== SSSD 1.13.1 ===

The SSSD team is proud to announce the release of version 1.13.1 of
the System Security Services Daemon.

As always, the source is available from https://fedorahosted.org/sssd

RPM packages will be made available for Fedora shortly.

== Feedback ==

Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
    https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
    https://lists.fedorahosted.org/mailman/listinfo/sssd-users

== Highlights ==
  * Initial support for Smart Card authentication was added. The feature
    can be activated with the new pam_cert_auth option
  * The PAM prompting was enhanced so that when Two-Factor Authentication
    is used, both factors (password and token) can be entered separately
    on separate prompts. At the same time, only the long-term password is
    cached, so offline access would still work using the long term password
  * A new command line tool sss_override is present in this release. The
    tools allows to override attributes on the SSSD side. It's helpful in
    environment where e.g. some hosts need to have a different view of POSIX
    attributes than others. Please note that the overrides are stored in
    the cache as well, so removing the cache will also remove the overrides
  * New methods were added to the SSSD D-Bus interface. Notably support
    for looking up a user by certificate and looking up multiple users
    using a wildcard was added. Please see the interface introspection or
    the design pages for full details
  * Several enhancements to the dynamic DNS update code. Notably, clients
    that update multiple interfaces work better with this release
  * This release supports authenticating againt a KDC proxy
  * The fail over code was enhanced so that if a trusted domain is not
    reachable, only that domain will be marked as inactive but the backed
    would stay in online mode
  * Several fixes to the GPO access control code are present 

== Packaging Changes ==
  * The Smart Card authentication feature requires a helper process
    p11_child that needs to be marked as setgid if SSSD needs to be able
    to. Please note the p11_child requires the NSS crypto library at the moment
  * The sss_override tool was added along with its own manpage
  * The upstream RPM can now build on RHEL/CentOS 6.7 

== Documentation Changes ==
  * The config_file_version configuration option now defaults to 2. As
    an effect, this option doesn't have to be set anymore unless the config
    file format is changed again by SSSD upstream
  * It is now possible to specify a comma-separated list of interfaces in
    the dyndns_iface option
  * The InfoPipe responder and the LDAP provider gained a new option
    wildcard_lookup that specifies an upper limit on the number of entries
    that can be returned with a wildcard lookup
  * A new option dyndns_server was added. This option allows to attempt
    a fallback DNS update against a specific DNS server. Please note this
    option only works as a fallback, the first attempt will always be
    performed against autodiscovered servers.
  * The PAM responder gained a new option ca_db that allows the storage
    of trusted CA certificates to be specified
  * The time the p11_child is allowed to operate can be specified using
    a new option p11_child_timeout

== Tickets Fixed ==

https://fedorahosted.org/sssd/ticket/546
    [RFE] Support for smart cards
https://fedorahosted.org/sssd/ticket/1697
    sssd: incorrect checks on length values during packet decoding
https://fedorahosted.org/sssd/ticket/1926
    [RFE] Start the dynamic DNS update after the SSSD has been setup for
    the first time
https://fedorahosted.org/sssd/ticket/1994
    Complain loudly if backend doesn't start due to missing or invalid keytab
https://fedorahosted.org/sssd/ticket/2275
    nested netgroups do not work in IPA provider
https://fedorahosted.org/sssd/ticket/2283
    test dyndns failed.
https://fedorahosted.org/sssd/ticket/2335
    Investigate using the krb5 responder for driving the PAM conversation
    with OTPs
https://fedorahosted.org/sssd/ticket/2463
    Pass error messages via the extdom plugin
https://fedorahosted.org/sssd/ticket/2495
    [RFE]Allow sssd to add a new option that would specify which server
    to update DNS with
https://fedorahosted.org/sssd/ticket/2549
    RFE: Support multiple interfaces with the dyndns_iface option
https://fedorahosted.org/sssd/ticket/2553
    RFE: Add support for wildcard-based cache updates
https://fedorahosted.org/sssd/ticket/2558
    Add dualstack and multihomed support
https://fedorahosted.org/sssd/ticket/2561
    Too much logging
https://fedorahosted.org/sssd/ticket/2579
    TRACKER: Support one-way trusts for IPA
https://fedorahosted.org/sssd/ticket/2581
    Re-check memcache after acquiring the lock in the client code
https://fedorahosted.org/sssd/ticket/2584
    RFE: Support client-side overrides
https://fedorahosted.org/sssd/ticket/2597
    Add index for 'objectSIDString' and maybe to other cache attributes
https://fedorahosted.org/sssd/ticket/2637
    RFE: Don't mark the main domain as offline if SSSD can't connect to
    a subdomain
https://fedorahosted.org/sssd/ticket/2639
    RFE: Detect re-established trusts in the IPA subdomain code
https://fedorahosted.org/sssd/ticket/2652
    KDC proxy not working with SSSD krb5_use_kdcinfo enabled
https://fedorahosted.org/sssd/ticket/2676
    Group members are not turned into ghost entries when the user is purged
    from the SSSD cache
https://fedorahosted.org/sssd/ticket/2682
    sudoOrder not honored as expected
https://fedorahosted.org/sssd/ticket/2688
    Default to config_file_version=2
https://fedorahosted.org/sssd/ticket/2691
    GPO: PAM system error returned for PAM_ACCT_MGMT and offline mode
https://fedorahosted.org/sssd/ticket/2692
    GPO: Access denied due to using wrong sam_account_name
https://fedorahosted.org/sssd/ticket/2694
    CI: Fix ramshackle test_ipa_subdomains_server (FAIL:
    test_ipa_subdom_server)
https://fedorahosted.org/sssd/ticket/2699
    SSSDConfig: wrong return type returned on python3
https://fedorahosted.org/sssd/ticket/2700
    krb5_child should always consider online state to allow use of
    MS-KKDC proxy
https://fedorahosted.org/sssd/ticket/2708
    Logging messages from user point of view
https://fedorahosted.org/sssd/ticket/2711
    [RFE] Provide interface for SSH to fetch user certificate
https://fedorahosted.org/sssd/ticket/2712
    Initgroups memory cache does not work with fq names
https://fedorahosted.org/sssd/ticket/2716
    Initgroups mmap cache needs update after db changes
https://fedorahosted.org/sssd/ticket/2717
    well-known SID check is broken for NetBIOS prefixes
https://fedorahosted.org/sssd/ticket/2718
    SSSD keytab validation check expects root ownership
https://fedorahosted.org/sssd/ticket/2719
    IPA: returned unknown dp error code with disabled migration mode
https://fedorahosted.org/sssd/ticket/2722
    Missing config options in gentoo init script
https://fedorahosted.org/sssd/ticket/2723
    Could not resolve AD user from root domain
https://fedorahosted.org/sssd/ticket/2724
    getgrgid for user's UID on a trust client prevents getpw*
https://fedorahosted.org/sssd/ticket/2725
    If AD site detection fails, not even ad_site override skipped
https://fedorahosted.org/sssd/ticket/2729
    Do not send SSS_OTP if both factors were entered separately
https://fedorahosted.org/sssd/ticket/2731
    searching SID by ID always checks all domains
https://fedorahosted.org/sssd/ticket/2733
    Don't use deprecated libraries (libsystemd-*)
https://fedorahosted.org/sssd/ticket/2737
    sss_override: add import and export commands
https://fedorahosted.org/sssd/ticket/2738
    Cannot build rpms from upstream spec file on rawhide
https://fedorahosted.org/sssd/ticket/2742
    When certificate is added via user-add-cert, it cannot be looked up
    via org.freedesktop.sssd.infopipe.Users.FindByCertificate
https://fedorahosted.org/sssd/ticket/2743
    memory cache can work intermittently
https://fedorahosted.org/sssd/ticket/2744
    cleanup_groups should sanitize dn of groups
https://fedorahosted.org/sssd/ticket/2746
    the PAM srv test often fails on RHEL-7
https://fedorahosted.org/sssd/ticket/2748
    test_memory_cache failed in invalidation cache before stop
https://fedorahosted.org/sssd/ticket/2749
    Fix crash in nss responder
https://fedorahosted.org/sssd/ticket/2754
    Clear environment and set restrictive umask in p11_child
https://fedorahosted.org/sssd/ticket/2757
    sss_override does not work correctly when 'use_fully_qualified_names
    = True'
https://fedorahosted.org/sssd/ticket/2758
    sss_override contains an extra parameter --debug but is not listed in
    the man page or in the arguments help
https://fedorahosted.org/sssd/ticket/2762
    [RFE] sssd: better feedback form constraint password change
https://fedorahosted.org/sssd/ticket/2768
    Test 'test_id_cleanup_exp_group' failed
https://fedorahosted.org/sssd/ticket/2772
    sssd cannot resolve user names containing backslash with ldap provider
https://fedorahosted.org/sssd/ticket/2773
    Make p11_child timeout configurable
https://fedorahosted.org/sssd/ticket/2777
    Fix memory leak in GPO
https://fedorahosted.org/sssd/ticket/2782
    sss_override : The local override user is not found
https://fedorahosted.org/sssd/ticket/2783
    REGRESSION: Dyndns soes not update reverse DNS records
https://fedorahosted.org/sssd/ticket/2790
    sss_override --name doesn't work with RFC2307 and ghost users
https://fedorahosted.org/sssd/ticket/2799
    unit tests do not link correctly on Debian
https://fedorahosted.org/sssd/ticket/2803
    Memory leak / possible DoS with krb auth.
https://fedorahosted.org/sssd/ticket/2805
    AD: Conditional jump or move depends on uninitialised value

== Detailed Changelog ==

Jakub Hrozek (52):
    * Updating the version for 1.13.1 development
    * tests: Move N_ELEMENTS definition to tests/common.h
    * SYSDB: Add functions to look up multiple entries including name and
      custom filter
    * DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUP
    * cache_req: Extend cache_req with wildcard lookups
    * UTIL: Add sss_filter_sanitize_ex
    * LDAP: Fetch users and groups using wildcards
    * LDAP: Add sdap_get_and_parse_generic_send
    * LDAP: Use sdap_get_and_parse_generic_/_recv
    * LDAP: Add sdap_lookup_type enum
    * LDAP: Add the wildcard_limit option
    * IFP: Add wildcard requests
    * Use NSCD path in execl()
    * KRB5: Use the right domain for case-sensitive flag
    * IPA: Better debugging
    * UTIL: Lower debug level in perform_checks()
    * IPA: Handle sssd-owned keytabs when running as root
    * IPA: Remove MPG groups if getgrgid was called before getpw()
    * LDAP: use ldb_binary_encode when printing attribute values
    * IPA: Change the default of ldap_user_certificate to
      userCertificate;binary
    * UTIL: Provide a common interface to safely create temporary files
    * IPA: Always re-fetch the keytab from the IPA server
    * DYNDNS: Add a new option dyndns_server
    * p11child: set restrictive umask and clear environment
    * KRB5: Use sss_unique file in krb5_child
    * KRB5: Use sss_unique_file when creating kdcinfo files
    * LDAP: Use sss_unique_filename in ldap_child
    * SSH: Use sss_unique_file_ex to create the known hosts file
    * SYSDB: Index the objectSIDString attribute
    * sbus: Initialize errno if constructing message fails and add debug
      messages
    * sbus: Add a special error code for messages sent by the bus itself
    * GPO: Use sss_unique_file and close fd on failure
    * SDAP: Remove unused function
    * KRB5: Don't error out reading a minimal krb5.conf
    * UTIL: Convert domain->disabled into tri-state with domain states
    * DP: Provide a way to mark subdomain as disabled and auto-enable it
      later with offline_timeout
    * SDAP: Do not set is_offline if ignore_mark_offline is set
    * AD: Only ignore errors from SDAP lookups if there's another connection
      to fallback to
    * KRB5: Offline operation with disabled domain
    * AD: Do not mark the whole back end as offline if subdomain lookup fails
    * AD: Set ignore_mark_offline=false when resolving AD root domain
    * IPA: Do not allow the AD lookup code to set backend as offline in
      server mode
    * BUILD: link dp tests with LDB directly to fix builds on Debian
    * LDAP: imposing sizelimit=1 for single-entry searches breaks
      overlapping domains
    * tests: Move named_domain from test_utils to common test code
    * LDAP: Move sdap_create_search_base from ldap to sdap code
    * LDAP: Filter out multiple entries when searching overlapping domains
    * IPA: Change ipa_server_trust_add_send request to be reusable from ID code
    * FO: Add an API to reset all servers in a single service
    * FO: Also reset the server common data in addition to SRV
    * IPA: Retry fetching keytab if IPA user lookup fails
    * Updating translations for the 1.13.1 release 

Lukas Slebodnik (49):
    * KRB5: Return right data provider error code
    * Update few debug messages
    * intg: Invalidate memory cache before removing files
    * SPEC: Update spec file for krb5_local_auth_plugin
    * SSSDConfig: Return correct types in python3
    * intg: Modernize 'except' clauses
    * mmap_cache: Rename variables
    * mmap_cache: "Override" functions for initgr mmap cache
    * mmap: Invalidate initgroups memory cache after any change
    * sss_client: Update integrity check of records in mmap cache
    * intg_test: Add module for simulation of utility id
    * intg_test: Add integration test for memory cache
    * NSS: Initgr memory cache should work with fq names
    * test_memory_cache: Add test for initgroups mc with fq names
    * SPEC: Workaround for build with rpm 4.13
    * KRB5: Do not try to remove missing ccache
    * test_memory_cache: Test mmap cache after initgroups
    * test_memory_cache: Test invalidation with sss_cache
    * krb5_utils-tests: Remove unused variables
    * sss_cache: Wait a while for invalidation of mc by nss responder
    * test_memory_cache: Fix few python issues
    * NSS: Fix use after free
    * NSS: Don't ignore backslash in usernames with ldap provider
    * intg_tests: Add regression test for 2163
    * BUILD: Build libdlopen_test_providers.la as a dynamic library
    * BUILD: Speed up build of some tests
    * BUILD: Simplify build of simple_access_tests
    * CI: Set env variable for all tabs in screen
    * dyndns-tests: Simulate job in wrapped execv
    * AUTOMAKE: Disable portability warnings
    * tests: Use unique name for TEST_PATH
    * tests: Move test_dom_suite_setup to different module
    * test_ipa_subdomains_server: Use unique dorectory for keytabs
    * test_copy_keytab: Create keytabs in unique directory
    * test_ad_common: Use unique directory for keytabs
    * Revert "LDAP: end on ENOMEM"
    * Partially revert "LDAP: sanitize group name when used in filter"
    * LDAP: Sanitize group dn before using in filter
    * test_ldap_id_cleanup: Fix coding style issues
    * DYNDNS: Return right error code in case of failure
    * BUILD: Simplify build of test_data_provider_be
    * BUILD: Remove unused variable CHECK_OBJ
    * BUILD: Do not build libsss_ad_common.la as library
    * BUILD: Remove unused variable SSSD_UTIL_OBJ
    * CONFIGURE: Remove bashism
    * IFP: Suppress warning from static analyzer
    * BUILD: Link test_data_provider_be with -ldl
    * sysdb-tests: Use valid base64 encoded certificate for search
    * test_pam_srv: Run cert test only with NSS 

Michal Židek (13):
    * DEBUG: Add new debug category for fail over.
    * pam: Incerease p11 child timeout
    * sdap_async: Use specific errmsg when available
    * TESTS: ldap_id_cleanup timeouts
    * sssd: incorrect checks on length values during packet decoding
    * CONFDB: Assume config file version 2 if missing
    * Makefile.am: Add missing AM_CFLAGS
    * SYSDB: Add function to expire entry
    * cleanup task: Expire all memberof targets when removing user
    * CI: Add regression test for #2676
    * intg: Fix some PEP 8 violations
    * PAM: Make p11_child timeout configurable
    * tests: Set p11_child_timeout to 30 in tests 

Nikolai Kondrashov (1):
    * TESTS: Add trailing whitespace test 

Pavel Březina (18):
    * VIEWS TEST: add null-check
    * SYSDB: prepare for LOCAL view
    * TOOLS: add common command framework
    * TOOLS: add sss_override for local overrides
    * AD: Use ad_site also when site search fails
    * IFP: use default limit if provided is 0
    * sudo: use "higher value wins" when ordering rules
    * sss_override: print input name if unable to parse it
    * sss_override: support domains that require fqname
    * TOOLS: add sss_colondb API
    * sss_override: decompose code better
    * sss_override: support import and export
    * sss_override: document --debug options
    * sss_override: support fqn in override name
    * views: do not require overrideDN in grous when LOCAL view is set
    * views: fix two typos in debug messages
    * views: allow ghost members for LOCAL view
    * sss_override: remove -d from manpage 

Pavel Reichl (23):
    * DYNDNS: sss_iface_addr_list_get return ENOENT
    * DYNDNS: support mult. interfaces for dyndns_iface opt
    * DYNDNS: special value '*' for dyndns_iface option
    * TESTS: dyndns tests support AAAA addresses
    * DYNDNS: support for dualstack
    * TESTS: fix compiler warnings
    * SDAP: rename SDAP_CACHE_PURGE_TIMEOUT
    * IPA: Improve messages about failures
    * DYNDNS: Don't use server cmd in nsupdate by default
    * DYNDNS: remove redundant talloc_steal()
    * DYNDNS: remove zone command
    * DYNDNS: rename field of sdap_dyndns_update_state
    * DYNDNS: remove code duplication
    * TESTS: UT for sss_iface_addr_list_as_str_list()
    * LDAP: sanitize group name when used in filter
    * LDAP: minor improvements in ldap id cleanup
    * TESTS: fix fail in test_id_cleanup_exp_group
    * LDAP: end on ENOMEM
    * AD: send less logs to syslog
    * Remove trailing whitespace
    * GPO: fix memory leak
    * DDNS: execute nsupdate for single update of PTR rec
    * AD: inicialize root_domain_attrs field 

Petr Cech (6):
    * BUILD: Repair dependecies on deprecated libraries
    * TESTS: Removing part of responder_cache_req-tests
    * UTIL: Function 2string for enum sss_cli_command
    * UTIL: Fixing Makefile.am for util/sss_cli_cmd.h
    * DATA_PROVIDER: BE_REQ as string in log message
    * IPA PROVIDER: Resolve nested netgroup membership 

Robin McCorkell (1):
    * man: List alternative schema defaults for LDAP AutoFS parameters 

Stephen Gallagher (1):
    * AD: Handle cases where no GPOs apply 

Sumit Bose (17):
    * test common: sss_dp_get_account_recv() fix assignment
    * nss_check_name_of_well_known_sid() improve name splitting
    * negcache: allow domain name for UID and GID
    * nss: use negative cache for sid-by-id requests
    * krb5: do not send SSS_OTP if two factors were used
    * utils: add NSS version of cert utils
    * Add NSS version of p11_child
    * pack_message_v3: allow empty name
    * authok: add support for Smart Card related authtokens
    * PAM: add certificate support to PAM (pre-)auth requests
    * pam_sss: add sc support
    * ssh: generate public keys from certificate
    * krb5 utils: add sss_krb5_realm_has_proxy()
    * krb5: do not create kdcinfo file if proxy configuration exists
    * krb5: assume online state if KDC proxy is configured
    * GPO: use SDAP_SASL_AUTHID as samAccountName
    * utils: make sss_krb5_get_primary() private 

Thomas Oulevey (1):
    * Fix memory leak in sssdpac_verify() 

Tyler Gates (1):
    * CONTRIB: Gentoo daemon startup options as declared in conf.d/sssd 

Yuri Chornoivan (1):
    * Fix minor typos 
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Reply via email to