From 8c39f3cfd882f530ecc70517ed083cd89d73c3d7 Mon Sep 17 00:00:00 2001 From: Michal Židek Date: Sep 16 2019 15:15:26 +0000 Subject: [PATCH 1/2] Release notes for SSSD 2.2.1 --- diff --git a/users/releases.rst b/users/releases.rst index f143204..dfe3b08 100644 --- a/users/releases.rst +++ b/users/releases.rst @@ -9,6 +9,8 @@ for a longer time than other releases. 2.x Series ^^^^^^^^^^ +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-2.2.1.tar.gz `_ |`sssd-2.2.1.tar.gz.asc `_ |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes ` |`Manpages `_ | ++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`sssd-2.2.0.tar.gz `_ |`sssd-2.2.0.tar.gz.asc `_ |SHA256SUM: ``ae618d73c7dc174a1481853ddbea82896bef031c623d374c77888e45b7d88558``|Date: 2019-06-13|:doc:`Release notes ` |`Manpages `_ | +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`*sssd-2.1.0.tar.gz `_ |`sssd-2.1.0.tar.gz.asc `_ |SHA256SUM: ``10f04bd8a1ae7e888e2bcc13edc1a64ef19b4990866c09c65c667d0c72b66743``|Date: 2019-02-27|:doc:`Release notes ` |`Manpages `_ | diff --git a/users/relnotes/notes_2_2_1.rst b/users/relnotes/notes_2_2_1.rst new file mode 100644 index 0000000..eac23f3 --- /dev/null +++ b/users/relnotes/notes_2_2_1.rst @@ -0,0 +1,189 @@ +SSSD 2.2.1 +========== + + +Highlights +---------- + +New features +^^^^^^^^^^^^ +* New options were added which allow sssd-kcm to handle bigger data. + See manual pages for ``max_ccaches``, ``max_uid_caches`` and + ``max_ccache_size``. +* SSSD can now automatically refresh cached user data from subdomains + in IPA/AD trust. + +Notable bug fixes +^^^^^^^^^^^^^^^^^ +* Fixed issue with SSSD hanging when connecting to non-responsive + server with ldaps:// +* SSSD is now restarted by systemd after crashes. +* Fixed refression when dyndns_update was set to True and + dyndns_refresh_interval was not set or set to 0 then DNS + records were not updated at all. +* Fixed issue when ``default_domain_suffix`` was used with + ``id_provider = files`` and caused all results from files domain to be + fully qualified. +* Fixed issue with sudo rules not being visible on OpenLDAP servers +* Fixed crash with ``auth_provider = proxy`` that prevented logins + + +Packaging Changes +----------------- +None + +Documentation Changes +--------------------- +A new option ``dns_resolver_server_timeout`` was added +A new option ``max_ccaches`` was added +A new option ``max_uid_ccaches`` was added +A new option ``max_ccache_size`` was added +A new option ``ocsp_dgst`` was added + +Tickets Fixed +------------- + * `2878 `_ - sssd failover does not work on connecting to non-responsive ldaps:// server + * `3217 `_ - Conflicting default timeout values + * `3386 `_ - sssd-kcm cannot handle big tickets + * `3489 `_ - p11_child should work wit openssl1.0+ + * `3685 `_ - KCM: Default to a new back end that would write to the secrets database directly + * `3833 `_ - port to pcre2 + * `3894 `_ - multihost tests: ldb-tools is needed for multihost tests + * `3905 `_ - SSSD doesn't clear cache entries for IDs below min_id. + * `4012 `_ - SSSD is not refreshing cached user data for the ipa sub-domain in a IPA/AD trust + * `4026 `_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 + * `4028 `_ - sssd-kcm calls sssd-genconf which triggers nscd warning + * `4037 `_ - Logins fail after upgrade to 2.2.0 + * `4040 `_ - Reasonable to Restart sssd on crashes? + * `4046 `_ - sudo: incorrect usn value for openldap + * `4047 `_ - dyndns_update = True is no longer not enough to get the IP address of the machine updated in IPA upon sssd.service startup + * `4050 `_ - nss_cmd_endservent resets the wrong index + * `4052 `_ - sssd config option "default_domain_suffix" should not cause the files domain entries to be qualified + * `3931 `_ - proxy provider is not working with enumerate=true when trying to fetch all groups + * `4043 `_ - Typo in systemd.m4 prevents detection of systemd.pc + * `3978 `_ - UPN negative cache does not use values from 'filter_users' config option + * `4032 `_ - p11_child::do_ocsp() function implementation is not FIPS140 compliant + * `4039 `_ - p11_child::sign_data() function implementation is not FIPS140 compliant + * `4056 `_ - permission denied on logs when running sssd as non-root user + * `4024 `_ - Non FIPS140 compliant usage of PRNG + * `2854 `_ - FAIL test-find-uid + * `3962 `_ - Problem with tests/cmocka/test_dyndns.c + * `4022 `_ - utils: sss_hmac_sha1() function implementation is not FIPS140 compliant + * `4024 `_ - Non FIPS140 compliant usage of PRNG + * `4026 `_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 + +Detailed changelog +------------------ +Alex Rodin (1): + tests/cmocka/test_dyndns.c: Switching from tevent_loop_once() to tevent_loop_wait() + +Alexey Tikhonov (14): + util/crypto/libcrypto: changed sss_hmac_sha1() + util/crypto/libcrypto: changed sss_hmac_sha1() + util/secrets: memory leaks are fixed + util/crypto/nss/nss_nite: params sanitization + crypto/libcrypto/crypto_nite: HMAC calculation changed + util/find_uid.c: fixed debug message + util/find_uid.c: fixed race condition bug + util/crypto: removed erroneous declaration + util/crypto/sss_crypto.c: cleanup of includes + util/crypto: generate_csprng_buffer() changed + util/crypto: added sss_rand() + crypto/libcrypto/crypto_nite.c: memory leak fixed + FIPS140 compliant usage of PRNG + crypto/nss: some nss_ctx_init() params made const + +Jakub Hrozek (34): + Updating the version for the 2.2.1 release + TESTS: Install expect to drive password-change modifications + TESTS: Also add LDAP password when creating users + TESTS: Test changing LDAP password with extended operation and modification + TEST: Add a multihost test for not returning / for an empty home dir + MONITOR: Don't check for the nscd socket while regenerating configuration + SYSDB: Add sysdb_search_with_ts_attr + BE: search with sysdb_search_with_ts_attr + BE: Enable refresh for multiple domains + BE: Make be_refresh_ctx_init set up the periodical task, too + BE/LDAP: Call be_refresh_ctx_init() in the provider libraries, not in back end + BE: Pass in attribute to look up with instead of hardcoding SYSDB_NAME + BE: Change be_refresh_ctx_init to return errno and set be_ctx->refresh_ctx + BE/LDAP: Split out a helper function from sdap_refresh for later reuse + BE: Pass in filter_type when creating the refresh account request + BE: Send refresh requests in batches + BE: Extend be_ptask_create() with control when to schedule next run after success + BE: Schedule the refresh interval from the finish time of the last run + AD: Implement background refresh for AD domains + IPA: Implement background refresh for IPA domains + BE/IPA/AD/LDAP: Add inigroups refresh support + BE/IPA/AD/LDAP: Initialize the refresh callback from a list to reduce logic duplication + IPA/AD/SDAP/BE: Generate refresh callbacks with a macro + MAN: Amend the documentation for the background refresh + DP/SYSDB: Move the code to set initgrExpireTimestamp to a reusable function + IPA/AD/LDAP: Increase the initgrExpireTimestamp after finishing refresh request + MAN: Get rid of sssd-secrets reference + MAN: Document that it is enough to systemctl restart sssd-kcm.service lately + SECRETS: Use different option names from secrets and KCM for quota options + SECRETS: Don't limit the global number of ccaches + KCM: Pass confdb context to the ccache db initialization + KCM: Configurable quotas for the secdb ccache back end + TESTS: Add tests for the configurable quotas + Don't qualify users from files domain when default_domain_suffix is set + +Jakub Jelen (1): + pam_sss: Add missing colon to the PIN prompt + +Lukas Slebodnik (1): + PROXY: Return data in output parameter if everything is OK + +Michal Židek (2): + TESTS: ldb-tools and sssd-tools are required for multihost tests + Update the translations for the 2.2.1 release + +Niranjan M.R (1): + TESTS: Test kvno correctly displays vesion numbers of principals + +Pavel Březina (11): + ci: disable timeout + ci: switch to new tooling and remove 'Read trusted files' stage + ci: rebase pull request on the target branch + ci: print node on which the test is being run + sudo: use proper datetime for default modifyTimestamp value + systemd: add Restart=on-failure to sssd.service + man: fix description of dns_resolver_op_timeout + man: fix description of dns_resolver_timeout + failover: add dns_resolver_server_timeout option + failover: change default timeouts + config: add dns_resolver_op_timeout to option list + +Sam Morris (1): + build: fix detection of systemd.pc + +Samuel Cabrero (1): + nss: Fix command 'endservent' resetting wrong struct member + +Sumit Bose (10): + negcache: add fq-usernames of know domains to all UPN neg-caches + p11_child: prefer better digest function if card supports it + p11_child: fix a memory leak and other memory mangement issues + pam: make sure p11_child.log has the right permissions + ssh: make sure p11_child.log has the right permissions + BE: make sure child log files have the right permissions + utils: remove unused prototype (cert_to_ssh_key) + utils: move parse_cert_verify_opts() into separate file + p11_child: make OCSP digest configurable + pam: fix loop in Smartcard authentication + +Tomas Halman (9): + MAN: ldap_user_home_directory default missing + pcre: port to pcre2 + CACHE: SSSD doesn't clear cache entries + LDAP: failover does not work on non-responsive ldaps + CONFDB: Files domain if activated without .conf + TESTS: adapt tests to enabled default files domain + BE: Introduce flag for be_ptask_create + BE: Convert be_ptask params to flags + DYNDNS: dyndns_update is not enough + +Yuri Chornoivan (1): + Fix minor typos in docs + From 31da1a6000983ec52a1b9dace853f0f03d55f1d6 Mon Sep 17 00:00:00 2001 From: Michal Židek Date: Sep 16 2019 15:15:38 +0000 Subject: [PATCH 2/2] Add release notes for SSSD 2.2.2 --- diff --git a/users/releases.rst b/users/releases.rst index dfe3b08..a148424 100644 --- a/users/releases.rst +++ b/users/releases.rst @@ -9,6 +9,8 @@ for a longer time than other releases. 2.x Series ^^^^^^^^^^ +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-2.2.2.tar.gz `_ |`sssd-2.2.2.tar.gz.asc `_ |SHA256SUM: ``5349a809d2e79ed6bbd875a49532e7e03c1e2e732c75e8d15e9e7de57d5a07d7``|Date: 2019-09-12|:doc:`Release notes ` |`Manpages `_ | ++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`sssd-2.2.1.tar.gz `_ |`sssd-2.2.1.tar.gz.asc `_ |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes ` |`Manpages `_ | +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`sssd-2.2.0.tar.gz `_ |`sssd-2.2.0.tar.gz.asc `_ |SHA256SUM: ``ae618d73c7dc174a1481853ddbea82896bef031c623d374c77888e45b7d88558``|Date: 2019-06-13|:doc:`Release notes ` |`Manpages `_ | diff --git a/users/relnotes/notes_2_2_2.rst b/users/relnotes/notes_2_2_2.rst new file mode 100644 index 0000000..29081cc --- /dev/null +++ b/users/relnotes/notes_2_2_2.rst @@ -0,0 +1,104 @@ +SSSD 2.2.2 +========== + + +Highlights +---------- + +New features +^^^^^^^^^^^^ +None + +Notable bug fixes +^^^^^^^^^^^^^^^^^ +* Removing domain from ad_enabled_domain was not reflected in SSSD's + cache. This has been fixed. +* Because of a race condition SSSD could crash during shutdown. The race + condition was fixed. +* Fixed a bug that limited number of external groups fetched by SSSD to 2000. +* pam_sss now properly creates gnome keyring during login. +* SSSD with KCM could wrongly pick older ccache instead of the latest one after + login. This was fixed. + +Packaging Changes +----------------- +None + +Documentation Changes +--------------------- +None + +Tickets Fixed +------------- + * `3932 `_ - MAN: Document that PAM stack contains the systemd-user service in the account phase in recent distributions + * `4009 `_ - Removing domain from ad_enabled_domains is not reflected in cache + * `4058 `_ - Paging not enabled when fetching external groups, limits the number of external groups to 2000 + * `4063 `_ - sssd-kcm: type confusion on KDC offset + * `4067 `_ - pam_sss with smartcard auth does not create gnome keyring + * `4068 `_ - pam_sss: empty smart card pin registers as authentication attempt + * `4069 `_ - pam_sss should reset PAM_USER based on use_fully_qualified_names option in sssd.conf + * `3996 `_ - sudo: do not update last usn when updating expired rules + * `4065 `_ - IFP: GetUserAttr does not search by UPN + * `4074 `_ - Integration tests use python2 unconditionally + +Detailed changelog +------------------ +Jakub Hrozek (6): + MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8 + IPA: Allow paging when fetching external groups + MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8 + IPA: Allow paging when fetching external groups + KCM: Use int32_t type conversion in DEBUG message for int32_t variable + KCM: Add a forgotten return + KCM: Allow modifications of ccache's principal + KCM: Fill empty cache, do not initialize a new one + +Lukas Slebodnik (18): + BUILD: Add macro for checking python3 modules + BUILD: Fix typo of detecting python module for intgcheck + BUILD: Move checking of python2 modules for intgcheck + BUILD: Add macro for checking pytest for intgcheck + BUILD: Change value of variable HAVE_PYTHON2/3_BINDINGS + BUILD: Move python checks for intgcheck to macro + INTG: Do hot hardcode version of python/pytest in intgcheck + BUILD: Prefer python3 for intgcheck + intg: Install python3 dependencies for intgcheck on new distros + pyhbac: Fix warning Wdiscarded-qualifiers + test_pam_responder: Fix unicore error + SSSDConfig: Add minimal test for parse method + SSSDConfig: Fix SyntaxWarning "is not" with a literal + TESTS: Add minimal test for pysss encrypt + pysss: Fix DeprecationWarning PY_SSIZE_T_CLEAN + pysss_murmur: Fix DeprecationWarning PY_SSIZE_T_CLEAN + test_pam_responder: Fix DeprecationWarning invalid escape sequence + testlib: Fix SyntaxWarning "is" with a literal + +Michal Židek (2): + Bumping the version to track the 2.2.2 development + Update the translations for the 2.2.2 release + +Pavel Březina (12): + ad: remove subdomain that has been disabled through ad_enabled_domains from sysdb + sysdb: add sysdb_domain_set_enabled() + ad: set enabled=false attribute for subdomains that no longer exists + sysdb: read and interpret domain's enabled attribute + sysdb: add sysdb_list_subdomains() + ad: remove all subdomains if only master domain is enabled + ad: make ad_enabled_domains case insensitive + ci: use python2 version of pytest + ci: pep8 was renamed to pycodestyle in Fedora 31 + ci: remove left overs from previous rebase + sudo: do not update last usn value on rules refresh + ifp: let cache_req parse input name so it can fallback to upn search + +Sumit Bose (5): + pam: keep pin on the PAM stack for forward_pass + pam: do not accept empty PIN + pam: user PAM return codes where expected + pam: set PAM_USER properly with allow_missing_name + Revert "SERVER: Receving SIGSEGV process on shutdown" + +Tomas Halman (3): + SERVER: Receving SIGSEGV process on shutdown + BE: Invalid oprator used in condition + SERVER: Receving SIGSEGV process on shutdown