Incompatible changes

You can upgrade DS 6.0 and later servers directly to DS 7.4.

For new DS servers, the setup command no longer enables support for changelog change numbers or change number indexing by default.

The documentation describes the new HDAP APIs for HTTP access.

The log publisher properties default-severity and override-severity now take single values.

The create-rc-script option -f|--outputFile has been removed.

The configuration property big-index-matching-rule has changed to big-index-extensible-matching-rule.

The configuration property log-control-oids has changed to log-controls and is true by default for new servers.

DS servers no longer return replication conflict entries by default.

New DS servers now write replication messages to the server error log (default: opendj/logs/errors).

Metrics formerly under cn=entry cache,cn=monitor have moved under cn=entry caches,cn=monitor.

The deployment key described in earlier DS 7 releases has been renamed deployment ID:

The setup command now requires a --deploymentId option.

$ /path/to/opendj/bin/dskeymgr create-deployment-id --deploymentIdPassword password
<deployment-id>
$ export DEPLOYMENT_ID=<deployment-id>

As a side effect of the change to allow mail addresses to include UTF-8 characters, DS no longer supports zero-length mail addresses.

The following changes affect proxy backend configurations:

The lookthrough-limit setting has been removed. Use time-limit instead.

The global advanced setting, cursor-entry-limit, has been replaced by a max-candidate-set-size setting, which corresponds to the maximum number of candidate entries that DS servers maintain in memory when querying attribute indexes.

The dsbackup command no longer supports specifying options before the subcommand.

With the introduction of the global configuration property, group-id-failover-order, which takes a comma-separated list of group IDs, commas are no longer permitted in group IDs.

The following changes affect proxy backend configurations:

When using the dskeymgr command to generate a PEM format certificate, you can no longer use the --alias option. The PEM format does not support aliases.

You may not provide both the --outputFile and the --alias arguments

There is an issue when running an upgrade from DS 6.5.0 to 6.5.1. If you did not set the je-backend-shared-cache-enabled property and accepted the default value of true prior to the upgrade, the value changes AFTER upgrade to false. You may have to reset this value to true for your deployments.

The status command has been rewritten, with the following notable changes:

The dsreplication status command no longer shows metrics for M.C. (missing changes) and A.O.M.C. (age of oldest missing change). Instead, it shows the replication delay.

The db/admin backend has been renamed db/adminRoot.

The global server configuration property, reject-unauthenticated-requests, a boolean, has been removed and replaced with the property, unauthenticated-requests-policy. The new property can be set to the following values:

The proxy backend configuration property service-discovery-mechanism has been renamed shard.

The encode-password command now displays the encoded password without additional characters.

Root DN users no longer belong to a special group or have alternate names, nor are their accounts stored in the configuration file, config.ldif. Instead, directory superusers are now stored in their own, separate backends whose base DN is the user DN.

Previously, root DN user profiles had an alternate-bind-dn property. This was used to allow you to specify bind DNs such as cn=Directory Manager instead of cn=Directory Manager,cn=Root DNs,cn=config. As the root user DNs are now top-level DNs, this mechanism is no longer supported.

Directory superuser privileges are now specified as ds-privilege-name values on their entries.

For new installations, defaults have changed for the following JE backend properties:

Default connection handler names have been shortened. The "Connection Handler" suffixes have been dropped from the names.

Server configuration expressions have been reimplemented to align with other ForgeRock Identity Platform software.

The setup command option --useJceks has been renamed to --useJceKeyStore.

When creating a schema provider for a customized JSON query matching rule, the type to create is now json-query-equality-matching-rule, rather than json-schema.

For new DS server installations, the file layout has changed to mutable data, which is changed by the server at runtime, from potentially immutable configuration data.

The command-line performance tools no longer accept printf-style format strings in templates. Instead, they use a {1}, {2}, {n} token syntax, where the {1} represents the first data source, {2} the second, and so on.

$ searchrate -p 1389 -b "dc=example,dc=com" -g "rand(0,2000)" "(uid=user.{1})"

Port-related options, and their short versions (such as -p for --port), no longer have default values when used in non-interactive mode:

The -t | --numThreads option for the following tools has changed to -t | --numConcurrentRequests:

The dsreplication command’s --baseDn option is now only available where it is applicable.

The product name has been aligned with the official name of the software release. The full product name starting with this release is ForgeRock Directory Services.

Manually changing the enabled property of an external change log domain returns incoherent results across the topology and is not supported.