From 66d79126a0b5a6d417e7476c3423f1db6877b17d Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Aug 10 2017 15:06:45 +0000 Subject: [PATCH 1/5] Fix broken links for 1.13.0 release notes Signed-off-by: Fabiano Fidêncio --- diff --git a/users/relnotes/notes_1_13_0.rst b/users/relnotes/notes_1_13_0.rst index bbb4bd5..47adeae 100644 --- a/users/relnotes/notes_1_13_0.rst +++ b/users/relnotes/notes_1_13_0.rst @@ -52,9 +52,8 @@ Packaging Changes - All python bindings now have a Python3 and a Python2 version in the upstream RPM packaging scheme - The OpenSSL development library such as ``openssl-devel`` on - RHEL/Fedora or - `Debian/Ubuntu? `__ - ``libssl-dev`` is now required to support certificate operations + RHEL/Fedora or Debian/Ubuntu ``libssl-dev`` is now required to support + certificate operations - A new internal library ``libsss_cert.so`` is present in this release. - The fast initgroups memcache is represented by a new file ``/var/lib/sss/mc/initgroups`` @@ -81,64 +80,64 @@ Tickets Fixed
-`#897 `__ +`#897 `__ sssd should pass -d to nsupdate when running with high log level -`#1501 `__ +`#1501 `__ Make the LDAP bind operation timeout configurable -`#2150 `__ +`#2150 `__ [RFE] Expose listing calls over D-BUS -`#2224 `__ +`#2224 `__ nsupdate stderr is not captured -`#2236 `__ +`#2236 `__ The cleanup task has no DEBUG statements -`#2326 `__ +`#2326 `__ SBUS: Flush the UID cache when we receive NameOwnerChanged -`#2338 `__ +`#2338 `__ [RFE] Implement object caching on the bus -`#2339 `__ +`#2339 `__ IFP: support multiple interfaces for object -`#2540 `__ +`#2540 `__ SSSD does not update Dynamic DNS records if the IPA domain differs from machine hostname's domain -`#2569 `__ +`#2569 `__ In ipa-ad trust, with 'default\_domain\_suffix' set to AD domain, IPA user are not able to log unless use\_fully\_qualified\_names is set -`#2574 `__ +`#2574 `__ SSSD should be able to build python2 and python3 bindings in a one build -`#2583 `__ +`#2583 `__ [RFE] Homedir is always overwritten with subdomain\_homedir value in server mode -`#2593 `__ +`#2593 `__ Does sssd-ad use the most suitable attribute for group name? -`#2596 `__ +`#2596 `__ Add a way to lookup users based on CAC identity certificates -`#2603 `__ +`#2603 `__ Make SSSD's HBAC validation more permissive if deny rules are not used -`#2609 `__ +`#2609 `__ [bug] sssd always appends default\_domain\_suffix when checking for host keys -`#2618 `__ +`#2618 `__ Man sssd-ad(5) lists Group Policy Management Editor naming for some policies but not for all -`#2620 `__ +`#2620 `__ id\_provider=proxy with auth\_provider=ldap does not work reliably -`#2625 `__ +`#2625 `__ Sudo responder does not respect filter\_users and filter\_groups -`#2627 `__ +`#2627 `__ Disable the cleanup task by default -`#2636 `__ +`#2636 `__ RFE: Fetch keytabs for one-way trusts in IPA subdomain code -`#2638 `__ +`#2638 `__ RFE: Change ad\_id\_ctx instantiation in the IPA subdomain code to support one-way trusts -`#2645 `__ +`#2645 `__ [RFE] Support GPOs from different domain controllers -`#2661 `__ +`#2661 `__ RFE: Change AD GPO default to enforcing -`#2666 `__ +`#2666 `__ sssd with ldap backend throws error domain log .. raw:: html @@ -149,18 +148,18 @@ Tickets Fixed
-`#1807 `__ +`#1807 `__ [RFE] authenticate against cache in SSSD -`#2017 `__ +`#2017 `__ [RFE] Python 3 support -`#2485 `__ +`#2485 `__ [RFE] The fast memory cache should cache initgroups -`#2590 `__ +`#2590 `__ SSSD doesn't re-read resolv.conf if the file doesn't exist during boot -`#2641 `__ +`#2641 `__ Add a IS\_DEFAULT\_VIEW macro -`#2701 `__ +`#2701 `__ Kerberos-based providers other than krb5 do not queue requests .. raw:: html @@ -391,17 +390,13 @@ Pavel Březina (53): - IFP: add org.freedesktop.sssd.infopipe.Users.User - IFP: add org.freedesktop.sssd.infopipe.Groups - IFP: add org.freedesktop.sssd.infopipe.Groups.Group -- IFP: deprecate - `GetUserAttr? `__ +- IFP: deprecate GetUserAttr - IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object] -- SBUS: Use default - `GetAll? `__ invoker - if none is set +- SBUS: Use default GetAll invoker if none is set - SBUS: Add support for in introspection - IFP: Export nodes - sbus: add support for incoming signals -- sbus: listen to - `NameOwnerChanged? `__ +- sbus: listen to NameOwnerChanged Pavel Reichl (20): @@ -458,6 +453,4 @@ Sumit Bose (22): - LDAP/IPA: add user lookup by certificate - ncache: add calls for certificate based searches - utils: add get\_last\_x\_chars() -- IFP: add - `FindByCertificate? `__ - method for User objects +- IFP: add FindByCertificate method for User objects From 448897b58a48a24a88a9802ce639ec1d1d4e95ec Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Aug 10 2017 15:06:45 +0000 Subject: [PATCH 2/5] Fix broken links for 1.13.1 release notes Signed-off-by: Fabiano Fidêncio --- diff --git a/users/relnotes/notes_1_13_1.rst b/users/relnotes/notes_1_13_1.rst index 6a22a68..15f62e3 100644 --- a/users/relnotes/notes_1_13_1.rst +++ b/users/relnotes/notes_1_13_1.rst @@ -66,142 +66,142 @@ Tickets Fixed
-`#546 `__ +`#546 `__ [RFE] Support for smart cards -`#1697 `__ +`#1697 `__ sssd: incorrect checks on length values during packet decoding -`#1926 `__ +`#1926 `__ [RFE] Start the dynamic DNS update after the SSSD has been setup for the first time -`#1994 `__ +`#1994 `__ Complain loudly if backend doesn't start due to missing or invalid keytab -`#2275 `__ +`#2275 `__ nested netgroups do not work in IPA provider -`#2283 `__ +`#2283 `__ test dyndns failed. -`#2335 `__ +`#2335 `__ Investigate using the krb5 responder for driving the PAM conversation with OTPs -`#2463 `__ +`#2463 `__ Pass error messages via the extdom plugin -`#2495 `__ +`#2495 `__ [RFE]Allow sssd to add a new option that would specify which server to update DNS with -`#2549 `__ +`#2549 `__ RFE: Support multiple interfaces with the dyndns\_iface option -`#2553 `__ +`#2553 `__ RFE: Add support for wildcard-based cache updates -`#2558 `__ +`#2558 `__ Add dualstack and multihomed support -`#2561 `__ +`#2561 `__ Too much logging -`#2579 `__ +`#2579 `__ TRACKER: Support one-way trusts for IPA -`#2581 `__ +`#2581 `__ Re-check memcache after acquiring the lock in the client code -`#2584 `__ +`#2584 `__ RFE: Support client-side overrides -`#2597 `__ +`#2597 `__ Add index for 'objectSIDString' and maybe to other cache attributes -`#2637 `__ +`#2637 `__ RFE: Don't mark the main domain as offline if SSSD can't connect to a subdomain -`#2639 `__ +`#2639 `__ RFE: Detect re-established trusts in the IPA subdomain code -`#2652 `__ +`#2652 `__ KDC proxy not working with SSSD krb5\_use\_kdcinfo enabled -`#2676 `__ +`#2676 `__ Group members are not turned into ghost entries when the user is purged from the SSSD cache -`#2682 `__ +`#2682 `__ sudoOrder not honored as expected -`#2688 `__ +`#2688 `__ Default to config\_file\_version=2 -`#2691 `__ +`#2691 `__ GPO: PAM system error returned for PAM\_ACCT\_MGMT and offline mode -`#2692 `__ +`#2692 `__ GPO: Access denied due to using wrong sam\_account\_name -`#2699 `__ +`#2699 `__ SSSDConfig: wrong return type returned on python3 -`#2700 `__ +`#2700 `__ krb5\_child should always consider online state to allow use of MS-KKDC proxy -`#2708 `__ +`#2708 `__ Logging messages from user point of view -`#2711 `__ +`#2711 `__ [RFE] Provide interface for SSH to fetch user certificate -`#2712 `__ +`#2712 `__ Initgroups memory cache does not work with fq names -`#2716 `__ +`#2716 `__ Initgroups mmap cache needs update after db changes -`#2717 `__ +`#2717 `__ well-known SID check is broken for NetBIOS prefixes -`#2718 `__ +`#2718 `__ SSSD keytab validation check expects root ownership -`#2719 `__ +`#2719 `__ IPA: returned unknown dp error code with disabled migration mode -`#2722 `__ +`#2722 `__ Missing config options in gentoo init script -`#2723 `__ +`#2723 `__ Could not resolve AD user from root domain -`#2724 `__ +`#2724 `__ getgrgid for user's UID on a trust client prevents getpw\* -`#2725 `__ +`#2725 `__ If AD site detection fails, not even ad\_site override skipped -`#2729 `__ +`#2729 `__ Do not send SSS\_OTP if both factors were entered separately -`#2731 `__ +`#2731 `__ searching SID by ID always checks all domains -`#2733 `__ +`#2733 `__ Don't use deprecated libraries (libsystemd-\*) -`#2737 `__ +`#2737 `__ sss\_override: add import and export commands -`#2738 `__ +`#2738 `__ Cannot build rpms from upstream spec file on rawhide -`#2742 `__ +`#2742 `__ When certificate is added via user-add-cert, it cannot be looked up via org.freedesktop.sssd.infopipe.Users.FindByCertificate -`#2743 `__ +`#2743 `__ memory cache can work intermittently -`#2744 `__ +`#2744 `__ cleanup\_groups should sanitize dn of groups -`#2746 `__ +`#2746 `__ the PAM srv test often fails on RHEL-7 -`#2748 `__ +`#2748 `__ test\_memory\_cache failed in invalidation cache before stop -`#2749 `__ +`#2749 `__ Fix crash in nss responder -`#2754 `__ +`#2754 `__ Clear environment and set restrictive umask in p11\_child -`#2757 `__ +`#2757 `__ sss\_override does not work correctly when 'use\_fully\_qualified\_names = True' -`#2758 `__ +`#2758 `__ sss\_override contains an extra parameter --debug but is not listed in the man page or in the arguments help -`#2762 `__ +`#2762 `__ [RFE] sssd: better feedback form constraint password change -`#2768 `__ +`#2768 `__ Test 'test\_id\_cleanup\_exp\_group' failed -`#2772 `__ +`#2772 `__ sssd cannot resolve user names containing backslash with ldap provider -`#2773 `__ +`#2773 `__ Make p11\_child timeout configurable -`#2777 `__ +`#2777 `__ Fix memory leak in GPO -`#2782 `__ +`#2782 `__ sss\_override : The local override user is not found -`#2783 `__ +`#2783 `__ REGRESSION: Dyndns soes not update reverse DNS records -`#2790 `__ +`#2790 `__ sss\_override --name doesn't work with RFC2307 and ghost users -`#2799 `__ +`#2799 `__ unit tests do not link correctly on Debian -`#2803 `__ +`#2803 `__ Memory leak / possible DoS with krb auth. -`#2805 `__ +`#2805 `__ AD: Conditional jump or move depends on uninitialised value .. raw:: html @@ -340,7 +340,7 @@ Michal Židek (13): - SYSDB: Add function to expire entry - cleanup task: Expire all memberof targets when removing user - CI: Add regression test for - `#2676 `__ + `#2676 `__ - intg: Fix some PEP 8 violations - PAM: Make p11\_child timeout configurable - tests: Set p11\_child\_timeout to 30 in tests @@ -405,8 +405,7 @@ Petr Cech (6): - DATA\_PROVIDER: BE\_REQ as string in log message - IPA PROVIDER: Resolve nested netgroup membership -Robin `McCorkell? `__ -(1): +Robin McCorkell (1): - man: List alternative schema defaults for LDAP AutoFS parameters From a0bec4d7b85c9029db8932097b8ebd19097dedc3 Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Aug 10 2017 15:06:45 +0000 Subject: [PATCH 3/5] Fix broken links for 1.13.2 release notes Signed-off-by: Fabiano Fidêncio --- diff --git a/users/relnotes/notes_1_13_2.rst b/users/relnotes/notes_1_13_2.rst index 0c557ee..a500822 100644 --- a/users/relnotes/notes_1_13_2.rst +++ b/users/relnotes/notes_1_13_2.rst @@ -43,59 +43,59 @@ Tickets Fixed
-`#2176 `__ +`#2176 `__ warn if memcache\_timeout is greater than entry\_cache\_timeout -`#2493 `__ +`#2493 `__ Check chown\_debug\_file() usage -`#2673 `__ +`#2673 `__ Consider also disabled domains when link\_forest\_roots() is called -`#2697 `__ +`#2697 `__ extend PAM responder unit test -`#2706 `__ +`#2706 `__ Contribute and DevelTips are duplicate -`#2726 `__ +`#2726 `__ Long living applicantion can use removed memory cache. -`#2730 `__ +`#2730 `__ responder\_cache\_req-tests failed -`#2736 `__ +`#2736 `__ sss\_override: add find and show commands -`#2759 `__ +`#2759 `__ sbus\_codegen\_tests leaves a process running -`#2779 `__ +`#2779 `__ Review and update wiki pages for 1.13.2 -`#2786 `__ +`#2786 `__ Create a wiki page that lists security-sensitive options -`#2792 `__ +`#2792 `__ SSSD is not closing sockets properly -`#2800 `__ +`#2800 `__ Relax POSIX check -`#2802 `__ +`#2802 `__ sss\_override segfaults when accidentally adding --help flag to some commands -`#2804 `__ +`#2804 `__ Size limit exceeded too loud during POSIX check -`#2807 `__ +`#2807 `__ CI: configure script failed on CentOS {6,7} -`#2810 `__ +`#2810 `__ sssd\_be crashed -`#2811 `__ +`#2811 `__ PAM responder crashed if user was not set -`#2814 `__ +`#2814 `__ avoid symlinks witih python modules -`#2819 `__ +`#2819 `__ CI: test\_ipa\_subdomains\_server failed on rhel6 + --coverage (FAIL: test\_ipa\_subdom\_server) -`#2826 `__ +`#2826 `__ sss\_override: memory violation -`#2827 `__ +`#2827 `__ bug in UPN lookups for subdomain users -`#2833 `__ +`#2833 `__ local overrides: don't contact server with overriden name/id -`#2837 `__ +`#2837 `__ REGRESSION: ipa-client-automout failed -`#2861 `__ +`#2861 `__ sssd crashes if non-UTF-8 locale is used -`#2863 `__ +`#2863 `__ IFP: ifp\_users\_user\_get\_groups doesn't handle non-POSIX groups .. raw:: html From e330cdb7594ed67d6675cecbf3bbec6800dcff59 Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Aug 10 2017 15:06:45 +0000 Subject: [PATCH 4/5] Fix broken links for 1.13.3 release notes Signed-off-by: Fabiano Fidêncio --- diff --git a/users/relnotes/notes_1_13_3.rst b/users/relnotes/notes_1_13_3.rst index 15787b5..f42d7f6 100644 --- a/users/relnotes/notes_1_13_3.rst +++ b/users/relnotes/notes_1_13_3.rst @@ -36,37 +36,37 @@ Tickets Fixed
-`#1632 `__ +`#1632 `__ [RFE] Unable to use AD provider for automount lookups -`#1943 `__ +`#1943 `__ convert sudo timer to be\_ptask -`#2672 `__ +`#2672 `__ sudo: reload hostinfo when going online -`#2732 `__ +`#2732 `__ Add Integration tests for local views feature -`#2747 `__ +`#2747 `__ get\_object\_from\_cache() does not handle services -`#2755 `__ +`#2755 `__ Review p11\_child hardening -`#2787 `__ +`#2787 `__ We should mention SSS\_NSS\_USE\_MEMCACHE in man sssd.conf(5) as well -`#2796 `__ +`#2796 `__ fix man page for sssd-ldap -`#2801 `__ +`#2801 `__ Check next certificate on smart card if first is not valid -`#2812 `__ +`#2812 `__ Smartcard login when certificate on the card is revoked and ocsp check enabled is not supported -`#2830 `__ +`#2830 `__ Try to suppress "Could not parse domain SID from [(null)]" for IPA users -`#2846 `__ +`#2846 `__ Inform about SSSD PAC timeout better -`#2868 `__ +`#2868 `__ AD provider and ignore\_group\_members=True might cause flaky group memberships -`#2874 `__ +`#2874 `__ sssd: [sysdb\_add\_user] (0x0400): Error: 17 (File exists) .. raw:: html From 46ad93779b9800bba8748a6c76fe2d71d13ed4f4 Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Aug 10 2017 15:39:32 +0000 Subject: [PATCH 5/5] Fix broken links for 1.13.4 release notes Signed-off-by: Fabiano Fidêncio --- diff --git a/users/relnotes/notes_1_13_4.rst b/users/relnotes/notes_1_13_4.rst index 439f2cf..61d4ae2 100644 --- a/users/relnotes/notes_1_13_4.rst +++ b/users/relnotes/notes_1_13_4.rst @@ -78,100 +78,100 @@ Tickets Fixed
-`#1041 `__ +`#1041 `__ [RFE] Support Automatic Renewing of Kerberos Host Keytabs -`#1108 `__ +`#1108 `__ [RFE] SUDO: Support the IPA schema -`#2188 `__ +`#2188 `__ automatically assign new slices for any AD domain -`#2522 `__ +`#2522 `__ [RFE] IPA: resolve external group memberships of IPA groups during getgrnam and getgrgid -`#2626 `__ +`#2626 `__ Retry EPIPE from clients -`#2764 `__ +`#2764 `__ the colondb intreface has no unit tests -`#2765 `__ +`#2765 `__ ad\_site parameter does not work -`#2785 `__ +`#2785 `__ incompatibility between sparkleshare and sss\_ssh\_knownhostsproxy due to setlocale() -`#2791 `__ +`#2791 `__ sssd dereference processing failed : Input/output error -`#2829 `__ +`#2829 `__ collapse\_srv\_lookups frees fo\_server structure that is returned by fail over API -`#2839 `__ +`#2839 `__ Allow SSSD to notify user of denial due to AD account lockout -`#2849 `__ +`#2849 `__ cache\_req: don't search override values in LDAP when using LOCAL view -`#2865 `__ +`#2865 `__ sssd\_nss memory usage keeps growing on sssd-1.12.4-47.el6.x86\_64 (RHEL6.7) when trying to retrieve non-existing netgroups -`#2881 `__ +`#2881 `__ MAN: Clarify that subdomains always use service discovery -`#2888 `__ +`#2888 `__ SRV lookups with id\_provider=proxy and auth\_provider=krb5 -`#2899 `__ +`#2899 `__ [sssd] Trusted (AD) user's info stays in sssd cache for much more than expected. -`#2902 `__ +`#2902 `__ Review and update wiki pages for 1.13.4 -`#2904 `__ +`#2904 `__ sssd\_be AD segfaults on missing A record -`#2906 `__ +`#2906 `__ Cannot retrieve users after upgrade from 1.12 to 1.13 -`#2909 `__ +`#2909 `__ extreme memory usage in libnfsidmap sss.so plug-in when resolving groups with many members -`#2910 `__ +`#2910 `__ sssd mixup nested group from AD trusted domains -`#2912 `__ +`#2912 `__ refresh\_expired\_interval stops sss\_cache from working -`#2917 `__ +`#2917 `__ Properly remove OriginalMemberOf attribute in SSSD cache if user has no secondary groups anymore -`#2922 `__ +`#2922 `__ ID mapping - bug in computing max id for slice range -`#2925 `__ +`#2925 `__ Add gnome-screensaver to the list of PAM services considered for Smartcard authentication -`#2931 `__ +`#2931 `__ Warn if user cannot read krb5.conf -`#2934 `__ +`#2934 `__ After removing certificate from user in IPA and even after sss\_cache, FindByCertificate still finds the user -`#2937 `__ +`#2937 `__ sss\_obfuscate: SyntaxError: Missing parentheses in call to 'print' -`#2938 `__ +`#2938 `__ Cannot start sssd after switching to non-root -`#2959 `__ +`#2959 `__ The delete operation of the memberof plugin allocates memory on NULL context -`#2960 `__ +`#2960 `__ IPA view: view name not stored properly with default FreeIPA installation -`#2961 `__ +`#2961 `__ Initgroups in AD provider might fail if user is stored in a non-default ou -`#2962 `__ +`#2962 `__ GPO: Access denied in non-root mode -`#2964 `__ +`#2964 `__ GPO: Access denied after blocking connection to AD. -`#2969 `__ +`#2969 `__ sudorule not working with ipa sudo\_provider on older freeipa -`#2970 `__ +`#2970 `__ sudo smart refresh does not work correctly on openldap -`#2971 `__ +`#2971 `__ SSSD PAM module does not support multiple password prompts (e.g. Password + Token) with sudo -`#2972 `__ +`#2972 `__ IPA sudo: support the externalUser attribute -`#2980 `__ +`#2980 `__ sssd\_be[11010]: segfault at 0 ip 00007ff889ff61bb sp 00007ffc7d66a3b0 error 4 in libsss\_ipa.so[7ff889fcf000+5d000] -`#2989 `__ +`#2989 `__ local overrides: issues with sub-domain users and mixed case names .. raw:: html