A. Changes Since Previous Release

The following sections attempt to summarize the new features and changes in OpenLDAP software since the 2.6.x release and the OpenLDAP Admin Guide.

A.1. New Features and Enhancements in 2.7

DNS SRV record support now also supports ldaps.
Options LDAP_OPT_X_TLS_URIS, LDAP_OPT_X_TLS_CACERTURIS: allow certificates and keys to be read from URIs. This enables support for TPM chips, smartcards, or Hardware Security Modules.
Support for LDAP_OPT_REFHOPLIMIT in ldap.conf: previously the option was only accessible via explicit ldap_set_option() calls.
Support for fractional seconds in timeouts in ldaprc: previously the ldaprc parser only supported integer seconds.
Debug messages now include timestamp and thread ID.
Better error reporting during connection failures: error codes distinguish hostname lookup failures from network connection failures.
Support for mbedTLS. Another TLS library with smaller footprint than OpenSSL and better support than GnuTLS.
Documented the ldap_pvt_put_filter() function, which has been available as a non-standard OpenLDAP-specific function since OpenLDAP 2.1.

The option -o remove-sids= has been added for stripping obsolete server IDs while importing an LDIF file.
slapadd will now implicitly strip dynamic attributes while importing an LDIF file.

There is now an explicit "increment" permission for ACLs.
ACLs can now be applied to operations and controls.
A new restrictop keyword can be used to limit combinations of operations and controls.

Now using LMDB 1.0.
Added support for page-level database encryption and/or checksums.
Added support for configurable page size, up to 64KB. Using larger pages allows using longer RDNs and multival values.

These features were strongly deprecated in 2.6 and removed in 2.7.

back-perl has been superseded by back-sock.
back-sql lacks an official maintainer and had to be removed from the release. If someone from the community is willing to maintain it, back-sql could be restored in a future release series.