp of the last attempted maintenance run.
  - Scribe: reconcile stored entries with the LDAP server.
    - The Scribe maintenance metrics are listed above.
Entry data compresses automatically — This reduces storage and network transfer size.
- IdentityScribe selects the compression algorithm from the data characteristics.
- Applications need no configuration changes.
- Typical LDAP entries can use up to 70% less storage.
- Prometheus metrics report compression effectiveness and cost.
LDAP entries keep their identity through restores and renames — Additional matching safeguards protect both initial and continuous synchronization, including rare directory restore and rename cases.
Prometheus scrapes return cached metrics — Metrics refresh on a regular interval so scrapes do not wait for collection work.
- Set monitoring.prometheus.scrapeInterval to control the refresh interval. The default is 15 seconds.
```
monitoring.prometheus.scrapeInterval = 15s
```

Fixed

License checks retry transient dependency failures — Connectivity failures involving LDAP or database services no longer crash the service immediately. IdentityScribe retries up to five times.
Attribute changes keep their configured casing — Change logs and event descriptions no longer lowercase attribute names, so downstream systems receive the configured names.
Reconciliation ignores unobserved operational attributes — It no longer reports false removals for attributes such as createTimestamp, modifyTimestamp, or entryUUID; history contains only changes IdentityScribe actually observed.

Breaking

BREAKING: Monitoring uses about half as many time series — dashboards and alerts that depend on the former formats may stop matching. Migration: update them to the formats below before upgrading, test them in staging, and monitor memory use after deployment.
- Performance Impact
  - ~50% fewer metrics: Reduced from ~1,600 to ~800 total metrics
  - Memory: Rolling windows expire after 5 minutes, reducing memory use and keeping measurements current.
  - Cardinality: Service-transition and LDAP-search labels use fewer combinations.
  - Precision: Summary percentiles replace histogram approximations.
  - Storage: Fewer time series require less monitoring storage.
- Monitoring Recommendations
  - Update dashboards to use new metric formats before upgrading
  - Test queries in a staging environment before using the new metrics in production.
  - Verify alerts that depend on histogram buckets before upgrading.
  - Monitor memory usage after upgrade (should decrease)
Detailed Changes
- Service Transition Metrics
  
  Before:
```
service_transition_seconds{service="X",from="new",to="starting",...}
service_transition_seconds{service="X",from="starting",to="running",...}
service_transition_seconds{service="X",from="running",to="failed",...}
```
  After:
```
service_transition_seconds{service="X",type="startup",...}
service_transition_seconds{service="X",type="restart",...}
service_transition_seconds{service="X",type="failure",...}
```
  Changes:
  - Removed: from and to tags (high cardinality)
  - Added: type tag with fixed categories (startup, restart, failure, shutdown)
  - Filtered: Startup noise transitions (new → starting)
  - Percentiles: Reduced from 5 to 2 percentiles (0.5, 0.95)
  Migration:
  - Update dashboards to use type instead of from/to tags
  - Categories: startup, restart, failure, shutdown
  Terminal window
```
# Old query
service_transition_seconds{from="starting",to="running"}

# New query
service_transition_seconds{type="startup"}
```
- LDAP Search Metrics
  
  Before: Histogram with 50+ buckets
```
channel_ldap_search_time_seconds_bucket{...,le="0.001"} 0
channel_ldap_search_time_seconds_bucket{...,le="0.002"} 1
[... 50+ buckets ...]
```
  After: Summary with selected percentiles
```
channel_ldap_search_time_seconds{...,quantile="0.5"} 0.043
channel_ldap_search_time_seconds{...,quantile="0.95"} 0.051
channel_ldap_search_time_seconds{...,quantile="0.99"} 0.052
```
  Changes:
  - Format: Histogram → Summary
  - Percentiles: Reduced to 0.5, 0.95, 0.99 (high cardinality optimization)
  - Buckets: Removed all histogram buckets (50+ → 0)
  Migration:
  - Replace histogram_quantile() with direct quantile label access
  - Update SLI/SLO calculations to use summary percentiles
  Terminal window
```
# Old query
histogram_quantile(0.95, rate(channel_ldap_search_time_seconds_bucket[5m]))

# New query
channel_ldap_search_time_seconds{quantile="0.95"}
```
- Processing Time Metrics
  
  Before: Histogram with SLO buckets
```
scribe_processing_time_seconds_bucket{entryType="user",phase="diffing",le="0.001"} 5
scribe_processing_time_seconds_bucket{entryType="user",phase="diffing",le="0.002"} 25
[... many buckets ...]
```
  After: Summary with full percentiles
```
scribe_processing_time_seconds{entryType="user",phase="diffing",quantile="0.5"} 0.004
scribe_processing_time_seconds{entryType="user",phase="diffing",quantile="0.75"} 0.007
scribe_processing_time_seconds{entryType="user",phase="diffing",quantile="0.9"} 0.015
scribe_processing_time_seconds{entryType="user",phase="diffing",quantile="0.95"} 0.050
scribe_processing_time_seconds{entryType="user",phase="diffing",quantile="0.99"} 0.487
```
  Changes:
  - Format: Histogram → Summary
  - Percentiles: Added 0.5, 0.75, 0.9, 0.95, 0.99 (standard set)
  - Buckets: Removed all histogram buckets
  Migration:
  - Update queries to use quantile labels instead of histogram_quantile()
  - SLIs can now use direct percentile values
  Terminal window
```
# Old query
histogram_quantile(0.90, rate(scribe_processing_time_seconds_bucket[5m]))

# New query
scribe_processing_time_seconds{quantile="0.9"}
```
- New Entry Codec Metrics
  
  Added new compression and entropy metrics:
```
scribe_entry_encode_bytes{codec="lz4|zstd|none",kind="raw|compressed",quantile="0.5"} 1440
scribe_entry_decode_bytes{codec="lz4|zstd|none",kind="raw|compressed",quantile="0.5"} 1440
scribe_entry_encode_compression{codec="lz4|zstd",le="5.0"} 4
scribe_entry_encode_entropy{le="25.0"} 137598
```
  Reports:
  - Encoded and decoded sizes by codec.
  - Compression thresholds at 85% and 95%.
  - Entropy distribution used for compression choices.
  - Percentiles 0.5, 0.75, 0.9, 0.95, 0.99.