B. Upgrading from 2.6.x

This section documents the steps necessary to upgrade from the latest OpenLDAP 2.6.x version.

The standard upgrade procedure documented in Maintenance must be completed prior to the steps documented in this section.

B.1. mdb backend

The underlying MDB database engine was upgraded to the LMDB 1.0 series in OpenLDAP 2.7. Due to a file format change, it is mandatory for existing slapd-mdb(5) databases to be exported prior to upgrade using an OpenLDAP 2.6 slapcat binary. The exported databases must be reloaded using an OpenLDAP 2.7 slapadd after OpenLDAP has been upgraded.

B.2. ppolicy overlay

Starting with OpenLDAP 2.7, it is now possible to express password policy selection with rule based definitions. As such, setting the pwdPolicySubentry attribute by hand is discouraged. It is now essentially a virtual attribute that represents the active policy as configured via the rule based definitions.

B.3. lloadd proxyauthz feature

The feature/olcBkLloadFeature option has now been split into enable/disable keywords to allow for features to have a default on/off state. The current "feature" keyword is still supported and means broadly the same as "enable", but it is highly recommended to migrate usage to the new keyword set.

Additionally, the default proxyauthz feature flag has changed from disabled in 2.6 to enabled in 2.7. This setting should only be set to disabled in environments where the backend implementation does not understand the control. In all other situations this is a potential security gap and the full ramifications of disabling it must be carefully considered.