Feature Design Documents

---

This page serves as a central collection point for feature design documents. Feature design documents are organized by the release where the feature is implemented.

If you are adding a new design document, use the template. Don’t forget to add a link under the proper release on this page!

Ansible DS Collection

• User Facing Design
• Backup Role

Roadmap

• Directory Server Roadmap

Feature design advice

• Configuration Migration and Upgrade

Backend Replacement

• Phase 1 & 2 - separate BDB code & confguration
• Phase 3 - Generic DB layer
• Phase 4 - Implement LMDB
• LMDB Import Design
• Berkeley Database Deprecation

Ansible

• Ansible DS

389 Directory Server 3.0

• Berkeley Database Deprecation (LMDB database is used by default) and its impact
• MFA Operation Note For Auditing
• Audit JSON Logging
• Session Tracking Control

389 Directory Server 2.6

• Deferred updates in memberof plugin

389 Directory Server 2.5

• LMDB support (Berkeley Database still used by default)

389 Directory Server 2.3

• Rust by default in 2.3
• Security Audit Log
• Expanded Backup
• Alias Entries Plugin
• HAProxy Connection Proxy Design –> might only land in 2.4
• Dynamic handling of the number of worker threads
• Store Case-Sensitive DN in Entry
• Audit Log Display Entry Attributes

389 Directory Server 2.x

• Account Policy Inactivity & Expiration
• Access Log Statistics Improvements
• Improve Automember Fixup Task
• Slapi_memberof
• Connection Table Multi List
• Pluggable Backend –> move to LMDB
• OTP Password Policy
• LDAPI DN Rewritter
• RetroCL exclude attributes
• Database Compaction Scheduling
• DB Locks Monitoring
• Global Counters Contention
• Support of In Chain matching rule
• Account Policy Plugin Inactivity And Expiration

389 Directory Server 1.4.4

• Replication Agreement Bootstrap Credentials
• Replication Changelog moved into main database
• Openldap to 389 Migration
• Mapping Tree Assembly Rework

389 Directory Server 1.4.3 (RHEL 8.x)

• Diskspace Monitoring
• Database Monitoring in dsconf
• dbgen replacement in dsctl
• Search rewriters
• New Keywords in Access Log RESULT Message
• Reject Internal Unindexed Searches
• Temporary Password policy
• Automatic virtual attribute toggle

389 Directory Server 1.4.2 (RHEL 8.2)

• Healthcheck Tool
• Protection of NSS DB password
• Password Upgrade On Bind
• Filter Syntax Validation

389 Directory Server 1.4.1 (RHEL 8.1)

• Container Integration
• Replication Agreement Status Message Improvements
• CLI Tool and Lib389 Design Guide
• Monitor Replication with CLI and Web Console Design Guide
• LDIF generation (dbgen) added to dsctl

389 Directory Server 1.4.0 (RHEL 8)

• Automembership Plugin Postop Modify
• New Password Poliy Syntax Checks
• New Python CLI Tools
• New Web UI (Cockpit plugin) –> Design doc in the works…

389 Directory Server 1.3.9 (RHEL 7.7)

• Automembership Plugin Postop Modify (backported from 1.4.0)

389 Directory Server 1.3.8 (RHEL 7.6)

• Just bug fixes

389 Directory Server 1.3.7 (RHEL 7.5)

• Replication Diff Tool
• Dynamic Certificate Mapping
• Pblock Breakup
• Password Policy Controls

389 Directory Server 1.3.6 (RHEL 7.4)

• Schema with Multiple Search Paths
• New Error Log Format and Severity Level
• Configuration Reset
• Autotuning Memory and Threads
• PBKDF2
• Change to tcmalloc for Memory Allocator

---

389 Directory Server 1.3.5 (RHEL 7.3)

• Shadow Account Support
• Password Expiring Control Configuration
• Disable Instance Script Installation
• Audit Logging Improvements
• Multiple Logging Backends
• High Resolution Logging Timestamps
• Enhanced Account Tools for Account Policy Plugin
• Allow usage of OpenLDAP libraries that do not use NSS for crypto
• Systemd Ask Password
• Replication Convergence Improvement - This feature will most likely be backported to previous versions
• Extended Op Plug-in Transaction Support

---

389 Directory Server 1.3.4

• Nunc Stans
• Audit Events
• MemberOf Plugin Scoping
• Retro Changelog Plugin Scoping
• MemberOf Plugin Auto Add Objectclass

---

389 Directory Server 1.3.3

• AES Password Based Encryption
• Referential Integrity Plugin Configuration
• MemberOf Plugin Shared Configuration
• Replication Changelog Trimming Interval
• Dynamic Plugins
• Available NSS Ciphers
• Windows Sync Enhancements
• Account Policy – alwaysRecordLoginAttr
• Content Synchronization Plugin

---

389 Directory Server 1.3.2

• POSIX Winsync SID Enhancements
• LDAPI and Access Control
• DNA Remote Server Setting
• Fine Grained ID List Size
• Content Synchronization Plugin (SyncRepl)
• Plugin Internal Operation Logging
• Configuring Scope for Referential Integrity
• Replication of Custom Schema
• Read Entry Controls
• Intervals to compact Primary DB and Replication Changelog DB

---

389 Directory Server 1.3.1

• Plug-in Transaction Support
• Normalized DN Cache
• Configurable Allowed SASL Mechanisms
• SASL Mapping Improvements
• Configurable SASL Buffer
• Replication Retry Settings
• Instance Script Improvements
• Access Log Analyzer Improvements
• Replication Protocol Timeout
• Password Administrators
• Referential Integrity Plugin and Replication
• MemberOf Plugin - Skip Nested Groups

---

389 Administration Server 1.1.36

• Register Remote Servers using register-ds-admin.pl
• Using 389 Console with Anonymous Access Disabled
• Security Modules, Console, and SELinux

---

Web-based Directory Server Management Console

• NEW Web-based Console
• LDAP REST API
• “o=dmc” Design Page

---

Older Design Documents

• 64-bit Counters
• Access Control and Moddn
• Account Policy
• “aclutil” Design
• Attribute Encryption
• Changelog Trimming Interval
• CLEANALLRUV Design
• Creation of Explicit Role Scoping
• Database Architecture
• Disable Virtual Attribute Lookups
• Diskspace Monitoring
• DNA Plugin Remote Server Settings
• Dynamic Schema Reload
• Entry USN
• Get Effective Rights
• Get Effective Rights for “not present” Attributes
• LDAP Transactions
• LDAP whoami
• Legacy Password Policy
• Matching Rule API
• MemberOf Grouping Enhancements
• Password Migration
• Password Policy API
• Plugin Ordering
• Plugin Design
• Plugin Bind DN Tracking
• POSIX Winsync SID Enhancements
• Replication Session Hooks
• SASL/GSSAPI/Kerberos
• Server to Server Connections
• Simple Paged Results
• Slapi_Task API
• Static Group Performance
• Subtree Rename
• Syntax Validation
• Task Initiation
• Task Initiation Design
• Track Password Updates
• Windows Sync Plugin API

---

Plugin Design Documents

• Auto Membership Plugin
• DNA Plugin Proposal
• DNA Plugin
• Linked Attributes Plugin
• Managed Entry Plugin
• MemberOf Plugin
• Root DN Access Control Plugin
• Winsync POSIX Plugin

---

Replication Design Documents

• CSN pending list and ruv updates
• Change log processing
• Agreement Status
• Bootstrap Credentials
• Integrate changelog into backend database
• Replication troubleshooting WIP

---

Design Discussions

• Token Auth
• Entry State Resolution
• High Contention with Entry Cache
• Separate Suffix for Tombstones/Conflicts
• Managed Entry Plug-in Enhancement
• Managing Replication Conflicts
• Logging Performance Improvement
• Dsadm and Dsconf
• Nunc Stans Workers
• Cache Redesign
• Plugin Version 4
• Password extensibility
• Transactional Operations
• PAD/PAC anchor cretaino