From b2ff7a070eb0bf1ab3c133262eb0c527e82bfc1f Mon Sep 17 00:00:00 2001
From: Michal Židek <mzidek@redhat.com>
Date: Feb 26 2020 23:06:00 +0000
Subject: Adding 2.2.3 version release notes


---

diff --git a/users/releases.rst b/users/releases.rst
index fbeda7a..6e4cbac 100644
--- a/users/releases.rst
+++ b/users/releases.rst
@@ -9,6 +9,8 @@ for a longer time than other releases.
 2.x Series
 ^^^^^^^^^^
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-2.2.3.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.3.tar.gz>`_     |`sssd-2.2.3.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.3.tar.gz.asc>`_   |SHA256SUM: ``11565446290e7432dbd208c4db02fcb42ab17e853d8ba4f994af9a9c57bbbb11``|Date: 2019-09-12|:doc:`Release notes <relnotes/notes_2_2_3>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.3/man/>`_  |
++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`sssd-2.2.2.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.2.tar.gz>`_     |`sssd-2.2.2.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.2.tar.gz.asc>`_   |SHA256SUM: ``5349a809d2e79ed6bbd875a49532e7e03c1e2e732c75e8d15e9e7de57d5a07d7``|Date: 2019-09-12|:doc:`Release notes <relnotes/notes_2_2_2>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.2/man/>`_  |
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`sssd-2.2.1.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz>`_     |`sssd-2.2.1.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz.asc>`_   |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes <relnotes/notes_2_2_1>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.1/man/>`_  |
diff --git a/users/relnotes/notes_2_2_3.rst b/users/relnotes/notes_2_2_3.rst
new file mode 100644
index 0000000..6ae2695
--- /dev/null
+++ b/users/relnotes/notes_2_2_3.rst
@@ -0,0 +1,267 @@
+SSSD 2.2.3
+==========
+
+
+Highlights
+----------
+
+New features
+^^^^^^^^^^^^
+* allow_missing_name now treats empty strings the same as missing names.
+* 'soft_ocsp' and 'soft_crl options have been added to make the checks for
+  revoked certificates more flexible if the system is offline.
+* Smart card authentication in polkit is now allowed by default.
+* ssh_use_certificate_matching_rules now allows no_rules and all_rules values
+  (see man page for description).
+
+Notable bug fixes
+^^^^^^^^^^^^^^^^^
+* Fixed several memory management errors that caused SSSD to crash under some
+  circumstances.
+* Handling of FreeIPA users and groups containing '@' sign now works.
+* Issue when autofs was unable to mount shares was fixed.
+* SSSD was unable to hande ldap_uri containing URIs with different port numbers.
+  This was fixed.
+
+Packaging Changes
+-----------------
+None
+
+Documentation Changes
+---------------------
+* added options soft_ocsp and soft_crl
+* ssh_use_certificate_matching_rules option was updated with no_rules and
+  all_rules.
+
+Tickets Fixed
+-------------
+
+ * `2607 <https://pagure.io/SSSD/sssd/issue/2607>`_ - sssd should not always read entire autofs map from ldap
+ * `2660 <https://pagure.io/SSSD/sssd/issue/2660>`_ - SSSD service is crashing: dbus_watch_handle() is invoked with corrupted 'watch' value
+ * `2710 <https://pagure.io/SSSD/sssd/issue/2710>`_ - Propagate error about multiple entries found from cache_req to responder
+ * `3078 <https://pagure.io/SSSD/sssd/issue/3078>`_ - use the ERROR and PRINT macros consistently
+ * `3219 <https://pagure.io/SSSD/sssd/issue/3219>`_ - [RFE] Regular expression used in sssd.conf not being able to consume an @-sign in the user/group name.
+ * `3583 <https://pagure.io/SSSD/sssd/issue/3583>`_ - Stop calling umask(0) in selinux_child now that libsemanage has been fixed
+ * `3677 <https://pagure.io/SSSD/sssd/issue/3677>`_ - [RFE] SSSD smart smard card, configure to soft fail when CRL not available
+ * `3864 <https://pagure.io/SSSD/sssd/issue/3864>`_ - sss_ssh_authorizedkeys: no output when attribute value contains trailing whitespace
+ * `3914 <https://pagure.io/SSSD/sssd/issue/3914>`_ - test_pam_responder.py needs improvement
+ * `3938 <https://pagure.io/SSSD/sssd/issue/3938>`_ - sssctl config-check giving the wrong error message when there are only snippet files and no sssd. conf
+ * `3995 <https://pagure.io/SSSD/sssd/issue/3995>`_ - SSSDConfig: some options are unknown
+ * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG
+ * `4030 <https://pagure.io/SSSD/sssd/issue/4030>`_ - sss_obfuscate fails to rewriting comments
+ * `4073 <https://pagure.io/SSSD/sssd/issue/4073>`_ - Let IPA client read IPA objects via LDAP and not via extdom plugin when resolving trusted users and groups
+ * `4078 <https://pagure.io/SSSD/sssd/issue/4078>`_ - Trusted domain user logins succeed after using ipa trustdomain-disable
+ * `4080 <https://pagure.io/SSSD/sssd/issue/4080>`_ - Improve `sssd_nss` debug messages
+ * `4081 <https://pagure.io/SSSD/sssd/issue/4081>`_ - systemctl status sssd says No such file or directory about "default" when keytab exists but is empty file
+ * `4085 <https://pagure.io/SSSD/sssd/issue/4085>`_ - support for defaults entry is failing in sssd sudo against Openldap server
+ * `4094 <https://pagure.io/SSSD/sssd/issue/4094>`_ - sss_client: usage of srand()/rand() may be disruptive for the user of lib
+ * `4100 <https://pagure.io/SSSD/sssd/issue/4100>`_ - KCM: ccache is created with kdc_offset=INT32_MAX
+ * `4101 <https://pagure.io/SSSD/sssd/issue/4101>`_ - [RFE] pam_sss allow_missing_name should allow whitespace-only string
+ * `4102 <https://pagure.io/SSSD/sssd/issue/4102>`_ - Null dereference in sssctl/sssctl_domains.c:sssctl_domain_status_active_server()
+ * `4111 <https://pagure.io/SSSD/sssd/issue/4111>`_ - automount on RHEL7 gives the message 'lookup(sss): setautomntent: No such file or directory'
+ * `4112 <https://pagure.io/SSSD/sssd/issue/4112>`_ - ldap_uri failover doesn't work with different ports
+ * `4114 <https://pagure.io/SSSD/sssd/issue/4114>`_ - sssd failover leads to delayed and failed logins
+ * `4115 <https://pagure.io/SSSD/sssd/issue/4115>`_ - Smart Card authentication in polkit
+ * `4116 <https://pagure.io/SSSD/sssd/issue/4116>`_ - autofs: delete possible duplicate of an autofs entry
+ * `4121 <https://pagure.io/SSSD/sssd/issue/4121>`_ - [RFE]: use certificate matching rule when generating SSH key from a certificate
+ * `689 <https://pagure.io/SSSD/sssd/issue/689>`_ - Split sssd-ldap man page
+
+
+Detailed changelog
+------------------
+
+* Alex Rodin (7):
+     * Added ERROR and PRINT macros to the tools
+     * Update sss_ssh.c
+     * Update __init__.py.in
+     * Added PRINT macro in the sssctl tool
+     * Update README.md
+     * Updated test_pam_responder.py
+     * Created a new sssd-ldap-attributes.5 man page
+
+* Alexey Tikhonov (39):
+     * providers/ipa/: add_v1_user_data() amended
+     * responder/cache_req: added debug helper function
+     * responder/nss: improved debug messages
+     * responder/nss: DCE
+     * responder: log cmdline of client pid
+     * SSS_CLIENT: got rid of using PRNG
+     * util/server: amended close_low_fds()
+     * util/sss_krb5.c: elimination of unreachable code
+     * util/sss_krb5: find_principal_in_keytab() was amended
+     * util/sss_krb5: fixed few memory handling issues
+     * util/sss_krb5: debug messages fixes
+     * sssctl/sssctl_domains.c: null dereference fixed
+     * MMAP_CACHE: use CSPRNG to init hash table seed
+     * Moved unsecure sss_rand() out of crypto lib
+     * Reduces code duplication
+     * sss_ssh_knownhostsproxy: relocated O_NONBLOCK setting
+     * sss_ssh_knownhostsproxy: fixed Coverity issue
+     * util/sss_krb5: amended sss_krb5_get_error_message()
+     * Amended sss_krb5_get_error_message() usage.
+     * ldap_child: sanitization of error handling
+     * KEYTAB_CLEAN_NAME macro was replaced
+     * SBUS: defer deallocation of sbus_watch_ctx
+     * util/server.c: become_daemon() made static
+     * server:become_daemon(): got rid of unused codepath
+     * server:become_daemon(): handle fail of fork()
+     * server:become_daemon(): fixed waitpid()-loop
+     * server:become_daemon(): fix read of uninitialized value
+     * server:become_daemon(): change handling of chdir() fail
+     * server:become_daemon(): handle fail of setsid()
+     * util/memory: sanitization
+     * util/memory: helper(s) to securely erase mem was reworked
+     * tools/sss_seed: proper zeroization of sensitive data
+     * util: fixed potential mem leak in s3crypt_gen_salt()
+     * util/sha512_crypt_r: got rid of redundant mem align
+     * util/sha512_crypt_r: removed misleading comments
+     * util/sha512_crypt_r: proper zeroization of sensitive data
+     * db/sysdb_ops: proper zeroization of sensitive data
+     * util/authtok: set destructor in sss_authtok_new()
+     * LDAP: proper handling of master password
+
+* Ariel O. Barria (1):
+     * sss_obfuscate: do not fail if sssd.conf contains non-ascii characters
+
+* Fabiano Fidêncio (1):
+     * TESTS: Re-add tests for `kdestroy -A`
+
+* Jakub Hrozek (3):
+     * KCM: Fix typo in allocation check
+     * KCM: Set kdc_offset to zero initially
+     * sudo: use objectCategory instead of objectClass in ad sudo provider
+
+* Jakub Jelen (1):
+     * Allow smart card authentication in polkit
+
+* Lukas Slebodnik (1):
+     * IFP: Fix talloc hierarchy for members of struct ifp_list_domains_state
+
+* MIZUTA Takeshi (4):
+     * sss_client/idmap/common_ex.c: fix sss_nss_timedlock() to return errno
+     * util/server.c: fix handling when error occurs in waitpid()
+     * Fix timing to save errno
+     * Add processing to save errno before outputting DEBUG
+
+* Michal Židek (8):
+     * Bumping the version to track the 2.2.3 development
+     * SPECFILE: Add 'make' as build dependency
+     * memcache: Stop using the word fastcache for memcache
+     * MAN: GPO and built-in groups
+     * bash_rc: Build with systemtap
+     * MAN: Missing man pages in src/man/po/po4a.cfg
+     * MAN: Fix errors in Japanese translation
+     * Update the translations for the 2.2.3 release
+
+* Niranjan M.R (4):
+     * pytest: Use idm:DL1 module to install 389-ds
+     * pytest: Update README with instructions to execute tests
+     * pytest/testlib: Add python-ldap as dependency
+     * Makefile.am: Use README.md instead of README
+
+* Pavel Březina (49):
+     * sss_ptr_hash: keep value pointer when destroying spy
+     * autofs: fix typo in test tool
+     * sysdb: add expiration time to autofs entries
+     * sysdb: add sysdb_get_autofsentry
+     * sysdb: add enumerationExpireTimestamp
+     * sysdb: store enumeration expiration time in autofs map
+     * sysdb: store original dn in autofs map
+     * sysdb: add sysdb_del_autofsentry_by_key
+     * cache_req: add autofs map entries plugin
+     * cache_req: add autofs map by name plugin
+     * cache_req: add autofs entry by name plugin
+     * autofs: convert code to cache_req
+     * autofs: use cache_req to obtain single entry in getentrybyname
+     * autofs: use cache_req to obtain map in setent
+     * dp: add dp_error_to_ret
+     * dp: add dp_no_output type to be used in dp_set_method
+     * dp: add additional autofs methods
+     * dp: replace autofs handler with enumerate method
+     * ldap: add base_dn to sdap_search_bases
+     * ldap: rename sdap_autofs_get_map to sdap_autofs_enumerate
+     * ldap: implement autofs get map
+     * ldap: implement autofs get entry
+     * autofs: allow to run only setent without enumeration in test tool
+     * autofs: always refresh auto.master
+     * sysdb: invalidate also autofs entries
+     * sss_cache: invalidate also autofs entries
+     * ci: allow distribution specific supression files
+     * ci: suppress Debian valgrind errors
+     * ci: add Debian 10
+     * ifp: call tevent_req_post in case of error in ifp_user_get_attr_send
+     * sudo: get timezone information from previous value when constructing new usn
+     * ci: enable on demand runs
+     * ci: set build name to pull request or branch name
+     * ci: notify that build awaits executor
+     * ci: convert to scripted pipeline
+     * db: fix potential memory leak in sysdb_store_selinux_config
+     * ldap: do not store empty attribute with ldap_rfc2307_fallback_to_local_users = true
+     * sss_ptr_hash: pass new hash_entry_t to custom delete callback
+     * failover: make sure we switch to anoter server if only port differs
+     * autofs: remove unused enum
+     * autofs: delete possible duplicate of an autofs entry
+     * ci: store artifacts in jenkins for on-demand runs
+     * ci: allow to specify systems where tests should be run for on-demand tests
+     * ci: add Fedora 31
+     * ci: install python2 on Fedora 31 and RHEL 8 so python2 bindings can be built
+     * ci: disable python2 bindings on Fedora 32+
+     * man: add missing new line to autofs_attributes.xml
+     * pam_sss: treat whitespace name as missing name if allow_missing_name is set
+     * sudo: add ldap_sudorule_object_class_attr
+
+* Paweł Poławski (2):
+     * selinux: Keep explicite umask() calls
+     * files_ops: Remove unused functions parameter
+
+* REIM THOMAS (1):
+     * MAN: Provide minimum information on GPO access control
+
+* Samuel Cabrero (12):
+     * SYSDB: Delete linked local user overrides when deleting a user
+     * SYSDB: Convert cached domain 'enumerated' attribute from bool to uint
+     * SDAP: Add provider name to enumeration and cleanup tasks
+     * LDAP: Return errno_t for ldap id enumeration task setup functions
+     * LDAP: Rename enumeration and cleanup functions to contain the provider
+     * AD: Rename enumeration functions to contain the provider name
+     * LDAP: Improve ldap_id_setup_enumeration error logic
+     * LDAP: Remove unnecessary task pointer
+     * LDAP: Move enum fields to id provider context
+     * MONITOR: Propagate error when resolv.conf does not exists in polling mode
+     * MONITOR: Add a new option to control resolv.conf monitoring
+     * MONITOR: Resolve symlinks setting the inotify watchers
+
+* Sumit Bose (15):
+     * ipa: use LDAP not extdom to lookup IPA users and groups
+     * utils: extend some find_domain_* calls to search disabled domain
+     * ipa: support disabled domains
+     * ipa: ignore objects from disabled domains on the client
+     * sysdb: add sysdb_subdomain_content_delete()
+     * ipa: delete content of disabled domains
+     * ipa: use the right context for autofs
+     * ssh: add ssh_use_certificate_keys option to config checks
+     * ssh: apply certificate matching rules
+     * ssh: add option ssh_use_certificate_matching_rules
+     * ssh: enable p11_child logging
+     * p11_child: allow verification with no_verification option
+     * p11_child: add 'soft_ocsp' and 'soft_crl options
+     * ipa: add failover to override lookups
+     * ipa: add failover to access checks
+
+* Thorsten Scherf (1):
+     * Fix option type for ldap_group_type
+
+* Tomas Halman (9):
+     * LDAP: Systemtap ldap probes fail without filter
+     * LDAP: extend LDAP systemtap probes of attr list
+     * LDAP: Add probes to be able print ldap attributes
+     * MAN: update systemtap man page
+     * TESTS: tests have to be linked with systemtap
+     * MAN: Update SystemTap man page
+     * IPA: Utilize new protocol in IPA extdom plugin
+     * INI: sssctl config-check giving the wrong message
+     * TESTS: check "sssctl config-check" output
+
+* pedrosam (1):
+     * cache_req: propagate multiple entries error to the caller
+

