The embedded Crowd integration mandates a Base DN in an LDAP Directory, but this was not the case for previous versions. As such, this prevents a customer to upgrade to Confluence 3.5.x, because their LDAP directory (100,000+ persons) does not use a base DN. Also, assuming that users and groups records always share the same base DN is an issue as well (this would not work either for this customer). Both limitations need to be removed from Confluence, i.e. there should be two optional base DN for users and groups searches.
Note: this is similar to
CWD-1971 (and present, I guess, because this is Crowd embedded).