Ds-7.1-Release-Notes.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
Release Notes Directory Services software provides an LDAPv3-compliant directory service, developed for the Java platform, delivering a high-performance, highly available, and secure store for the identities managed by your organization. Read these notes before you install or upgrade Directory Services software. The easy installation process, combined with the power of the Java platform, makes this the simplest and fastest directory service to deploy and manage. Directory Services software comes with plenty of tools. Directory Services software also oéers REST access to directory data over HTTP. Directory Services software is free to download, evaluate, and use for developing your applications and solutions. ForgeRock oéers training and support subscriptions to help you get the most out of your deployment. What's New Requirements Discover new features. Check DS prerequisites. Compatibility Fixes Review incompatible Review bug êxes, limitations, changes. known issues. Documentation Support Track documentation changes. Get support and training. ForgeRock Identity Platform® serves as the basis for our simple and comprehensive Identity and Access Management solution. We help our customers deepen their relationships with their customers, and improve the productivity and connectivity of their employees and partners. For more information about ForgeRock and about the platform, see https://www.forgerock.com. The ForgeRock® Common REST API works across the platform to provide common ways to access web resources and collections of resources. What’s New 7.1.1 ForgeRock maintenance releases contain a collection of êxes and minor RFEs that have been grouped together and released as part of our commitment to support our customers. For general information on ForgeRock’s maintenance and patch releases, see Maintenance and Patch Availability Policy. DS 7.1.1 is the latest release targeted for DS 7.1.0 deployments, and can be downloaded from the ForgeRock Backstage website. The release can be deployed as an initial deployment or updated from an existing DS 7.1.x deployment. Java DS 7.1.1 introduces support for Java 17 in addition to Java 11. Java 17 was very recent at the release of DS 7.1.1. ForgeRock has successfully completed all DS functional testing with Java 17, but has not thoroughly performance- and stress-tested DS with Java 17: In Java 17, the PCKS#12 keystore encryption/Mac algorithm has been upgraded to HmacPBESHA256 . Update to at least Java 11.0.12 if you have an application that runs Java 11 and must read the keystore. Use G1 GC (the default) or parallel GC, as suggested in Java Settings. Use of ZGC or Shenandoah is not recommended for production deployments at this stage. 7.1.0 Backup The dsbackup command now lets you set a non-default storage provider endpoint. For details, see Cloud Storage. Indexing The online rebuild index process is now less intrusive, more eéective, and more robust. When you run a rebuild-index command while the server is online, the backend database remains available for directory operations during the rebuild. Individual indexes do appear as degraded and unavailable while the server rebuilds them. A search request that relies on an index in this state may temporarily fail as an unindexed search. Logging DS log messages now include the authorization ID for every request. DS servers now support logging the internal delete operations triggered by entry expiration. If you have set the ttl-age and ttl-enabled properties for a backend, use this feature by conêguring an access log publisher to record messages about internal operations. When the server deletes an expired entry, it logs a message with "additionalItems":{"ttl": null} in the response. For background, see Entry Expiration. Passwords Password quality checks using the password quality advice control now ensure that proposed passwords are not in the password history. If the server ênds the proposed password in the password history, this appears in the failing criteria returned with the advice response control. In addition, the REST to LDAP response over HTTP now includes the password attribute type. Replication DS servers now let you restrict which replicas you trust to send updates. By default, all directory servers in a replication topology trust all replicas. If a replica allows an update, then other servers relay and replay the update without further veriêcation. This simpliêes deployments where you control all the replicas. In deployments where you do not control all the replicas, you can conêgure replication servers to accept updates only from trusted replicas. The trust depends on the certiêcate that a replica presents to the replication server when connecting. For details, see Trusted Replicas. DS servers now let you deêne replication group failover. This determines how a directory server selects the next group with replication servers to connect to when no replication server is available in the directory server’s own group. To activate replication group failover, set the global conêguration property, group- id-failover-order . For details on how a directory server chooses a replication server, see Replication Connection Selection. When a replica’s last change is older than the oldest change recorded in the replication server’s changelog, the replication server now records the problem in its log, and sends a message to the replica. When it receives the message, a 7.1 replica remains connected to the replication server, but refuses update operations, eéectively becoming read-only. A pre-7.1 replica closes the connection. In any case, the replica no longer applies replication updates. Its data diverges more and more from other replicas' data. Should this happen in your deployment, reinitialize the replica. For details, see Manual Initialization. DS servers now log more explicit messages when they discover duplicate server IDs. REST to LDAP This release introduces support for querying êelds of reference or reverseReference resources that are subtypes of the resources you are searching. As an example, suppose that devices and users are both subtypes of a "managed object" type. Also, suppose that devices have a deviceType êeld, that users have a surname êeld, and that a basic managed object has neither of these êelds. Now, your queries on a collection of managed objects can match properties of the referenced subtypes, such as /managedObjects?_queryFilter=deviceType+eq+phone , or /managedObjects?_queryFilter=surname+eq+Jensen . Samples The sample for building custom DS Docker images now has a USE_DEMO_KEYSTORE_AND_PASSWORDS setting that simpliêes getting started with a basic Docker image on your computer. For details, see opendj/samples/docker/README.md . Security DS directory and proxy servers now allow access to the root DSE operational attribute subSchemaSubEntry . This attribute indicates the entry holding the LDAP schema deênitions. Many applications retrieve this attribute, and the associated schema, to properly display or validate attribute values. If you cannot upgrade yet, update the conêguration of your DS server to grant all users read access to subSchemaSubEntry at least on the root DSE: For DS 7 directory servers, add subSchemaSubEntry to the attribute list in the "User-Visible Root DSE Operational Attributes" global ACI. For DS 7 directory proxy servers, add allowed-attribute:subSchemaSubEntry on the Root DSE access conêguration object. For details on granting access to subSchemaSubEntry on entries in directory data, see ACI: Access SubSchemaSubEntry Attribute. DS servers now support text-based Privacy-Enhanced Mail (PEM) keys and certiêcates for server key pairs, master keys, and trusted certiêcates. For details, see Use PEM-Format Keys. The DS Fingerprint Certiêcate Mapper now also supports êngerprints without colons. For example, the following SHA-256 êngerprints are equivalent: 0555BDA5E14C35A6A54E78DD3EFDEA5A665DE0DC9CC5187EE9CAA91ECD874B78 05:55:BD:A5:E1:4C:35:A6:A5:4E:78:DD:3E:FD:EA:5A:66:5D:E0:DC:9C:C5:18 :7E:E9:CA:A9:1E:CD:87:4B:78 Tools DS command options that have secrets as arguments now support :env and :file modiêer suìxes. For example, if the bind password is stored in a ~/.pass êle, use -- bindPassword:file ~/.pass . If the password is stored in the environment variable PASS , use --bindPassword:env PASS . Use the modiêers with the following options to provide the secret in an environment variable ( :env ), or in a êle ( :file ): --bindPassword[:env|:file] --deploymentKeyPassword[:env|:file] --keyStorePassword[:env|:file] --monitorUserPassword[:env|:file] --rootUserPassword[:env|:file] --set[:env|:file] (for setup proêle parameters) --trustStorePassword[:env|:file] The supportextract command now uses the jcmd command, if available, for heap dumps. Otherwise, it uses the jmap command. The addrate , authrate , modrate , and searchrate commands now include connection time as part of the response time for a request. Requirements IMPORTANT ForgeRock supports customers deploying DS in Docker containers and Kubernetes platforms, as well as bare metal and VM deployments, provided you follow the hardware and software requirements speciêed here. Other versions and alternative environments might work as well. When opening a support ticket for an issue, however, make sure you can also reproduce the problem on a combination covered here. Downloads The ForgeRock BackStage download site provides access to ForgeRock releases. File Description DS-7.1.1.zip Cross-platform distribution of the server software. Pure Java, high-performance