From 4d5e968afc26915b5c85e23486b602d485df965c Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Aug 10 2017 09:54:48 +0000 Subject: Re-add upstream 1.13 release notes --- diff --git a/users/releases.rst b/users/releases.rst index 6a18864..734dbff 100644 --- a/users/releases.rst +++ b/users/releases.rst @@ -20,9 +20,17 @@ for a longer time than other releases. 1.13.x Series (LTM) ^^^^^^^^^^^^^^^^^^^ -+---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+-------------+--------------------------------------------------------------+ -|`sssd-1.13.4.tar.gz `_ |`sssd-1.13.4.tar.gz.asc `_ |SHA1SUM: ``8332501d752ab82f994170d11d31d5d15912b2e9``|Date: 2016-04-13|Release Notes|`Manpages `_| -+---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+-------------+--------------------------------------------------------------+ ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-1.13.4.tar.gz `_ |`sssd-1.13.4.tar.gz.asc `_ |SHA1SUM: ``8332501d752ab82f994170d11d31d5d15912b2e9``|Date: 2016-04-13|:doc:`Release notes ` |`Manpages `_| ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-1.13.3.tar.gz `_ |`sssd-1.13.3.tar.gz.asc `_ |SHA1SUM: ``333bccc6c037f6153dcfea9f7ebfefa9fd853512``|Date: 2015-12-15|:doc:`Release notes ` |`Manpages `_| ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-1.13.2.tar.gz `_ |`sssd-1.13.2.tar.gz.asc `_ |SHA1SUM: ``30bfc03448140983ee49fa7ef363612bd31a156f``|Date: 2015-11-19|:doc:`Release notes ` |`Manpages `_| ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-1.13.1.tar.gz `_ |`sssd-1.13.1.tar.gz.asc `_ |SHA1SUM: ``ae2b202abe9d62c24294f4d174717638dc24bce2``|Date: 2015-09-30|:doc:`Release notes ` |`Manpages `_| ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-1.13.0.tar.gz `_ |`sssd-1.13.0.tar.gz.asc `_ |SHA1SUM: ``f9c57cfb91d8e0e35d565a1d5b165e8f669989d2``|Date: 2015-07-06|:doc:`Release notes ` |`Manpages `_| ++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ List of all release notes ^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/users/relnotes/notes_1_13_0.rst b/users/relnotes/notes_1_13_0.rst new file mode 100644 index 0000000..bbb4bd5 --- /dev/null +++ b/users/relnotes/notes_1_13_0.rst @@ -0,0 +1,463 @@ +SSSD 1.13.0 +=========== + +Highlights +---------- + +- Support for separate prompts when using two-factor authentication was + added +- Added support for one-way trusts between an IPA and Active Directory + environment. Please note that this SSSD functionality depends on IPA + code that will be released in the IPA 4.2 version +- The fast memory cache now also supports the initgroups operation. +- The PAM responder is now capable of caching authentication for + configurable period, which might reduce server load in cases where + accounts authenticate very frequently. Please refer to the + ``cached_auth_timeout`` option in the ``sssd.conf`` manual page. +- The Active Directory provider has changed the default value of the + ``ad_gpo_access_control`` option from ``permissive`` to + ``enforcing``. As a consequence, the GPO access control now affects + all clients that set ``access_provider`` to ``ad``. In order to + restore the previous behaviour, set ``ad_gpo_access_control`` to + ``permissive`` or use a different ``access_provider`` type. +- Group Policy objects defined in a different AD domain that the + computer object is defined in are now supported. +- Credential caching and Offline authentication are also available when + using two-factor authentication +- Many enhancements to the InfoPipe D-Bus API. Notably, the SSSD users + and groups are now exposed as first-class objects. The users and + groups can also be marked as cached and would subsequently show up in + the Introspection output +- The DBus interface is now also able to look up User objects by + certificate. This is a first part of work that will eventually allow + smart-card authentication in SSSD. +- The LDAP cleanup task is now disabled by default, unless enumeration + is enabled. Please refer to the ``ldap_purge_cache_timeout`` option + in case your environment requires the cleanup task +- The Python bindings are now built for both Python2 and Python3 +- The LDAP bind timeout, StartTLS timeout and password change timeout + are now configurable using the ``ldap_opt_timeout`` option + +Packaging Changes +----------------- + +- A new directory ``/var/lib/sss/keytabs`` is present and owned by the + ``sssd-ipa`` subpackage. The SSSD stores keytabs for one-way trust + relationships in this directory. Downstreams should make sure that + the directory is only readable to the user who runs the SSSD service. +- Several packaging changes are present in this release to support the + Python3 bindings, notably new ``python-sss`` and + ``python-sss-murmur`` subpackages are introduced in upstream RPM + packaging +- All python bindings now have a Python3 and a Python2 version in the + upstream RPM packaging scheme +- The OpenSSL development library such as ``openssl-devel`` on + RHEL/Fedora or + `Debian/Ubuntu? `__ + ``libssl-dev`` is now required to support certificate operations +- A new internal library ``libsss_cert.so`` is present in this release. +- The fast initgroups memcache is represented by a new file + ``/var/lib/sss/mc/initgroups`` + +Documentation Changes +--------------------- + +- The ``ad_gpo_access_control`` option default has changed from + ``permissive`` to ``enforcing`` +- The default value of ``ldap_purge_cache_timeout`` changed to 0, thus + effectivelly disabling the cleanup task. +- A new option ``cache_credentials_minimal_first_factor_length`` was + added. This option sets constraints on the password length if + One-Time passwords are used and credentials are to be cached. Please + see the ``sssd.conf(5)`` man page for more details +- The cached authentication is controlled by new option + ``cached_auth_timeout``. By default the cached authentication is + disabled. + +Tickets Fixed +------------- + +.. raw:: html + +
+ +`#897 `__ + sssd should pass -d to nsupdate when running with high log level +`#1501 `__ + Make the LDAP bind operation timeout configurable +`#2150 `__ + [RFE] Expose listing calls over D-BUS +`#2224 `__ + nsupdate stderr is not captured +`#2236 `__ + The cleanup task has no DEBUG statements +`#2326 `__ + SBUS: Flush the UID cache when we receive NameOwnerChanged +`#2338 `__ + [RFE] Implement object caching on the bus +`#2339 `__ + IFP: support multiple interfaces for object +`#2540 `__ + SSSD does not update Dynamic DNS records if the IPA domain differs + from machine hostname's domain +`#2569 `__ + In ipa-ad trust, with 'default\_domain\_suffix' set to AD domain, + IPA user are not able to log unless use\_fully\_qualified\_names is + set +`#2574 `__ + SSSD should be able to build python2 and python3 bindings in a one + build +`#2583 `__ + [RFE] Homedir is always overwritten with subdomain\_homedir value in + server mode +`#2593 `__ + Does sssd-ad use the most suitable attribute for group name? +`#2596 `__ + Add a way to lookup users based on CAC identity certificates +`#2603 `__ + Make SSSD's HBAC validation more permissive if deny rules are not + used +`#2609 `__ + [bug] sssd always appends default\_domain\_suffix when checking for + host keys +`#2618 `__ + Man sssd-ad(5) lists Group Policy Management Editor naming for some + policies but not for all +`#2620 `__ + id\_provider=proxy with auth\_provider=ldap does not work reliably +`#2625 `__ + Sudo responder does not respect filter\_users and filter\_groups +`#2627 `__ + Disable the cleanup task by default +`#2636 `__ + RFE: Fetch keytabs for one-way trusts in IPA subdomain code +`#2638 `__ + RFE: Change ad\_id\_ctx instantiation in the IPA subdomain code to + support one-way trusts +`#2645 `__ + [RFE] Support GPOs from different domain controllers +`#2661 `__ + RFE: Change AD GPO default to enforcing +`#2666 `__ + sssd with ldap backend throws error domain log + +.. raw:: html + +
+ +.. raw:: html + +
+ +`#1807 `__ + [RFE] authenticate against cache in SSSD +`#2017 `__ + [RFE] Python 3 support +`#2485 `__ + [RFE] The fast memory cache should cache initgroups +`#2590 `__ + SSSD doesn't re-read resolv.conf if the file doesn't exist during + boot +`#2641 `__ + Add a IS\_DEFAULT\_VIEW macro +`#2701 `__ + Kerberos-based providers other than krb5 do not queue requests + +.. raw:: html + +
+ +Detailed Changelog +------------------ + +Jakub Hrozek (73): + +- MAN: Fix a typo +- SYSDB: Reduce code duplication in sysdb\_gpo.c +- UTIL: Make two child\_common.c functions static +- TESTS: Cover child\_common.c with unit tests +- LDAP: Use child\_io\_destructor instead of child\_cleanup in a custom + desctructor +- UTIL: Remove child\_cleanup +- UTIL: Unify the fd\_nonblocking implementation +- RESOLV: Remove obsolete in-tree implementation of SRV and TXT parsing +- PAM: print the pam status as string, too +- KRB5: More debugging for create\_ccache() +- SDAP: Make simple bind timeout configurable +- SDAP: Make password change timeout configurable with + ldap\_opt\_timeout +- SDAP: Make StartTLS bind configurable with ldap\_opt\_timeout +- SDAP: Decorate the sdap\_op functions with DEBUG messages +- IPA: Remove the ipa\_hbac\_treat\_deny\_as option +- MAN: Clarify debug\_level a bit +- SSH: Ignore the default\_domain\_suffix +- LDAP: Set sdap handle as explicitly connected in LDAP auth +- tests: Revert strcmp condition +- ncache: Fix sss\_ncache\_reset\_permanent +- ncache: Silence critical error from filter\_users when + default\_domain\_suffix is set +- ncache: Add sss\_ncache\_reset\_repopulate\_permanent +- responders: reset ncache after domains are discovered during startup +- NSS: Reset negcache after checking domains +- MAN: Clarify how are GPO mappings called in GPO editor +- UTIL: Add a simple function to get the fd of debug\_file +- dyndns: Log nsupdate stderr with a high debug level +- nsupdate: Append -d/-D to nsupdate with a high debug level +- subdom: Remove unused function get\_flat\_name\_from\_subdomain\_name +- nss: Use negcache for getbysid requests +- tests: Add NSS responder tests for bysid requests +- LDAP: disable the cleanup task by default +- TESTS: Use the right testcase +- TESTS: Add test for get\_next\_domain +- LDAP: Do not print verbose DEBUG messages from providers that don't + set UUID +- SYSDB: Store trust direction for subdomains +- UTIL/SYSDB: Move new\_subdomain() to sysdb\_subdomains.c and make it + private +- TESTS: Add a test for sysdb\_subdomains.c +- SYSDB: Add realm to sysdb\_master\_domain\_add\_info +- SYSDB: Add a forest root attribute to sss\_domain\_info +- IPA: Add ipa\_subdomains\_handler\_get\_{start,cont} wrappers +- IPA: Check master domain record before subdomain records +- IPA: Fold ipa\_subdom\_enumerates into ipa\_subdom\_store +- IPA: Also update master domain when initializing subdom handler +- IPA: Move server-mode functions to a separate module +- IPA: Split two functions to new module ipa\_subdomains\_utils.c +- IPA: Include ipaNTTrustDirection in the attribute set for trusted + domains +- IPA: Read forest name for trusted forest roots as well +- IPA: Make constructing an IPA server mode context async +- TESTS: Split off keytab creation into a common module +- TESTS: Add a common mock\_be\_ctx function +- TESTS: Add a common function to set up sdap\_id\_ctx +- TESTS: Move krb5\_try\_kdcip to nested group test +- TESTS: Add unit test for the subdomain\_server.c module +- IPA: Fetch keytab for 1way trusts +- AD: Rename ad\_set\_ad\_id\_options to ad\_set\_sdap\_options +- AD: Rename ad\_create\_default\_options to + ad\_create\_2way\_trust\_options +- AD: Split off ad\_create\_default\_options +- IPA/AD: Set up AD domain in ad\_create\_2way\_trust\_options +- IPA: Do not set AD\_KRB5\_REALM twice +- AD: Add ad\_create\_1way\_trust\_options +- IPA: Utility function for setting up one-way trust context +- LDAP: Do not set keytab through environment variable +- LDAP: Consolidate SDAP\_SASL\_REALM/SDAP\_KRB5\_REALM behaviour +- CONFIG: Add SSS\_STATEDIR as VARDIR/lib/sss +- BUILD: Store keytabs in /var/lib/sss/keytabs +- Updating the translations for the 1.13 Alpha release +- Updating the version.m4 file for the 1.13 Beta release +- tests: Reduce duplication with new function test\_ev\_done +- KRB5: Add and use krb5\_auth\_queue\_send to queue requests by + default +- PAM: Only cache first-factor +- Updating the translations for the 1.13.0 release +- Updating the version for the 1.13.0 release + +John Dickerson (1): + +- MAN: Amend the description of ignore\_group\_members + +Lukas Slebodnik (67): + +- MAN: Remove indentation in element programlistening +- Fix warning: for loop has empty body +- Bump version to track 1.13 development +- SPEC: Use libnl3 for epel6 +- MAKE: Don't include autoconf generated file to tarball +- TESTS: Mock return value of sdap\_get\_generic\_recv +- test\_nested\_groups: Additional unit tests +- Fix warning: equality comparison with extraneous parentheses +- LDAP: Conditional jump depends on uninitialised value +- BUILD: Remove unused libraries for pysss.so +- BUILD: Remove unused variables +- BUILD: Remove detection of type Py\_ssize\_t +- UTIL: Remove python wrapper sss\_python\_set\_new +- UTIL: Remove python wrapper sss\_python\_set\_add +- UTIL: Remove python wrapper sss\_python\_set\_check +- UTIL: Remove compatibility macro PyModule\_AddIntMacro +- UTIL: Remove python wrapper sss\_python\_unicode\_from\_string +- BUILD: Use python-config for detection \*FLAGS +- SPEC: Use new convention for python packages +- SPEC: Move python bindings to separate packages +- BUILD: Add possibility to build python{2,3} bindings +- TESTS: Run python tests with all supported python versions +- SPEC: Replace python\_ macros with python2\_ +- SPEC: Build python3 bindings on available platforms +- BUILD: Uninstall also symbolic links to python bindings +- Remove unused argument from be\_nsupdate\_create\_fwd\_msg +- IPA: Remove unused argument from ipa\_id\_get\_group\_uuids +- Remove useless assignment to function parameter +- PAC: Fix memory leak +- responder\_cache: Fix warning may be used uninitialized +- debug-tests: Fix test with new line in debug message +- BUILD: Add missing header file to tarball +- pam\_client: fix casting to const pointer +- test\_expire: Use right assertion macro for standard functions +- test\_ldap\_auth: Use right assertion for integer comparison +- test\_resolv\_fake: Fix alignment warning +- PAC: Remove unused function +- KRB5: Unify prototype and definition +- util-tests: Initialize boolean variable to default value +- SPEC: Drop workaround for old libtool +- SPEC: Drop workarounds for old rpmbuild +- SPEC: Remove unused option +- SPEC: Few cosmetic changes +- simple\_access-tests: Simplify assertion +- sysdb-tests: Add missing assertions +- sysdb-tests: test return value before output arguments +- ad\_opts: Use different default attribute for group name +- BUILD: Write hints about optional python bindings +- sss\_client: Fix mixed enums +- LDAP: Remove dead assignment +- sss\_client: Fix warning "\_" redefined +- SSSDConfigTest: Use unique temporary directory +- util-tests: Add validation of internal error messages +- SDAP: Check return value before using output arguments +- SDAP: Log failure from sysdb\_handle\_original\_uuid +- test\_ipa\_subdomains\_server: Run clean-up after success +- IFP: Fix warnings with enabled optimisation +- SDAP: Remove user from cache for missing user in LDAP +- test\_ipa\_subdom\_server: Add missing assert +- test\_ipa\_subdomains\_server: Fix build with --coverage +- nss: Store entries in responder to initgr mmap cache +- mmap\_cache: Invalidate entry in right memory cache +- nss: Invalidate entry in initgr mmap cache +- sss\_client: Use initgr mmap cache in client code +- sss\_cache: Clear also initgroups fast cache +- sss\_client: Use unique lock for memory cache +- sss\_client: Re-check memcache after acquiring the lock + +Michal Zidek (5): + +- Use FQDN if default domain was set +- MAN: default\_domain\_suffix with use\_fully\_qualified\_names. +- views: Add is\_default\_view helper function +- MONITOR: Poll for resolv.conf if not available during boot +- MONITOR: Do not report missing file as fatal in monitor\_config\_file + +Nikolai Kondrashov (3): + +- BUILD: Add AM\_PYTHON2\_MODULE macro +- Add integration tests +- BUILD: Fix variable substitution in cwrap.m4 + +Pavel Březina (53): + +- tests: refactor create\_dom\_test\_ctx() +- tests: add create\_multidom\_test\_ctx() +- tests: add test\_multidom\_suite\_cleanup() +- tests: remove code duplication in single domain cleanup +- responders: new interface for cache request +- responders: enable views in cache request +- IFP: use new cache interface +- server-tests: use strtouint32 instead strtol +- sbus: add new iface via sbus\_conn\_register\_iface() +- sbus: move iface and object path code to separate file +- sbus: use 'path/\*' to represent a D-Bus fallback +- sbus: support multiple interfaces on single path +- sbus: add object path to sbus request +- sbus: add sbus\_opath\_hash\_lookup\_supported() +- sbus: support org.freedesktop.DBus.Introspectable +- sbus: support org.freedesktop.DBus.Properties +- sbus: unify naming of handler data variable +- sbus: move common opath functions from ifp to sbus code +- sbus: add sbus\_opath\_get\_object\_name() +- ifp: fix potential memory leak in + check\_and\_get\_component\_from\_path() +- sbus: use hard coded getters instead of generated +- sbus: remove unused 'reply as' functions +- IFP: move interface definitions from ifpsrv.c into separate file +- IFP: unify generated interfaces names +- sbus codegen: do not prefix getters with iface name +- IFP: simplify object path constant names +- sbus: add constant to represent subtree +- be\_refresh: get rid of callback pointers +- sysdb: use sysdb\_user/group\_dn +- cache\_req tests: rename test\_user to test\_user\_by\_name +- cache\_req tests: define user name constant +- cache\_req: preparations for different input type +- cache\_req: add support for user by uid +- cache\_req: add support for group by name +- cache\_req: remove default branch from switches +- cache\_req: add support for group by id +- cmocka: include mock\_parse\_inp in header file +- cache\_req: parse input name if needed +- cache\_req: return ERR\_INTERNAL if more than one entry is found +- sbus: provide custom error names +- sbus: add sbus\_opath\_decompose[\_exact] +- sbus: add a{sas} get invoker +- IFP: add org.freedesktop.sssd.infopipe.Users +- IFP: add org.freedesktop.sssd.infopipe.Users.User +- IFP: add org.freedesktop.sssd.infopipe.Groups +- IFP: add org.freedesktop.sssd.infopipe.Groups.Group +- IFP: deprecate + `GetUserAttr? `__ +- IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object] +- SBUS: Use default + `GetAll? `__ invoker + if none is set +- SBUS: Add support for in introspection +- IFP: Export nodes +- sbus: add support for incoming signals +- sbus: listen to + `NameOwnerChanged? `__ + +Pavel Reichl (20): + +- add missing '\\n' in debug messages +- PROXY: add missing space in debug message +- BUILD: fix chmake not to generate warning +- SDAP: log expired accounts at lower severity level +- KRB5: add debug hint +- TESTS: test expiration +- ldap: refactor check\_pwexpire\_kerberos to use util func +- ldap: refactor nds\_check\_expired to use util func +- Fix a few typos in comments +- sbus: sbus\_opath\_hash\_add\_iface free tmp talloc ctx +- krb5: remove field run\_as\_user +- localauth plugin: fix coverity warning +- dyndns: remove dupl declaration of ipa\_dyndns\_update +- dyndns: don't pass zone directive to nsupdate +- dyndns: ipa\_dyndns.h missed declaration of used data +- krb: remove duplicit decl. of write\_krb5info\_file +- IPA: Don't override homedir with subdomain\_homedir +- sysdb: new attribute lastOnlineAuthWithCurrentToken +- PAM: authenticate agains cache +- Minor code improvements + +Stephen Gallagher (5): + +- LDAP: Support returning referral information +- AD GPO: Support processing referrals +- AD GPO: Change default to "enforcing" +- Add Vagrant configuration for SSSD +- GPO: Fix incorrect strerror on GPO access denial + +Sumit Bose (22): + +- Add leak check and command line option to test\_authtok +- utils: add sss\_authtok\_[gs]et\_2fa +- pam: handle 2FA authentication token in the responder +- Add pre-auth request +- krb5-child: add preauth and split 2fa token support +- IPA: create preauth indicator file at startup +- pam\_sss: add pre-auth and 2fa support +- Add cache\_credentials\_minimal\_first\_factor\_length config option +- sysdb: add sysdb\_cache\_password\_ex() +- krb5: save hash of the first authentication factor to the cache +- krb5: try delayed online authentication only for single factor auth +- 2FA offline auth +- pam\_sss: move message encoding into separate file +- PAM: add PAM responder unit test +- adding ldap\_user\_auth\_type where missing +- LDAP: add ldap\_user\_certificate option +- certs: add PEM/DER conversion utilities +- sysdb: add sysdb\_search\_user\_by\_cert() and + sysdb\_search\_object\_by\_cert() +- LDAP/IPA: add user lookup by certificate +- ncache: add calls for certificate based searches +- utils: add get\_last\_x\_chars() +- IFP: add + `FindByCertificate? `__ + method for User objects diff --git a/users/relnotes/notes_1_13_1.rst b/users/relnotes/notes_1_13_1.rst new file mode 100644 index 0000000..6a22a68 --- /dev/null +++ b/users/relnotes/notes_1_13_1.rst @@ -0,0 +1,447 @@ +SSSD 1.13.1 +=========== + +Highlights +---------- + +- Initial support for Smart Card authentication was added. The feature + can be activated with the new ``pam_cert_auth`` option +- The PAM prompting was enhanced so that when Two-Factor Authentication + is used, both factors (password and token) can be entered separately + on separate prompts. At the same time, only the long-term password is + cached, so offline access would still work using the long term + password +- A new command line tool ``sss_override`` is present in this release. + The tools allows to override attributes on the SSSD side. It's + helpful in environment where e.g. some hosts need to have a different + view of POSIX attributes than others. Please note that the overrides + are stored in the cache as well, so removing the cache will also + remove the overrides +- New methods were added to the SSSD D-Bus interface. Notably support + for looking up a user by certificate and looking up multiple users + using a wildcard was added. Please see the interface introspection or + the design pages for full details +- Several enhancements to the dynamic DNS update code. Notably, clients + that update multiple interfaces work better with this release +- This release supports authenticating againt a KDC proxy +- The fail over code was enhanced so that if a trusted domain is not + reachable, only that domain will be marked as inactive but the backed + would stay in online mode +- Several fixes to the GPO access control code are present + +Packaging Changes +----------------- + +- The Smart Card authentication feature requires a helper process + ``p11_child`` that needs to be marked as setgid if SSSD needs to be + able to. Please note the ``p11_child`` requires the NSS crypto + library at the moment +- The ``sss_override`` tool was added along with its own manpage +- The upstream RPM can now build on RHEL/CentOS 6.7 + +Documentation Changes +--------------------- + +- The ``config_file_version`` configuration option now defaults to 2. + As an effect, this option doesn't have to be set anymore unless the + config file format is changed again by SSSD upstream +- It is now possible to specify a comma-separated list of interfaces in + the ``dyndns_iface`` option +- The InfoPipe responder and the LDAP provider gained a new option + ``wildcard_lookup`` that specifies an upper limit on the number of + entries that can be returned with a wildcard lookup +- A new option ``dyndns_server`` was added. This option allows to + attempt a fallback DNS update against a specific DNS server. Please + note this option only works as a fallback, the first attempt will + always be performed against autodiscovered servers. +- The PAM responder gained a new option ``ca_db`` that allows the + storage of trusted CA certificates to be specified +- The time the ``p11_child`` is allowed to operate can be specified + using a new option ``p11_child_timeout`` + +Tickets Fixed +------------- + +.. raw:: html + +
+ +`#546 `__ + [RFE] Support for smart cards +`#1697 `__ + sssd: incorrect checks on length values during packet decoding +`#1926 `__ + [RFE] Start the dynamic DNS update after the SSSD has been setup for + the first time +`#1994 `__ + Complain loudly if backend doesn't start due to missing or invalid + keytab +`#2275 `__ + nested netgroups do not work in IPA provider +`#2283 `__ + test dyndns failed. +`#2335 `__ + Investigate using the krb5 responder for driving the PAM + conversation with OTPs +`#2463 `__ + Pass error messages via the extdom plugin +`#2495 `__ + [RFE]Allow sssd to add a new option that would specify which server + to update DNS with +`#2549 `__ + RFE: Support multiple interfaces with the dyndns\_iface option +`#2553 `__ + RFE: Add support for wildcard-based cache updates +`#2558 `__ + Add dualstack and multihomed support +`#2561 `__ + Too much logging +`#2579 `__ + TRACKER: Support one-way trusts for IPA +`#2581 `__ + Re-check memcache after acquiring the lock in the client code +`#2584 `__ + RFE: Support client-side overrides +`#2597 `__ + Add index for 'objectSIDString' and maybe to other cache attributes +`#2637 `__ + RFE: Don't mark the main domain as offline if SSSD can't connect to + a subdomain +`#2639 `__ + RFE: Detect re-established trusts in the IPA subdomain code +`#2652 `__ + KDC proxy not working with SSSD krb5\_use\_kdcinfo enabled +`#2676 `__ + Group members are not turned into ghost entries when the user is + purged from the SSSD cache +`#2682 `__ + sudoOrder not honored as expected +`#2688 `__ + Default to config\_file\_version=2 +`#2691 `__ + GPO: PAM system error returned for PAM\_ACCT\_MGMT and offline mode +`#2692 `__ + GPO: Access denied due to using wrong sam\_account\_name +`#2699 `__ + SSSDConfig: wrong return type returned on python3 +`#2700 `__ + krb5\_child should always consider online state to allow use of + MS-KKDC proxy +`#2708 `__ + Logging messages from user point of view +`#2711 `__ + [RFE] Provide interface for SSH to fetch user certificate +`#2712 `__ + Initgroups memory cache does not work with fq names +`#2716 `__ + Initgroups mmap cache needs update after db changes +`#2717 `__ + well-known SID check is broken for NetBIOS prefixes +`#2718 `__ + SSSD keytab validation check expects root ownership +`#2719 `__ + IPA: returned unknown dp error code with disabled migration mode +`#2722 `__ + Missing config options in gentoo init script +`#2723 `__ + Could not resolve AD user from root domain +`#2724 `__ + getgrgid for user's UID on a trust client prevents getpw\* +`#2725 `__ + If AD site detection fails, not even ad\_site override skipped +`#2729 `__ + Do not send SSS\_OTP if both factors were entered separately +`#2731 `__ + searching SID by ID always checks all domains +`#2733 `__ + Don't use deprecated libraries (libsystemd-\*) +`#2737 `__ + sss\_override: add import and export commands +`#2738 `__ + Cannot build rpms from upstream spec file on rawhide +`#2742 `__ + When certificate is added via user-add-cert, it cannot be looked up + via org.freedesktop.sssd.infopipe.Users.FindByCertificate +`#2743 `__ + memory cache can work intermittently +`#2744 `__ + cleanup\_groups should sanitize dn of groups +`#2746 `__ + the PAM srv test often fails on RHEL-7 +`#2748 `__ + test\_memory\_cache failed in invalidation cache before stop +`#2749 `__ + Fix crash in nss responder +`#2754 `__ + Clear environment and set restrictive umask in p11\_child +`#2757 `__ + sss\_override does not work correctly when + 'use\_fully\_qualified\_names = True' +`#2758 `__ + sss\_override contains an extra parameter --debug but is not listed + in the man page or in the arguments help +`#2762 `__ + [RFE] sssd: better feedback form constraint password change +`#2768 `__ + Test 'test\_id\_cleanup\_exp\_group' failed +`#2772 `__ + sssd cannot resolve user names containing backslash with ldap + provider +`#2773 `__ + Make p11\_child timeout configurable +`#2777 `__ + Fix memory leak in GPO +`#2782 `__ + sss\_override : The local override user is not found +`#2783 `__ + REGRESSION: Dyndns soes not update reverse DNS records +`#2790 `__ + sss\_override --name doesn't work with RFC2307 and ghost users +`#2799 `__ + unit tests do not link correctly on Debian +`#2803 `__ + Memory leak / possible DoS with krb auth. +`#2805 `__ + AD: Conditional jump or move depends on uninitialised value + +.. raw:: html + +
+ +Detailed Changelog +------------------ + +Jakub Hrozek (52): + +- Updating the version for 1.13.1 development +- tests: Move N\_ELEMENTS definition to tests/common.h +- SYSDB: Add functions to look up multiple entries including name and + custom filter +- DP: Add DP\_WILDCARD and + SSS\_DP\_WILDCARD\_USER/SSS\_DP\_WILDCARD\_GROUP +- cache\_req: Extend cache\_req with wildcard lookups +- UTIL: Add sss\_filter\_sanitize\_ex +- LDAP: Fetch users and groups using wildcards +- LDAP: Add sdap\_get\_and\_parse\_generic\_send +- LDAP: Use sdap\_get\_and\_parse\_generic\_/\_recv +- LDAP: Add sdap\_lookup\_type enum +- LDAP: Add the wildcard\_limit option +- IFP: Add wildcard requests +- Use NSCD path in execl() +- KRB5: Use the right domain for case-sensitive flag +- IPA: Better debugging +- UTIL: Lower debug level in perform\_checks() +- IPA: Handle sssd-owned keytabs when running as root +- IPA: Remove MPG groups if getgrgid was called before getpw() +- LDAP: use ldb\_binary\_encode when printing attribute values +- IPA: Change the default of ldap\_user\_certificate to + userCertificate;binary +- UTIL: Provide a common interface to safely create temporary files +- IPA: Always re-fetch the keytab from the IPA server +- DYNDNS: Add a new option dyndns\_server +- p11child: set restrictive umask and clear environment +- KRB5: Use sss\_unique file in krb5\_child +- KRB5: Use sss\_unique\_file when creating kdcinfo files +- LDAP: Use sss\_unique\_filename in ldap\_child +- SSH: Use sss\_unique\_file\_ex to create the known hosts file +- SYSDB: Index the objectSIDString attribute +- sbus: Initialize errno if constructing message fails and add debug + messages +- sbus: Add a special error code for messages sent by the bus itself +- GPO: Use sss\_unique\_file and close fd on failure +- SDAP: Remove unused function +- KRB5: Don't error out reading a minimal krb5.conf +- UTIL: Convert domain->disabled into tri-state with domain states +- DP: Provide a way to mark subdomain as disabled and auto-enable it + later with offline\_timeout +- SDAP: Do not set is\_offline if ignore\_mark\_offline is set +- AD: Only ignore errors from SDAP lookups if there's another + connection to fallback to +- KRB5: Offline operation with disabled domain +- AD: Do not mark the whole back end as offline if subdomain lookup + fails +- AD: Set ignore\_mark\_offline=false when resolving AD root domain +- IPA: Do not allow the AD lookup code to set backend as offline in + server mode +- BUILD: link dp tests with LDB directly to fix builds on Debian +- LDAP: imposing sizelimit=1 for single-entry searches breaks + overlapping domains +- tests: Move named\_domain from test\_utils to common test code +- LDAP: Move sdap\_create\_search\_base from ldap to sdap code +- LDAP: Filter out multiple entries when searching overlapping domains +- IPA: Change ipa\_server\_trust\_add\_send request to be reusable from + ID code +- FO: Add an API to reset all servers in a single service +- FO: Also reset the server common data in addition to SRV +- IPA: Retry fetching keytab if IPA user lookup fails +- Updating translations for the 1.13.1 release + +Lukas Slebodnik (49): + +- KRB5: Return right data provider error code +- Update few debug messages +- intg: Invalidate memory cache before removing files +- SPEC: Update spec file for krb5\_local\_auth\_plugin +- SSSDConfig: Return correct types in python3 +- intg: Modernize 'except' clauses +- mmap\_cache: Rename variables +- mmap\_cache: "Override" functions for initgr mmap cache +- mmap: Invalidate initgroups memory cache after any change +- sss\_client: Update integrity check of records in mmap cache +- intg\_test: Add module for simulation of utility id +- intg\_test: Add integration test for memory cache +- NSS: Initgr memory cache should work with fq names +- test\_memory\_cache: Add test for initgroups mc with fq names +- SPEC: Workaround for build with rpm 4.13 +- KRB5: Do not try to remove missing ccache +- test\_memory\_cache: Test mmap cache after initgroups +- test\_memory\_cache: Test invalidation with sss\_cache +- krb5\_utils-tests: Remove unused variables +- sss\_cache: Wait a while for invalidation of mc by nss responder +- test\_memory\_cache: Fix few python issues +- NSS: Fix use after free +- NSS: Don't ignore backslash in usernames with ldap provider +- intg\_tests: Add regression test for 2163 +- BUILD: Build libdlopen\_test\_providers.la as a dynamic library +- BUILD: Speed up build of some tests +- BUILD: Simplify build of simple\_access\_tests +- CI: Set env variable for all tabs in screen +- dyndns-tests: Simulate job in wrapped execv +- AUTOMAKE: Disable portability warnings +- tests: Use unique name for TEST\_PATH +- tests: Move test\_dom\_suite\_setup to different module +- test\_ipa\_subdomains\_server: Use unique dorectory for keytabs +- test\_copy\_keytab: Create keytabs in unique directory +- test\_ad\_common: Use unique directory for keytabs +- Revert "LDAP: end on ENOMEM" +- Partially revert "LDAP: sanitize group name when used in filter" +- LDAP: Sanitize group dn before using in filter +- test\_ldap\_id\_cleanup: Fix coding style issues +- DYNDNS: Return right error code in case of failure +- BUILD: Simplify build of test\_data\_provider\_be +- BUILD: Remove unused variable CHECK\_OBJ +- BUILD: Do not build libsss\_ad\_common.la as library +- BUILD: Remove unused variable SSSD\_UTIL\_OBJ +- CONFIGURE: Remove bashism +- IFP: Suppress warning from static analyzer +- BUILD: Link test\_data\_provider\_be with -ldl +- sysdb-tests: Use valid base64 encoded certificate for search +- test\_pam\_srv: Run cert test only with NSS + +Michal Židek (13): + +- DEBUG: Add new debug category for fail over. +- pam: Incerease p11 child timeout +- sdap\_async: Use specific errmsg when available +- TESTS: ldap\_id\_cleanup timeouts +- sssd: incorrect checks on length values during packet decoding +- CONFDB: Assume config file version 2 if missing +- Makefile.am: Add missing AM\_CFLAGS +- SYSDB: Add function to expire entry +- cleanup task: Expire all memberof targets when removing user +- CI: Add regression test for + `#2676 `__ +- intg: Fix some PEP 8 violations +- PAM: Make p11\_child timeout configurable +- tests: Set p11\_child\_timeout to 30 in tests + +Nikolai Kondrashov (1): + +- TESTS: Add trailing whitespace test + +Pavel Březina (18): + +- VIEWS TEST: add null-check +- SYSDB: prepare for LOCAL view +- TOOLS: add common command framework +- TOOLS: add sss\_override for local overrides +- AD: Use ad\_site also when site search fails +- IFP: use default limit if provided is 0 +- sudo: use "higher value wins" when ordering rules +- sss\_override: print input name if unable to parse it +- sss\_override: support domains that require fqname +- TOOLS: add sss\_colondb API +- sss\_override: decompose code better +- sss\_override: support import and export +- sss\_override: document --debug options +- sss\_override: support fqn in override name +- views: do not require overrideDN in grous when LOCAL view is set +- views: fix two typos in debug messages +- views: allow ghost members for LOCAL view +- sss\_override: remove -d from manpage + +Pavel Reichl (23): + +- DYNDNS: sss\_iface\_addr\_list\_get return ENOENT +- DYNDNS: support mult. interfaces for dyndns\_iface opt +- DYNDNS: special value '\*' for dyndns\_iface option +- TESTS: dyndns tests support AAAA addresses +- DYNDNS: support for dualstack +- TESTS: fix compiler warnings +- SDAP: rename SDAP\_CACHE\_PURGE\_TIMEOUT +- IPA: Improve messages about failures +- DYNDNS: Don't use server cmd in nsupdate by default +- DYNDNS: remove redundant talloc\_steal() +- DYNDNS: remove zone command +- DYNDNS: rename field of sdap\_dyndns\_update\_state +- DYNDNS: remove code duplication +- TESTS: UT for sss\_iface\_addr\_list\_as\_str\_list() +- LDAP: sanitize group name when used in filter +- LDAP: minor improvements in ldap id cleanup +- TESTS: fix fail in test\_id\_cleanup\_exp\_group +- LDAP: end on ENOMEM +- AD: send less logs to syslog +- Remove trailing whitespace +- GPO: fix memory leak +- DDNS: execute nsupdate for single update of PTR rec +- AD: inicialize root\_domain\_attrs field + +Petr Cech (6): + +- BUILD: Repair dependecies on deprecated libraries +- TESTS: Removing part of responder\_cache\_req-tests +- UTIL: Function 2string for enum sss\_cli\_command +- UTIL: Fixing Makefile.am for util/sss\_cli\_cmd.h +- DATA\_PROVIDER: BE\_REQ as string in log message +- IPA PROVIDER: Resolve nested netgroup membership + +Robin `McCorkell? `__ +(1): + +- man: List alternative schema defaults for LDAP AutoFS parameters + +Stephen Gallagher (1): + +- AD: Handle cases where no GPOs apply + +Sumit Bose (17): + +- test common: sss\_dp\_get\_account\_recv() fix assignment +- nss\_check\_name\_of\_well\_known\_sid() improve name splitting +- negcache: allow domain name for UID and GID +- nss: use negative cache for sid-by-id requests +- krb5: do not send SSS\_OTP if two factors were used +- utils: add NSS version of cert utils +- Add NSS version of p11\_child +- pack\_message\_v3: allow empty name +- authok: add support for Smart Card related authtokens +- PAM: add certificate support to PAM (pre-)auth requests +- pam\_sss: add sc support +- ssh: generate public keys from certificate +- krb5 utils: add sss\_krb5\_realm\_has\_proxy() +- krb5: do not create kdcinfo file if proxy configuration exists +- krb5: assume online state if KDC proxy is configured +- GPO: use SDAP\_SASL\_AUTHID as samAccountName +- utils: make sss\_krb5\_get\_primary() private + +Thomas Oulevey (1): + +- Fix memory leak in sssdpac\_verify() + +Tyler Gates (1): + +- CONTRIB: Gentoo daemon startup options as declared in conf.d/sssd + +Yuri Chornoivan (1): + +- Fix minor typos diff --git a/users/relnotes/notes_1_13_2.rst b/users/relnotes/notes_1_13_2.rst new file mode 100644 index 0000000..0c557ee --- /dev/null +++ b/users/relnotes/notes_1_13_2.rst @@ -0,0 +1,252 @@ +SSSD 1.13.2 +=========== + +Highlights +---------- + +- This is primarily a bugfix release, with minor features added to the + local overrides feature +- The ``sss_override`` tool gained new ``user-show``, ``user-find``, + ``group-show`` and ``group-find`` commands +- The PAM responder was crashing if PAM\_USER was set to an empty + string. This bug was fixed +- The ``sssd_be`` process could crash when looking up groups in setups + with IPA-AD trusts that use POSIX attributes but do not replicate + them to the Global Catalog +- A socket leak in case SSSD couldn't establish a connection to an LDAP + server was fixed +- SSSD's memory cache now behaves better when used by long-running + applications such as system deamons and the administrator invalidates + the cache +- The SSSDConfig Python API no longer throws an exception when + config\_file\_version is missing +- The InfoPipe D-Bus interface is able to retrieve user groups + correctly if the user is a member of non-POSIX groups like ipausers + as well +- Lookups by certificate now work correctly in multi-domain environment +- The lookup of POSIX attributes after startup was relaxed to only + check attribute presence, not validity. The POSIX check was also made + less verbose. +- A bug when looking up a subdomain user by UPN users was fixed + +Packaging Changes +----------------- + +- The memory cache for initgroups results was previously not packaged. + This bug was fixed. +- Python 2/3 packaging in the RPM specfile was improved + +Tickets Fixed +------------- + +.. raw:: html + +
+ +`#2176 `__ + warn if memcache\_timeout is greater than entry\_cache\_timeout +`#2493 `__ + Check chown\_debug\_file() usage +`#2673 `__ + Consider also disabled domains when link\_forest\_roots() is called +`#2697 `__ + extend PAM responder unit test +`#2706 `__ + Contribute and DevelTips are duplicate +`#2726 `__ + Long living applicantion can use removed memory cache. +`#2730 `__ + responder\_cache\_req-tests failed +`#2736 `__ + sss\_override: add find and show commands +`#2759 `__ + sbus\_codegen\_tests leaves a process running +`#2779 `__ + Review and update wiki pages for 1.13.2 +`#2786 `__ + Create a wiki page that lists security-sensitive options +`#2792 `__ + SSSD is not closing sockets properly +`#2800 `__ + Relax POSIX check +`#2802 `__ + sss\_override segfaults when accidentally adding --help flag to some + commands +`#2804 `__ + Size limit exceeded too loud during POSIX check +`#2807 `__ + CI: configure script failed on CentOS {6,7} +`#2810 `__ + sssd\_be crashed +`#2811 `__ + PAM responder crashed if user was not set +`#2814 `__ + avoid symlinks witih python modules +`#2819 `__ + CI: test\_ipa\_subdomains\_server failed on rhel6 + --coverage + (FAIL: test\_ipa\_subdom\_server) +`#2826 `__ + sss\_override: memory violation +`#2827 `__ + bug in UPN lookups for subdomain users +`#2833 `__ + local overrides: don't contact server with overriden name/id +`#2837 `__ + REGRESSION: ipa-client-automout failed +`#2861 `__ + sssd crashes if non-UTF-8 locale is used +`#2863 `__ + IFP: ifp\_users\_user\_get\_groups doesn't handle non-POSIX groups + +.. raw:: html + +
+ +Detailed Changelog +------------------ + +Dan Lavu (1): + +- sss\_override: Add restart requirements to man page + +Jakub Hrozek (10): + +- Bump the version for the 1.13.2 development +- AD: Provide common connection list construction functions +- AD: Consolidate connection list construction on ad\_common.c +- tests: Fix compilation warning +- tools: Don't shadow 'exit' +- IFP: Skip non-POSIX groups properly +- DP: Drop dp\_pam\_err\_to\_string +- DP: Check callback messages for valid UTF-8 +- sbus: Check string arguments for valid UTF-8 strings +- Updating translations for the 1.13.2 release + +Lukas Slebodnik (33): + +- CI: Fix configure script arguments for CentOS +- CI: Don't depend on user input with apt-get +- CI: Add missing dependency for debian +- CI: Run integration tests on debian testing +- BUILD: Link just libsss\_crypto with crypto libraries +- BUILD: Link crypto\_tests with existing library +- BUILD: Remove unused variable TEST\_MOCK\_OBJ +- BUILD: Avoid symlinks with python modules +- SSSDConfigTest: Try load saved config +- SSSDConfigTest: Test real config without config\_file\_version +- intg\_tests: Fix PEP8 warnings +- BUILD: Accept krb5 1.14 for building the PAC plugin +- BUILD: Fix detection of pthread with strict CFLAGS +- BUILD: Fix doc directory for sss\_simpleifp +- LDAP: Fix leak of file descriptors +- CI: Workaroung for code coverage with old gcc +- cache\_req: Fix warning -Wshadow +- SBUS: Fix warnings -Wshadow +- TESTS: Fix warnings -Wshadow +- INIT: Drop syslog.target from service file +- sbus\_codegen\_tests: Suppress warning Wmaybe-uninitialized +- DP\_PTASK: Fix warning may be used uninitialized +- UTIL: Fix memory leak in switch\_creds +- TESTS: Initialize leak check +- TESTS: Check return value of check\_leaks\_pop +- TESTS: Make check\_leaks static function +- TESTS: Add warning for unused result of leak check functions +- sss\_client: Fix underflow of active\_threads +- sssd\_client: Do not use removed memory cache +- test\_memory\_cache: Test removing mc without invalidation +- Revert "intg: Invalidate memory cache before removing files" +- CONFIGURE: Bump AM\_GNU\_GETTEXT\_VERSION +- test\_sysdb\_subdomains: Do not use assignment in assertions + +Michal Židek (7): + +- SSSDConfig: Do not raise exception if config\_file\_version is + missing +- spec: Missing initgroups mmap file +- util: Update get\_next\_domain's interface +- tests: Add get\_next\_domain\_flags test +- sysdb: Include disabled domains in link\_forest\_roots +- sysdb: Use get\_next\_domain instead of dom->next +- Refactor some conditions + +Nikolai Kondrashov (13): + +- CI: Update reason blocking move to DNF +- CI: Exclude whitespace\_test from Valgrind checks +- intg: Get base DN from LDAP connection object +- intg: Add support for specifying all user attrs +- intg: Split LDAP test fixtures for flexibility +- intg: Reduce sssd.conf duplication in test\_ldap.py +- intg: Fix RFC2307bis group member creation +- intg: Do not use non-existent pre-increment +- CI: Do not skip tests not checked with Valgrind +- CI: Handle dashes in valgrind-condense +- intg: Fix all PEP8 issues +- CI: Enforce coverage make check failures +- intg: Add more LDAP tests + +Pavel Březina (23): + +- sss tools: improve option handling +- sbus codegen tests: free ctx +- cache\_req: provide extra flag for oob request +- cache\_req: add support for UPN +- cache\_req tests: reduce code duplication +- cache\_req: remove raw\_name and do not touch orig\_name +- sss\_override: fix comment describing format +- sss\_override: explicitly set ret = EOK +- sss\_override: steal msgs string to objs +- nss: send original name and id with local views if possible +- sudo: search with view even if user is found +- sudo: send original name and id with local views if possible +- sss\_tools: always show common and help options +- sss\_override: fix exporting multiple domains +- sss\_override: add user-find +- sss\_override: add group-find +- sss\_override: add user-show +- sss\_override: add group-show +- sss\_override: do not free ldb\_dn in get\_object\_dn() +- sss\_override: use more generic help text +- sss\_tools: do not allow unexpected free argument +- BE: Add IFP to known clients +- AD: remove annoying debug message + +Pavel Reichl (12): + +- AD: add debug messages for netlogon get info +- confdb: warn if memcache\_timeout > than entry\_cache +- SDAP: Relax POSIX check +- SDAP: optional warning - sizelimit exceeded in POSIX check +- SDAP: allow\_paging in sdap\_get\_generic\_ext\_send() +- SDAP: change type of attrsonly in sdap\_get\_generic\_ext\_state +- SDAP: pass params in sdap\_get\_and\_parse\_generic\_send +- sss\_override: amend man page - overrides do not stack +- sss\_override: Removed overrides might be in memcache +- pam-srv-tests: split pam\_test\_setup() so it can be reused +- pam-srv-tests: Add UT for cached 'online' auth. +- intg: Add test for user and group local overrides + +Petr Cech (9): + +- DEBUG: Preventing chown\_debug\_file if journald on +- TEST: Add test\_user\_by\_recent\_filter\_valid +- TEST: Refactor of test\_responder\_cache\_req.c +- TEST: Refactor of test\_responder\_cache\_req.c +- TEST: Add common function are\_values\_in\_array() +- TEST: Add test\_users\_by\_recent\_filter\_valid +- TEST: Add test\_group\_by\_recent\_filter\_valid +- TEST: Refactor of test\_responder\_cache\_req.c +- TEST: Add test\_groups\_by\_recent\_filter\_valid + +Stephen Gallagher (2): + +- LDAP: Inform about small range size +- Monitor: Show service pings at debug level 8 + +Sumit Bose (5): + +- PAM: only allow missing user name for certificate authentication +- fix ldb\_search usage +- fix upn cache\_req for sub-domain users +- nss: fix UPN lookups for sub-domain users +- cache\_req: check all domains for lookups by certificate diff --git a/users/relnotes/notes_1_13_3.rst b/users/relnotes/notes_1_13_3.rst new file mode 100644 index 0000000..15787b5 --- /dev/null +++ b/users/relnotes/notes_1_13_3.rst @@ -0,0 +1,145 @@ +SSSD 1.13.3 +=========== + +Highlights +---------- + +- A bug that prevented user lookups and logins after migration from + winsync to IPA-AD trusts was fixed +- The OCSP certificate validation checks are enabled for smartcard + logins if SSSD was compiled with the NSS crypto library. +- A bug that prevented the ``ignore_group_members`` option from working + correctly in AD provider setups that use a dedicated primary group + (as opposed to a user-private group) was fixed +- Offline detection and offline login timeouts were improved for AD + users logging in from a domain trusted by an IPA server +- The AD provider supports setting up ``autofs_provider=ad`` +- Several usability improvements to our debug messages + +Packaging Changes +----------------- + +- The ``p11_child`` helper binary is able to run completely + unprivileged and no longer requires the setgid bit to be set + +Documentation Changes +--------------------- + +- A new option ``certificate_verification`` was added. This option + allows the administrator to disable OCSP checks in case the OCSP + server is not reachable + +Tickets Fixed +------------- + +.. raw:: html + +
+ +`#1632 `__ + [RFE] Unable to use AD provider for automount lookups +`#1943 `__ + convert sudo timer to be\_ptask +`#2672 `__ + sudo: reload hostinfo when going online +`#2732 `__ + Add Integration tests for local views feature +`#2747 `__ + get\_object\_from\_cache() does not handle services +`#2755 `__ + Review p11\_child hardening +`#2787 `__ + We should mention SSS\_NSS\_USE\_MEMCACHE in man sssd.conf(5) as + well +`#2796 `__ + fix man page for sssd-ldap +`#2801 `__ + Check next certificate on smart card if first is not valid +`#2812 `__ + Smartcard login when certificate on the card is revoked and ocsp + check enabled is not supported +`#2830 `__ + Try to suppress "Could not parse domain SID from [(null)]" for IPA + users +`#2846 `__ + Inform about SSSD PAC timeout better +`#2868 `__ + AD provider and ignore\_group\_members=True might cause flaky group + memberships +`#2874 `__ + sssd: [sysdb\_add\_user] (0x0400): Error: 17 (File exists) + +.. raw:: html + +
+ +Detailed Changelog +------------------ + +Dan Lavu (1): + +- Clarify that subdomains always use service discovery + +Jakub Hrozek (7): + +- Upgrading the version for the 1.13.3 release +- DP: Do not confuse static analysers with dead code +- BUILD: Only install polkit rules if the directory is available +- IPA: Use search timeout, not enum timeout for searching overrides +- AD: Add autofs provider +- MAN: Clarify when should TGs be disabled for group nesting + restriction +- Update translations for the 1.13.3 release + +Lukas Slebodnik (2): + +- sbus\_codegen\_tests: Use portable definition of large constants +- DEBUG: Add missing new lines + +Michal Židek (1): + +- MAN: sssd.conf should mention SSS\_NSS\_USE\_MEMCACHE + +Pavel Březina (22): + +- SYSDB: Add missing include to sysdb\_services.h +- LDAP: Mark globals in ldap\_opts.h as extern +- AD: Mark globals in ad\_opts.h as extern +- IPA: Mark globals in ipa\_opts.h as extern +- KRB5: Mark globals in krb5\_opts.h as extern +- SUDO: convert periodical refreshes to be\_ptask +- SUDO: move refreshes from sdap\_sudo.c to sdap\_sudo\_refresh.c +- SUDO: move offline check to handler +- SUDO: simplify error handling +- SUDO: fix sdap\_id\_op logic +- SUDO: fix tevent style +- SUDO: fix sdap\_sudo\_smart\_refresh\_recv() +- SUDO: sdap\_sudo\_load\_sudoers improve iterator +- SUDO: set USN inside sdap\_sudo\_refresh request +- SUDO: built host filter inside sdap\_sudo\_refresh request +- SUDO: do not imitate full refresh if usn is unknown in smart refresh +- SUDO: fix potential memory leak in sdap\_sudo\_init +- SUDO: obtain host information when going online +- SUDO: remove finalizer +- SUDO: make sdap\_sudo\_handler static +- SUDO: use size\_t instead of int in for cycles +- SUDO: get srv\_opts after we are connected + +Pavel Reichl (1): + +- sysdb-tests: Fix warning - incompatible pointer type + +Petr Cech (2): + +- IPA\_PROVIDER: Explicit no handle of services +- KRB5\_CHILD: Debug logs for PAC timeout + +Sumit Bose (7): + +- IPA: fix override with the same name +- p11: allow p11\_child to run completely unprivileged +- p11: check if cert is valid before selecting it +- p11: enable ocsp checks +- ldap: skip sdap\_save\_grpmem() if ignore\_group\_members is set +- initgr: only search for primary group if it is not already cached +- LDAP: check early for missing SID in mapping check diff --git a/users/relnotes/notes_1_13_4.rst b/users/relnotes/notes_1_13_4.rst new file mode 100644 index 0000000..439f2cf --- /dev/null +++ b/users/relnotes/notes_1_13_4.rst @@ -0,0 +1,348 @@ +SSSD 1.13.4 +=========== + +Highlights +---------- + +- The IPA sudo provider was reimplemented. The new version reads the + data from IPA's LDAP tree (as opposed to the compat tree populated by + the ``slapi-nis`` plugin that was used previously). The benefit is + that deployments which don't require the compat tree for other + purposes, such as support for non-SSSD clients can disable those + autogenerated LDAP trees to conserve resources that slapi-nis + otherwise requires. There should be no visible changes to the end + user. +- SSSD now has the ability to renew the machine credentials (keytabs) + when the ``ad`` provider is used. Please note that a recent version + of the ``adcli`` (0.8 or newer) package is required for this feature + to work. +- The automatic ID mapping feature was improved so that the + administrator is no longer required to manually set the range size in + case a RID in the AD domain is larger than the default range size +- A potential infinite loop in the NFS ID mapping plugin that was + resulting in an excessive memory usage was fixed +- Clients that are pinned to a particular AD site using the ``ad_site`` + option no longer communicate with DCs outside that site during + service discovery. +- The IPA identity provider is now able to resolve external (typically + coming from a trusted AD forest) group members during + get-group-information requests. Please note that resolving external + group memberships for AD users during the initgroup requests used to + work even prior to this update. This feature is mostly useful for + cases where an IPA client is using the compat tree to resolve AD + trust users. +- The IPA ID views feature now works correctly even for deployments + without a trust relationship. Previously, the ``subdomains`` IPA + provider failed to read the views data if no master domain record was + created on the IPA server during trust establishment. +- A race condition in the client libraries between the SSSD closing the + socket as idle and the client application using the socket was fixed. + This bug manifested with a ``Broken Pipe`` error message on the + client. +- SSSD is now able to resolve users with the same usernames in + different OUs of an AD domain +- The smartcard authentication now works properly with + ``gnome-screensaver`` + +Packaging Changes +----------------- + +- The ``krb5.include.d`` directory is now owned by the ``sssd`` user + and packaged in the ``krb5-common`` subpackage + +Documentation Changes +--------------------- + +- A new option ``ldap_idmap_helper_table_size`` was added. This option + can help tune allocation of new ID mapping slices for AD domains with + a high RID values. Most deployments can use the default value of this + option. +- Several PAM services were added to the lists that are used to map + Windows logon services to Linux PAM services. The newly added PAM + services include login managers (``lightdm``, ``lxdm``, ``sddm`` and + ``xdm``) as well as the ``cockpit`` service. +- The AD machine credentials renewal task can be fine-tuned using the + ``ad_machine_account_password_renewal_opts`` to change the initial + delay and period of the credentials renewal task. In addition, the + new ``ad_maximum_machine_account_password_age`` option allows the + administrator to select how old the machine credential must be before + trying to renew it. +- The administrator can use the new option + ``pam_account_locked_message`` to set a custom informational message + when the account logging in is locked. + +Tickets Fixed +------------- + +.. raw:: html + +
+ +`#1041 `__ + [RFE] Support Automatic Renewing of Kerberos Host Keytabs +`#1108 `__ + [RFE] SUDO: Support the IPA schema +`#2188 `__ + automatically assign new slices for any AD domain +`#2522 `__ + [RFE] IPA: resolve external group memberships of IPA groups during + getgrnam and getgrgid +`#2626 `__ + Retry EPIPE from clients +`#2764 `__ + the colondb intreface has no unit tests +`#2765 `__ + ad\_site parameter does not work +`#2785 `__ + incompatibility between sparkleshare and sss\_ssh\_knownhostsproxy + due to setlocale() +`#2791 `__ + sssd dereference processing failed : Input/output error +`#2829 `__ + collapse\_srv\_lookups frees fo\_server structure that is returned + by fail over API +`#2839 `__ + Allow SSSD to notify user of denial due to AD account lockout +`#2849 `__ + cache\_req: don't search override values in LDAP when using LOCAL + view +`#2865 `__ + sssd\_nss memory usage keeps growing on sssd-1.12.4-47.el6.x86\_64 + (RHEL6.7) when trying to retrieve non-existing netgroups +`#2881 `__ + MAN: Clarify that subdomains always use service discovery +`#2888 `__ + SRV lookups with id\_provider=proxy and auth\_provider=krb5 +`#2899 `__ + [sssd] Trusted (AD) user's info stays in sssd cache for much more + than expected. +`#2902 `__ + Review and update wiki pages for 1.13.4 +`#2904 `__ + sssd\_be AD segfaults on missing A record +`#2906 `__ + Cannot retrieve users after upgrade from 1.12 to 1.13 +`#2909 `__ + extreme memory usage in libnfsidmap sss.so plug-in when resolving + groups with many members +`#2910 `__ + sssd mixup nested group from AD trusted domains +`#2912 `__ + refresh\_expired\_interval stops sss\_cache from working +`#2917 `__ + Properly remove OriginalMemberOf attribute in SSSD cache if user has + no secondary groups anymore +`#2922 `__ + ID mapping - bug in computing max id for slice range +`#2925 `__ + Add gnome-screensaver to the list of PAM services considered for + Smartcard authentication +`#2931 `__ + Warn if user cannot read krb5.conf +`#2934 `__ + After removing certificate from user in IPA and even after + sss\_cache, FindByCertificate still finds the user +`#2937 `__ + sss\_obfuscate: SyntaxError: Missing parentheses in call to 'print' +`#2938 `__ + Cannot start sssd after switching to non-root +`#2959 `__ + The delete operation of the memberof plugin allocates memory on NULL + context +`#2960 `__ + IPA view: view name not stored properly with default FreeIPA + installation +`#2961 `__ + Initgroups in AD provider might fail if user is stored in a + non-default ou +`#2962 `__ + GPO: Access denied in non-root mode +`#2964 `__ + GPO: Access denied after blocking connection to AD. +`#2969 `__ + sudorule not working with ipa sudo\_provider on older freeipa +`#2970 `__ + sudo smart refresh does not work correctly on openldap +`#2971 `__ + SSSD PAM module does not support multiple password prompts (e.g. + Password + Token) with sudo +`#2972 `__ + IPA sudo: support the externalUser attribute +`#2980 `__ + sssd\_be[11010]: segfault at 0 ip 00007ff889ff61bb sp + 00007ffc7d66a3b0 error 4 in libsss\_ipa.so[7ff889fcf000+5d000] +`#2989 `__ + local overrides: issues with sub-domain users and mixed case names + +.. raw:: html + +
+ +Detailed Changelog +------------------ + +Dan Lavu (1): + +- PAM: Fix man for pam\_account\_{expired,locked}\_message + +David Disseldorp (1): + +- build: detect endianness at configure time + +Jakub Hrozek (17): + +- Upgrading the version for the 1.13.4 release +- SDAP: Make it possible to silence errors from dereference +- Add a new option ldap\_group\_external\_member +- IPA: Add interface to call into IPA provider from LDAP provider +- LDAP: Use the IPA provider interface to resolve external group + members +- FO: Don't free rc-allocated structure +- tests: Reduce failover code duplication +- FO: Use refcount to keep track of servers returned to callers +- FO: Use tevent\_req\_defer\_callback() when notifying callers +- memberof: Don't allocate on a NULL context +- tests: Add a unit test for the external groups resolution +- MAN: Remove duplicate description of the + pam\_account\_locked\_message option +- AD: Recognize Windows Server 2016 +- memberof: Fix a memory leak when removing ghost users +- memberof: Don't allocate on NULL when deleting memberUids +- tests: Check NULL context in sysdb-tests when removing group members +- Updating translations for the 1.13.4 release + +Lukas Slebodnik (33): + +- SPEC: Change package ownership of %{pubconfpath}/krb5.include.d +- CONFIGURE: Replace obsoleted macro AC\_PROG\_LIBTOOL +- TESTS: Fix race condition in python test +- PYTHON: sss\_obfuscate should work with python3 +- PYTHON: Fix pep8 errors in sss\_obfuscate +- UTIL: Backport error code ERR\_ACCOUNT\_LOCKED +- sss\_idmap-tests: Fix segmentation fault +- krb5\_child: Warn if user cannot read krb5.conf +- Fix typos reported by lintian +- UTIL: Use prefix for debug function +- UTIL: Provide varargs version of debug\_fn +- UTIL: Use sss\_vdebug\_fn for callbacks +- Revert "DEBUG: Preventing chown\_debug\_file if journald on" +- DEBUG: Ignore ENOENT for change owner of log files +- TOOLS: Fix minor memory leak in sss\_colondb\_writeline +- CI: Use yum-deprecated instead of dnf +- FAIL\_OVER: Fix warning value computed is not used +- UTIL: Fix indentation in dlinklist.h +- UTIL: Fix warning misleading-indentation +- CLIENT: Reduce code duplication +- CLIENT: Retry request after EPIPE +- UTIL: Move debug part from util.h -> new debug.h +- UTIL: Allow to append new line in sss\_vdebug\_fn +- AUTOMAKE: Force usage of parallel test harness +- CI: Use make check instead of make-check-wrap +- test\_ipa\_subdom\_server: Workaround for slow krb5 + SELinux +- SPEC: Run extra unit tests with epel +- GPO: Soften umask in gpo\_child +- GPO\_CHILD: Create directories in gpo\_cache with right permissions +- GPO: Process GPOS in offline mode if ldap search failed +- IPA: Check RDN in ipa\_add\_ad\_memberships\_get\_next +- dp\_ptask: Fix memory leak in synchronous ptask +- test\_be\_ptask: Check leaks in tests + +Michal Židek (6): + +- NSS: do not skip cache check for netgoups +- util: Continue if setlocale fails +- server\_setup: Log failed attempt to set locale +- tests: Run intgcheck without libsemanage +- tests: Regression test with wrong LC\_ALL +- GPO: log specific ini parse error messages + +Pavel Březina (37): + +- AD SRV: prefer site-local DCs in LDAP ping +- SDAP: do not fail if refs are found but not processed +- SDAP: Add request that iterates over all search bases +- SDAP: rename sdap\_get\_id\_specific\_filter +- SDAP: support empty filters in sdap\_combine\_filters() +- SUDO: use sdap\_search\_bases instead custom sb iterator +- SUDO: make sudo sysdb interface more reusable +- SUDO: move code shared between ldap and ipa to separate module +- SUDO: allow to disable ptask +- SUDO: fail on failed request that cannot be retry +- IPA: add ipa\_get\_rdn and ipa\_check\_rdn +- SDAP: use ipa\_get\_rdn() in nested groups +- IPA SUDO: choose between IPA and LDAP schema +- IPA SUDO: Add ipasudorule mapping +- IPA SUDO: Add ipasudocmdgrp mapping +- IPA SUDO: Add ipasudocmd mapping +- IPA SUDO: Implement sudo handler +- IPA SUDO: Implement full refresh +- IPA SUDO: Implement rules refresh +- IPA SUDO: Remember USN +- SDAP: Add sdap\_or\_filters +- IPA SUDO: Implement smart refresh +- SUDO: sdap\_sudo\_set\_usn() do not steal usn +- SUDO: remove full\_refresh\_in\_progress +- SUDO: assume zero if usn is unknown +- SUDO: allow disabling full refresh +- SUDO: remember usn as number instead of string +- SUDO: simplify usn filter +- IPA SUDO: Add support for ipaSudoRunAsExt\* attributes +- sdap\_connect\_send: fail if uri or sockaddr is NULL +- cache\_req: simplify cache\_req\_cache\_check() +- cache\_req: do not lookup views if possible +- remove user certificate if not found on the server +- IPA SUDO: download externalUser attribute +- IPA SUDO: fix typo +- IPA SUDO: support old ipasudocmd rdn +- SUDO: be able to parse modifyTimestamp correctly + +Pavel Reichl (11): + +- sudo: remove unused param name in sdap\_sudo\_get\_usn() +- sudo: remove unused param. in ldap\_get\_sudo\_options +- IDMAP: Fix computing max id for slice range +- IDMAP: New structure for domain range params +- IDMAP: Add support for automatic adding of ranges +- IDMAP: Fix minor memory leak +- IDMAP: Man change for ldap\_idmap\_range\_size option +- NSS: Fix memory leak netgroup +- IDMAP: Add test to validate off by one bug +- SDAP: Add return code ERR\_ACCOUNT\_LOCKED +- PAM: Pass account lockout status and display message + +Petr Cech (6): + +- KRB5: Adding DNS SRV lookup for krb5 provider +- TOOLS: Fix memory leak after getline() failed +- TOOLS: Add comments on functions in colondb +- TEST\_TOOLS\_COLONDB: Add tests for sss\_colondb\_\* +- REFACTOR: umask(077) --> umask(SSS\_DFL\_X\_UMASK) +- REFACTOR: umask(0177) --> umask(SSS\_DFL\_UMASK) + +Stephen Gallagher (2): + +- GPO: Add Cockpit to the Remote Interactive defaults +- GPO: Add other display managers to interactive logon + +Sumit Bose (20): + +- nfs idmap: fix infinite loop +- Use right domain for user lookups +- sdap\_save\_grpmem: determine domain by SID if possible +- ipa\_s2n\_save\_objects(): use configured user and group timeout +- ldap: remove originalMeberOf if there is no memberOf +- UTIL: allow to skip default options for child processes +- DP\_TASK: add be\_ptask\_get\_timeout() +- AD: add task to renew the machine account password if needed +- FO: add fo\_get\_active\_server() +- FO: add be\_fo\_get\_active\_server\_name() +- AD: try to use current server in the renewal task +- p11: add gnome-screensaver to list of allowed services +- IPA: lookup idview name even if there is no master domain record +- IPA: invalidate override data if original view is missing +- sdap: improve filtering of multiple results in GC lookups +- pam\_sss: reorder pam\_message array +- sss\_override: do not generate DN, search object +- tools: read additional data of the master domain +- sss\_override: only add domain if name is not fully qualified +- intg: local override for user with mixed case name