General

Kubernetes deployment - From v9.1 on, DirX Directory is also delivered in form of container images. The release contains also a Kubernetes example project which could be used to evaluate and experiment with the container images. For details, please check the new DirX Directory Containerization document.

Code signing - verification of binaries: see Section 2.6 for details.

License control - verification of DirX Directory license: see Section 1.2.8 for details.

Time-based one-time password two-factor authentication (TOTP 2FA) for DirX Directory users: see chapter "14.8 Using Two-Factor Authentication (2FA)" in DirX Directory Administration Guide for details. Important note for shadowing configurations: TOTP 2FA should only be configured for a user, if all servers in a shadowing configuration support it (all servers are already updated to V9.1 version).

New dirxcp command "verify_abbr" was introduced to check the installed abbreviation files against the schema stored in the DSA. In connection with that new feature, the dirxabbr file has been synchronized to the default schema. Abbreviations that are not part of the default schema have been commented out and moved into a separate section labelled as "Historical Abbreviations". To reuse them if needed, move the selected abbreviations from this section to an application- specific dirxabbr-ext file and uncomment them there. See the section "Abbreviation Files" in the DirX Directory Administration Reference for details.

New DSE type checks have been introduced in dbamverify, which upon detection of errors previously unseen, will block any new backups to be made. Therefore it is highly recommended to take a backup right before switching to the new version.

Partial support for 4 bytes UTF-8 characters (emojis) in attributes with Directory String syntax was added. For details on limitations see Section 5.4.1 (DirX server limitations)

Optimized import-dbconfig Tcl procedure for attribute index configuration The old version of this procedure processed all lines in DirXDBConfig.out index configuration file sequentially and issued one 'db attrconfig' command per 'attributeIndex: …​' line, creating all requested index types for this attribute. In the new version it combines up to 200 'attributeIndex: …​' lines for one index type (e.g: INITIAL, …​) into one single 'db attrconfig' command. This new approach is much faster, than the old method.

Software Bill of Materials file (DirX-Directory-sbom.json) containing information about delivered components and their versions was added to the DirX Directoty installation package.

SDX-1039: Non RFC complient Server Side Sorting
The Server Side Sorting implementation did not behave as described in RFC-2891#section-2, point 4. It specifies that if the criticality is false and the server "for some reason cannot sort the search results", then "the server should return all search results unsorted". This is fixed now. If you want to make sure that the result is sorted, set the criticality to true.

SDX-1010: New restriction was introduced in the DSA for search filters
A huge number of filter items can significantly increase the memory consumption of a DSA during the evaluation of the filter in a search operation. This could lead to consuming the whole available CTX memory, causing problems in other parallel running operations (e.g.: DISP update) as well. To avoid this situation, a limit was introduced in the DSA (controlled via environment variable DIRX_SEARCH_FILTER_ITEM_LIMIT) that sets the max upper limit for filter items contained in a search operation. If this environment variable is not set, the default limit value of 5000 filter items is used.

SDX-1006: DSA crash on index configuration
A software bug in libdbam could result in a DSA crash when a db attrconfig command was executed and the database had more than 800 configured indexes.

SDX-991 userPassword attribute added with dirxadm visible in DSA logs in cleartext
The command line of modify commands executed with dirxadm are logged in ADM*, DSA_EXC* and audit logs. Therefore if the UP attribute was added with dirxadm, the PW value was visible in clear text in the logged command line.
With this modification the behavior has changed, the added PW value will be replaced with '**' in the logged command line.

SDX-965: Incorrect output in lob show -pretty mode
Software bug in dirxadm. The lob show command in -pretty mode produced incorrect output, every line was left aligned. Therefore a complex specification filter containing several And/Or/Not items was incorrectly displayed. Fix: Use correct indentation according to the displayed structure.

internal: notes for dbamverify - related to automatic database verification
In this patch version, the handling of binary backup header was improved. If the dbamverify is called with a subset of the components, the verification result components will not be reset, only the newly verified components will be added in addition. This means, that it is suported now to do the backup verification in individual steps. For example, the following sequence: + — Save the backup without verification using dirxbackup -n -S backup — Verify the D, S and T components by using dbamverify -DST backup — Do the rest of the verification by using dbamverify -AX backup This sequence will result in a fully verified backup file.

Compares the signature file dirx.lic.sig with the dirx.lic file in the installation.

Compares the parameter settings in the dirx.lic file against the current installation and logs the results in the DSA’s fatal log file ($DIRX_INST_PATH/server/log/fatalDSA*).

If the violation is because vendor support has expired or because the installation has exceeded the maximum number of directory entries, the DSA continues to run or starts but generates warning messages in the DSA’s fatal log file. For example, if your license allows 100000 entries but your installation has 120000, the service still starts but you will find WARNING messages in the DSA’s fatal log file about the problem and you may not be able to open trouble tickets if your license settings are not met.

For all other types of violation, the DSA shuts down or does not start.