+The \fBtry-\fP prefix instructs the proxy to continue operations
+if start TLS failed; its use is highly deprecated.
+
+.TP
+.B t-f-support {NO|yes|discover}
+enable if the remote server supports absolute filters
+(see \fIdraft-zeilenga-ldap-t-f\fP for details).
+If set to
+.BR discover ,
+support is detected by reading the remote server's rootDSE.
+
+.SH BACKWARD COMPATIBILITY
+The LDAP backend has been heavily reworked between releases 2.2 and 2.3;
+as a side-effect, some of the traditional directives have been
+deprecated and should be no longer used.
+
+.TP
+.B server <hostname[:port]>
+this directive is no longer supported. Use the
+.B uri
+directive as described above.
+
+.TP
+.B acl-authcDN "<administrative DN for access control purposes>"
+DN which is used to query the target server for acl checking; it
+is supposed to have read access on the target server to attributes used
+on the proxy for acl checking.
+There is no risk of giving away such values; they are only used to
+check permissions.
+.B The acl-authcDN identity is by no means implicitly used by the proxy
+.B when the client connects anonymously.
+See the
+.B idassert-*
+feature instead.
+This directive is obsoleted by
+.BR acl-bind ,
+and may dismissed in the future.
+
+.TP
+.B acl-passwd <password>
+Password used with the
+.B
+acl-authcDN
+above.
+This directive is obsoleted by
+.BR acl-bind ,
+and may be dismissed in the future.
+
+.TP
+.B idassert-authcDN "<administrative DN for proxyAuthz purposes>"
+DN which is used to propagate the client's identity to the target
+by means of the proxyAuthz control when the client does not
+belong to the DIT fragment that is being proxyied by back-ldap.
+This directive is obsoleted by
+.BR idassert-bind ,
+and may be dismissed in the future.
+
+.TP
+.B idassert-passwd <password>
+Password used with the
+.B idassert-authcDN
+above.
+This directive is obsoleted by
+.BR idassert-bind ,
+and may be dismissed in the future.
+
+.TP
+.B idassert-mode <mode> [<flags>]
+defines what type of
+.I identity assertion
+is used.
+This directive is obsoleted by
+.BR idassert-bind ,
+and may be dismissed in the future.
+
+.TP
+.B idassert-method <method> [<saslargs>]
+This directive is obsoleted by
+.BR idassert-bind ,
+and may be dismissed in the future.