<?xml version="1.0" ?>
<?xml-stylesheet href="Changes.xsl" type="text/xsl"?>
<!DOCTYPE changelog
[
<!ELEMENT changelog (section+) >
<!ELEMENT section (versionchange+) >
<!ATTLIST section title CDATA #REQUIRED >

<!ENTITY % inlines "">

<!ELEMENT versionchange ( note?, change+ ) >
<!ATTLIST versionchange from CDATA #REQUIRED to CDATA #REQUIRED >

<!ELEMENT change (#PCDATA | list | emph | link | directive | config | code | vartext )* >

<!ELEMENT list ( item+ ) >
<!ELEMENT item ( #PCDATA | emph | link | directive | config | code | vartext )* >

<!ELEMENT note ( #PCDATA | emph | link | directive | config | code | vartext )* >

<!ELEMENT link (#PCDATA | emph | link | directive | config | code | vartext )* >
<!ATTLIST link href CDATA #REQUIRED>

<!ELEMENT directive (#PCDATA) >
<!ELEMENT emph (#PCDATA | emph | link | directive | config | code | vartext )* >
<!ELEMENT config (#PCDATA) >
<!ELEMENT code (#PCDATA) >
<!ELEMENT vartext (#PCDATA) >

]
>
<!--
   Copyright (c) 2000,2001 Dave Carrigan <dave@rudedog.org>
   All rights reserved.
      
   This module is free software; you can redistribute it and/or modify
   it under the same terms as Apache itself. This module is
   distributed in the hope that it will be useful, but WITHOUT ANY
   WARRANTY; without even the implied warranty of MERCHANTABILITY or
   FITNESS FOR A PARTICULAR PURPOSE. The copyright holder of this
   module can not be held liable for any general, special, incidental
   or consequential damages arising out of the use of the module.

   $Id: Changes.xml,v 1.5 2001/04/07 20:23:49 dave Exp $
-->

<changelog>
  <section title="Changes Between Major Revisions">
    <versionchange from="1.4" to="1.6">

      <change>
	All changes and bugfixes in the 1.4 releases.
      </change>

      <change>
	Completely rewrote the LDAP caching algorithms (see
	<link href="auth_ldap.html#caching">
	  the documentation on caching</link> for more
	  information). Here are the highlights of the changes:

	<list>
	  <item>
	    All cache sizes are measured in terms of cache
	    entries. <emph>Warning!! This affects the
	      <directive>AuthLDAPCacheSize</directive>
	      directive!!</emph> In version 1.4 and
	    before, this directive specified the size in megabytes. Now,
	    it specifies the size in cache entri es. <emph>If you
	      currently have this directive in a config file, it is
	      probably set way too high, and will use a significant amount
	      of server memory</emph>.
	  </item>

	  <item>
	    Deprecated the
	    <directive>AuthLDAPCacheCompareOps</directive>
	    directive. Apache will still accept the directive, but it
	    has no effect, other than to generate a warning in the
	    Apache logs.
	  </item>

	  <item>
	    The cache no longer grows without bounds. For servers with a
	    very active cache, this should make a big difference with
	    memory usage.
	  </item>

	  <item>
	    No longer use the cache management routines from the LDAP
	    SDK.  All LDAP operations are now cached, using a cache
	    that's specially designed for auth_ldap's authentication
	    methods.
	  </item>

	  <item>
	    If Apache has been compiled with MM support and auth_ldap
	    has been compiled with <code>-DWITH_SHARED_LDAP_CACHE</code>
	    then the cache is shared across all server instances.
	  </item>

	  <item>
	    Added a content handler that can be used to display the cache
	    statistics. To use it, add the following directives:
	    <config><![CDATA[
<Location /server/auth-ldap-info>
  SetHandler auth-ldap-info
</Location>]]></config>
	  </item>
	</list>

      </change>

      <change>
	Added support for a <directive>require dn</directive> directive,
	and a <directive>AuthLDAPCompareDNOnServer</directive>
	directive. See the
	<link href="auth_ldap.html#dir:AuthLDAPCompareDNOnServer">
	  documentation</link> for more information.
      </change>

      <change>
	auth_ldap now allows the user to specify any attribute when
	checking for group membership, by using the
	<directive>AuthLDAPGroupAttribute</directive> directive. If this
	directive is not specified, the default continues to be member
	and uniqueMember. Patch courtesy of 
	<link href="mailto:minfrin@sharp.fm">
	  Graham Leggett</link>.
      </change>

      <change>
	Added another directive,
	<directive>AuthLDAPGroupAttributeIsDN</directive>, which says
	whether to use the DN that was retrieved from the LDAP search,
	or to use the username passed by the client when doing group
	authorization. This directive, in conjuction with the previous
	one, allows us to use things like posixGroups for checks:
	<config>
AuthLDAPGroupAttribute memberuid
AuthLDAPGroupAttributeIsDN off
	</config>
      </change>

      <change>
	Added support for TLS under OpenLDAP. This can be enabled with
	the <directive>AuthLDAPStartTLS</directive> directive.
      </change>

      <change>
	Added a <directive>AuthLDAPEnabled</directive> that allows you
	to enable or disable auth_ldap on a directory-by-directory
	basis.
      </change>

      <change>
	Ensure that auth_ldap will follow referrals under OpenLDAP. This
	behavior was turned off in previous versions.
      </change>

      <change>
	Allow auth_ldap to dereference aliases, using the new
	<directive>AuthLDAPDereferenceAliases</directive> directive. By
	default, this directive is set to <vartext>always</vartext>.
      </change>

      <change>
	Now use <code>ldap_init()</code> when using OpenLDAP. Unless
	your OpenLDAP is really old, this probably won't affect you.
      </change>

      <change>
	Cleaned up a number of memory leaks.
      </change>

      <change>
	Can now be built with <code>autoconf</code>.
      </change>
    </versionchange>

    <versionchange from="1.1" to="1.4">
      <change>Support for SSL</change>

      <change>LDAP caching</change>

      <change>Improved NT support</change>

      <change>OpenLDAP support</change>

      <change>
	Added <directive>AuthLDAPRemoteUserIsDN</directive> directive
      </change>

      <change>
	Removed <directive>AuthLDAPRedundantServers</directive>
	directive
      </change>

      <change>Split source into multiple files</change>
    </versionchange>
  </section>

  <section title="Changes Between Minor Versions">

    <versionchange from="1.4.2" to="1.4.3">
      <change>
	Added a <link href="FAQ.html">FAQ</link>.
      </change>

      <change>
	Minor bugfixes and changes to documentation.
      </change>
    </versionchange>

    <versionchange from="1.4.0" to="1.4.2">
      <note>
	Version 1.4.1 was skipped due to a last-minute problem that
	cropped up just before its release.
      </note>

      <change>
	Fixed a bug where multiple users on a <directive>require
	user</directive> line would prevent authentication of the users.
      </change>

      <change>
	Got rid of the spurious "ldap_init" messages that were showing
	up in the log.
      </change>

      <change>
	Got rid of the meaningless "Could not release configuration
	mutex. Expect deadlocks." message that appeard on Unix-based
	versions of auth_ldap.
      </change>

      <change>
	Added some new flags to the Makefile for compilation on AIX.
      </change>

      <change>
	Made use of the <code>-Wall</code> flag optional, since not
	everybody uses gcc.
      </change>

      <change>
	Fixed some indented compiler directives that caused certain
	compilers to barf.
      </change>

    </versionchange>

    <versionchange from="1.3.4" to="1.4.0">

      <change>Production release of 1.3.x series</change>
      <change>Documentation rewrite</change>
      
    </versionchange>

    <versionchange from="1.3.3" to="1.3.4">

      <change>More Makefile tweaks</change>
      <change>Got rid const-correctness warnings when compiling with OpenLDAP</change>
    </versionchange>

    <versionchange from="1.3.2" to="1.3.3">
      <change>Documentation changes only</change>
    </versionchange>

    <versionchange from="1.3.1" to="1.3.2">
      <change>
	Fixed bugs with logging so that LogLevels would actually work correctly
      </change>
      <change>Fixed a bug that caused crashes under WinNT</change>
      <change>More Makefile tweaks</change>
      <change>Added OpenLDAP support</change>
      <change>Fixed potential endless loop if all LDAP servers are down</change>
      <change>
	Removed <directive>AuthLDAPRedundantServers</directive> directive
      </change>
    </versionchange>

    <versionchange from="1.3.0" to="1.3.1">
      <change>Various Makefile tweaks and fixes</change>
      <change>Added more fields to the module struct</change>
      <change>
	Added <code>eprintf</code> for systems that don't correctly link
	in the GNU C support library
      </change>

      <change>
	Added <directive>AuthLDAPRemoteUserIsDN</directive> directive
      </change>
    </versionchange>

    <versionchange from="1.2.3" to="1.2.4">
      <change>Documentation changes only</change>
    </versionchange>

    <versionchange from="1.2.2" to="1.2.3">
      <change>
	Fixed bug with failover logic that would cause spurious auth
	failures
      </change>
    </versionchange>

    <versionchange from="1.2.1" to="1.2.2">
      <change>
	Fixed string constants in source to be ANSI compliant
      </change>

      <change>
	Replaced calls to <code>free()</code> with
	<code>ldap_memfree()</code>.This makes a difference under NT.
      </change>

      <change>
	First release tested against Apache 1.3
      </change>
    </versionchange>

    <versionchange from="1.1" to="1.2.1">
      <change>
	Started using a different version numbering scheme. The second
	number is even for production releases and odd for beta
	releases. The third number is used for incremental fixes in
	releases. Anyone familiar with the Linux kernel will recognize
	this convention.
      </change>

      <change>Fixed a bug with log levels</change>

      <change>Started adding NT support</change>
    </versionchange>

    <versionchange from="1.0" to="1.1">
      <change>Added AuthLDAPRedundantServers directive</change>

      <change>Added support for caching LDAP connections</change>

      <change>
	Started using Airius in all examples (as per other vendors' LDAP
	documentation)</change>
      <change>Fixed some bugs with non-authoritative authentication</change>

    </versionchange>
  </section>
</changelog>
