Version History

Version v2.7.0 (2025-11-14)

Added

• Virtual attributes are computed when requested — Large multi-valued attributes, including sets with more than 100,000 values, no longer need to be stored with every entry.

  • Define them with LDAP filter expressions and variable substitution.
  • Two patterns are available:
    • Cross-reference: Compute relationships to other entries, such as every group a user belongs to through groupMembership.
    • Self-reference: Filter with the current entry’s attributes, such as a userLevel derived from departmentNumber.
  • Values stay current without consuming entry storage.
  • LDAP clients can request, filter, and sort virtual attributes like stored attributes.
  • Existing database coverage accelerates virtual-attribute searches where applicable.

  Configuration Example:

  ldap {
    virtualAttributes {
      # Cross-reference: Find all groups where this user is a member
      groupMembership {
        filter = "(member={{current.entryDN}})"
        value = "{{other.entryDN}}"
      }
  
      # Self-reference: Compute user level based on department
      userLevel {
        filter = "(departmentNumber=Executive)"
        value = "senior"
      }
    }
  }
  
  transcribes = [
    {
      type = "user"
      ldap {
        attributes = """
          cn, sn, mail, groupMembership, userLevel
        """
        # groupMembership and userLevel will be computed virtually
      }
    }
  ]

  Common uses:

  • Large multi-valued attributes such as equivalentToMe on roles, without timeouts or database bloat.
  • Reverse lookups without redundant stored data, such as every group a user belongs to.
  • Values derived from an entry’s own properties, such as access levels or flags.

  See LDAP Configuration for configuration and more examples.

Fixed

• Checkpoints advance during continuous synchronization — They previously advanced only while the system was idle, delaying offline-delete detection and reconciliation under sustained traffic.
• Compression monitoring uses 40–50% fewer time series — Memory use and dashboard query time drop while actionable thresholds remain available. Existing dashboards need no changes.
• LDAP connection metrics no longer become negative — Prometheus now reports the active connection count accurately.
• Extended DN searches return accurate matches — LDAP filter processing now handles extended DN matching correctly.
• Forwarded LDAP operations carry more diagnostic context — Logs now identify the relevant entry types for configuration and troubleshooting.
• Common operational-attribute filters require less database work — LDAP searches avoid unnecessary processing for these attributes.
• Database helper functions run with less overhead — Their lower-cost implementation reduces work during searches.
• Searches use configured indexes more reliably — IdentityScribe now keeps the statistics needed to choose them.
• LDAP forwarding metrics register reliably — The reorganized metrics prevent registration errors. Existing dashboards must be updated for the new format.