SSSD 1.16.1 ===========
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights —————
New Features ^^^^^^^^^^^^ * A new option ``auto_private_groups`` was added. If this option is enabled, SSSD will automatically create user private groups based on user's UID number. The GID number is ignored in this case. Please see https://docs.pagure.org/SSSD.sssd/design_pages/auto_private_groups.html for more details on the feature.
* The SSSD smart card integration now supports a special type of PAM conversation implemented by GDM which allows the user to select the appropriate smrt card certificate in GDM. Please refer to https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_multiple_certificat... for more details about this feature.
* A new API for accessing user and group information was added. This API is similar to the tradiional Name Service Switch API, but allows the consumer to talk to SSSD directly as well as to fine-tune the query with e.g. how cache should be evaluated. Please see https://docs.pagure.org/SSSD.sssd/design_pages/enhanced_nss_api.html for more information on the new API.
* The ``sssctl`` command line tool gained a new command ``access-report``, which can generate who can access the client machine. Currently only generating the report on an IPA client based on HBAC rules is supported. Please see https://docs.pagure.org/SSSD.sssd/design_pages/attestation_report.html for more information about this new feature.
* The ``hostid`` provider was moved from the IPA specific code to the generic LDAP code. This allows SSH host keys to be access by the generic LDAP provider as well. See the ``ldap_host_*`` options in the ``sssd-ldap`` manual page for more details.
* Setting the ``memcache_timeout`` option to 0 disabled creating the memory cache files altogether. This can be useful in cases there is a bug in the memory cache that needs working around.
Performance enhancements ^^^^^^^^^^^^^^^^^^^^^^^^ * Several internal changes to how objects are stored in the cache improve SSSD performance in environments with large number of objects of the same type (e.g. many users, many groups). In particular, several useless indexes were removed and the most common object types no longer use the indexed ``objectClass`` attribute, but use unindexed ``objectCategory`` instead (#3503)
* In setups with ``id_provider=ad`` that use POSIX attributes which are replicated to the Global Catalog, SSSD uses the Global Catalog to determine which domain should be contacted for a by-ID lookup instead of iterating over all domains. More details about this feature can be found at https://docs.pagure.org/SSSD.sssd/design_pages/uid_negative_global_catalog.h...
Notable bug fixes ^^^^^^^^^^^^^^^^^ * A crash in ``sssd_nss`` that might have happened if a list of domains was refreshed while a NSS lookup using this request was fixed (#3551)
* A potential crash in ``sssd_nss`` during netgroup lookup in case the netgroup object kept in memory was already freed (#3523)
* Fixed a potential crash of ``sssd_be`` with two concurrent sudo refreshes in case one of them failed (#3562)
* A memory growth issue in ``sssd_nss`` that occured when an entry was removed from the memory cache was fixed (#3588)
* Two potential memory growth issues in the ``sssd_be`` process that could have hit configurations with ``id_provider=ad`` were fixed (#3639)
* The ``selinux_child`` process no longer crashes on a system where SSSD is compiled with SELinux support, but at the same time, the SELinux policy is not even installed on the machine (#3618)
* The memory cache consistency detection logic was fixed. This would prevent printing false positive memory cache corruption messages (#3571)
* SSSD now remembers the last successfuly discovered AD site and use this for DNS search to lookup a site and forest during the next lookup. This prevents time outs in case SSSD was discovering the site using the global list of DCs where some of the global DCs might be unreachable. (#3265)
* SSSD no longer starts the implicit file domain when configured with ``id_provider=proxy`` and ``proxy_lib_name=files``. This bug prevented SSSD from being used in setups that combine identities from UNIX files together with authentication against a remote source unless a files domain was explicitly configured (#3590)
* The IPA provider can handle switching between different ID views better (#3579)
* Previously, the IPA provider kept SSH public keys and certificates from an ID view in its cache and returned them even if the public key or certificate was then removed from the override (#3602, #3603)
* FleetCommander profiles coming from IPA are applied even if they are assigned globally (to ``category: ALL``), previously, only profiles assigned to a host or a hostgroup were applied (#3449)
* It is now possible to reset an expired password for users with 2FA authentication enabled (#3585)
* A bug in the AD provider which could have resulted in built-in AD groups being incorrectly cached was fixed (#3610)
* The SSSD watchdog can now cope better with time drifts (#3285)
* The ``nss_sss`` NSS module's return codes for invalid cases were fixed
* A bug in the LDAP provider that prevented setups with id_provider=proxy and auth_provider=ldap with LDAP servers that do not allow anonymous binds from working was fixed (#3451)
Packaging Changes ----------------- * The FleetCommander desktop profile path now uses stricter permissions, 751 instead of 755 (#3621)
* A new option ``--logger`` was added to the ``sssd(8)`` binary. This option obsoletes old options such as ``--debug-to-files``, although the old options are kept for backwards compatibility.
* The file ``/etc/systemd/system/sssd.service.d/journal.conf`` is not installed anymore In order to change logging to journald, please use the ``--logger`` option. The logger is set using the ``Environment=DEBUG_LOGGER`` directive in the systemd unit files. The default value is ``Environment=DEBUG_LOGGER=--logger=files``
Documentation Changes --------------------- There are no notable documentation changes such as options changing default values etc in this release.
Tickets Fixed ------------- * `3648 https://pagure.io/SSSD/sssd/issue/3648`_ - Mention in the manpages that Fleet Commander does *not* work when SSSD is running as the unprivileged user * `3639 https://pagure.io/SSSD/sssd/issue/3639`_ - sssd_be consumes more memory on RHEL 7.4 systems. * `3627 https://pagure.io/SSSD/sssd/issue/3627`_ - MAN: Explain how does auto_private_groups affect subdomains * `3621 https://pagure.io/SSSD/sssd/issue/3621`_ - FleetCommander integration must not require capability DAC_OVERRIDE * `3618 https://pagure.io/SSSD/sssd/issue/3618`_ - selinux_child segfaults in a docker container * `3615 https://pagure.io/SSSD/sssd/issue/3615`_ - Requesting an AD user's private group and then the user itself returns an emty homedir * `3613 https://pagure.io/SSSD/sssd/issue/3613`_ - auto_private_groups does not work with trusted domains with direct AD integration * `3610 https://pagure.io/SSSD/sssd/issue/3610`_ - AD provider - AD BUILTIN groups are cached with gidNumber = 0 * `3608 https://pagure.io/SSSD/sssd/issue/3608`_ - dbus-send unable to find user by CAC cert * `3603 https://pagure.io/SSSD/sssd/issue/3603`_ - Certificate is not removed from cache when it's removed from the override * `3602 https://pagure.io/SSSD/sssd/issue/3602`_ - SSH public key authentication keeps working after keys are removed from ID view * `3601 https://pagure.io/SSSD/sssd/issue/3601`_ - race condition: sssd_be in a one-way trust accepts request before ipa-getkeytab finishes, marking the sssd offline * `3599 https://pagure.io/SSSD/sssd/issue/3599`_ - getent output is not showing home directory for IPA AD trusted user * `3594 https://pagure.io/SSSD/sssd/issue/3594`_ - sssd used wrong search base with wrong AD server * `3592 https://pagure.io/SSSD/sssd/issue/3592`_ - Write a regression test for false possitive "corrupted" memory cache * `3590 https://pagure.io/SSSD/sssd/issue/3590`_ - proxy to files does not work with implicit_files_domain * `3588 https://pagure.io/SSSD/sssd/issue/3588`_ - sssd_nss consumes more memory until restarted or machine swaps * `3586 https://pagure.io/SSSD/sssd/issue/3586`_ - Give a more detailed debug and system-log message if krb5_init_context() failed * `3585 https://pagure.io/SSSD/sssd/issue/3585`_ - Reset password with two factor authentication fails * `3579 https://pagure.io/SSSD/sssd/issue/3579`_ - SSSD fails to fetch group information after switching IPA client to a non-default view * `3571 https://pagure.io/SSSD/sssd/issue/3571`_ - mmap cache: consistency check might fail if there are hash collisions * `3570 https://pagure.io/SSSD/sssd/issue/3570`_ - The cache-req debug string representation uses a wrong format specifier for by-ID requests * `3569 https://pagure.io/SSSD/sssd/issue/3569`_ - The cache_req code doesn't check the min_id/max_id boundaries for requests by ID * `3564 https://pagure.io/SSSD/sssd/issue/3564`_ - Smartcard authentication fails if SSSD is offline and 'krb5_store_password_if_offline = True' * `3563 https://pagure.io/SSSD/sssd/issue/3563`_ - Some sysdb tests fail because they expect a certain order of entries returned from ldb * `3562 https://pagure.io/SSSD/sssd/issue/3562`_ - Use-after free if more sudo requests run and one of them fails, causing a fail-over to a next server * `3560 https://pagure.io/SSSD/sssd/issue/3560`_ - Improve Smartcard integration if multiple certificates or multiple mapped identities are available * `3551 https://pagure.io/SSSD/sssd/issue/3551`_ - Race condition between refreshing the cr_domain list and a request that is using the list can cause a segfault is sssd_nss * `3547 https://pagure.io/SSSD/sssd/issue/3547`_ - data from ipa returned with id_provider=file * `3545 https://pagure.io/SSSD/sssd/issue/3545`_ - SSSD creates bad override search filter due to AD Trust object with parenthesis * `3539 https://pagure.io/SSSD/sssd/issue/3539`_ - Do not autostart the implicit files domain if sssd configures id_provider=proxy and proxy_target_files * `3529 https://pagure.io/SSSD/sssd/issue/3529`_ - SSSD-kcm/secrets failed to restart during/after upgrade * `3528 https://pagure.io/SSSD/sssd/issue/3528`_ - sssd refuses to start when pidfile is present, but the process is gone * `3523 https://pagure.io/SSSD/sssd/issue/3523`_ - ABRT crash - /usr/libexec/sssd/sssd_nss in setnetgrent_result_timeout * `3503 https://pagure.io/SSSD/sssd/issue/3503`_ - Do not index objectclass, add and index objectcategory instead * `3496 https://pagure.io/SSSD/sssd/issue/3496`_ - [RFE] Add a configuration option to SSSD to disable the memory cache * `3486 https://pagure.io/SSSD/sssd/issue/3486`_ - Improve `enumerate` documentation/troubleshooting guide * `3484 https://pagure.io/SSSD/sssd/issue/3484`_ - MAN: Describe the constrains of ipa_server_mode better in the man page * `3468 https://pagure.io/SSSD/sssd/issue/3468`_ - SSSD doesn't use AD global catalog for gidnumber lookup, resulting in unacceptable delay for large forests * `3454 https://pagure.io/SSSD/sssd/issue/3454`_ - sssd-kcm crashes with multiple parallel requests * `3451 https://pagure.io/SSSD/sssd/issue/3451`_ - When sssd is configured with id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing anonymous binds. * `3444 https://pagure.io/SSSD/sssd/issue/3444`_ - document information on why SSSD does not use host-based security filtering when processing AD GPOs * `3433 https://pagure.io/SSSD/sssd/issue/3433`_ - SYSLOG_IDENTIFIER is different * `3293 https://pagure.io/SSSD/sssd/issue/3293`_ - Log when SSSD authentication fails because when two IPA accounts share an email address * `3285 https://pagure.io/SSSD/sssd/issue/3285`_ - SSSD needs restart after incorrect clock is corrected with AD * `3265 https://pagure.io/SSSD/sssd/issue/3265`_ - [RFE] sssd should remember DNS sites from first search * `3198 https://pagure.io/SSSD/sssd/issue/3198`_ - Incorrect error code returned from krb5_child for expired/locked user with id_provider AD * `2976 https://pagure.io/SSSD/sssd/issue/2976`_ - sdap code can mark the whole sssd_be offline * `2840 https://pagure.io/SSSD/sssd/issue/2840`_ - [RFE] Produce access control attestation report for IPA domains * `2823 https://pagure.io/SSSD/sssd/issue/2823`_ - Integration tests: Use dbus-daemon in cwrap enviroment for test * `2478 https://pagure.io/SSSD/sssd/issue/2478`_ - Provide sss_nss_* API to directly query SSSD instead of nsswitch.conf route * `1872 https://pagure.io/SSSD/sssd/issue/1872`_ - [RFE] Support User Private Groups for main domains, too * `1729 https://pagure.io/SSSD/sssd/issue/1729`_ - Enumerating large number of users makes sssd_be hog the cpu for a long time.
Detailed Changelog ------------------
* Andreas Schneider (1):
* Avoid double semicolon warnings on older compilers
* Carlos O'Donell (1):
* nss: Fix invalid enum nss_status return values.
* Fabiano Fidêncio (21):
* CACHE_REQ: Copy the cr_domain list for each request * LDAP: Bind to the LDAP server also in the auth * TOOLS: Double quote array expansions in sss_debuglevel * TOOLS: Call "exec" for sss_debuglevel * LDAP: Improve error treatment from sdap_cli_connect() in ldap_auth * SYSDB: Remove code causing a covscan warning * NSS: Fix covscan warning * CACHE_REQ: Fix typo: cache_reg -> cache_req * TOOLS: Fix typo: exist -> exists * SYSDB: Return EOK in case a non-fatal issue happened * SYSDB_VIEWS: Remove sshPublicKey attribute when it's not set * IPA: Remove sshPublicKey attribute when it's not set * DESKPROFILE: Add checks for user and host category * DESKPROFILE: Harden the permission of deskprofilepath * DESKPROFILE: Soften umask for the domain's dir * DESKPROFILE: Fix the permissions and soften the umask for user's dir * DESKPROFILE: Use seteuid()/setegid() to create the profile * DESKPROFILE: Use seteuid()/setegid() to delete the profile/user's dir * DESKPROFILE: Set the profile permissions to read-only * PYSSS_MURMUR: Fix [-Wsign-compare] found by gcc * DESKPROFILE: Document it doesn't work when run as unprivileged user
* Hristo Venev (1):
* providers: Move hostid from ipa to sdap, v2
* Jakub Hrozek (35):
* Update the version number to track 1.16.1 development * CONFIG: Add a new option auto_private_groups * CONFDB: Remove the obsolete option magic_private_groups * SDAP: Allow the mpg flag for the main domain * LDAP: Turn group request into user request for MPG domains if needed * SYSDB: Prevent users and groups ID collision in MPG domains except for id_provider=local * TESTS: Add integration tests for the auto_private_groups option * RESP: Add some missing NULL checks * TOOLS: Add a new sssctl command access-report * SDAP: Split out utility function sdap_get_object_domain() from sdap_object_in_domain() * LDAP: Extract the check whether to run a POSIX check to a function * LDAP: Only run the POSIX check with a GC connection * SDAP: Search with a NULL search base when looking up an ID in the Global Catalog * SDAP: Rename sdap_posix_check to sdap_gc_posix_check * DP: Create a new handler function getAccountDomain() * AD: Implement a real getAccountDomain handler for the AD provider * RESP: Expose DP method getAccountDomain() to responders * NEGCACHE: Add API for setting and checking locate-account-domain requests * TESTS: Add tests for the object-by-id cache_req interface * CACHE_REQ: Export cache_req_search_ncache_add() as cache_req private interface * CACHE_REQ: Add plugin methods required for the domain-locator request * CACHE_REQ: Add a private request cache_req_locate_domain() * CACHE_REQ: Implement the plugin methods that utilize the domain locator API * CACHE_REQ: Use the domain-locator request to only search domains where the entry was found * MAN: Document how the Global Catalog is used currently * IPA: Include SYSDB_OBJECTCATEGORY, not OBJECTCLASS in cache search results * MAN: Document that auth and access IPA and AD providers rely on id_provider being set to the same type * MAN: Improve enumeration documentation * MAN: Describe the constrains of ipa_server_mode better in the man page * IPA: Delay the first periodic refresh of trusted domains * AD: Inherit the MPG setting from the main domain * SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains * SYSDB: Use sysdb_domain_dn instead of raw ldb_dn_new_fmt * SYSDB: Read the ldb_message from loop's index counter when reading subdomain UPNs * AD: Use the right sdap_domain for the forest root
* Lukas Slebodnik (51):
* KCM: Fix typo in comments * CI: Ignore source file generated by systemtap * UTIL: Add wrapper function to configure logger * Add parameter --logger to daemons * SYSTEMD: Replace parameter --debug-to-files with ${DEBUG_LOGGER} * SYSTEMD: Add environment file to responder service files * UTIL: Hide and deprecate parameter --debug-to-files * KCM: Fix restart during/after upgrade * BUILD: Properly expand variables in sssd-ifp.service * SYSTEMD: Clean pid file in corner cases * CHILD: Pass information about logger to children * BUILD: Disable tests with know failures * SPEC: Reduce build time dependencies * sysdb-test: Fix warning may be used uninitialized * responder: Fix talloc hierarchy in sized_output_name * test_responder: Check memory leak in sized_output_name * confdb: Move detection files to separate function * confdb: Fix starting of implicit files domain * confdb: Do not start implicit_files with proxy domain * test_files_provider: Regression test for implicit_files + proxy * SDAP: Fix typo in debug message * Revert "intg: Disable add_remove tests" * libnfsidmap: Use public plugin header file if available * dyndns_tests: Fix unit test with missing features in nsupdate * Remove unnecessary script for upgrading debug_levels * Remove legacy script for upgrading sssd.conf * BUILD: Add missing libs found by -Wl,-z,defs * BUILD: Fix using of libdlopen_test_providers.so in tests * SYSDB: Decrese debuglevel in sysdb_get_certmap * KRB5: Pass special flag to krb5_child * krb5_child: Distinguish between expired & disabled AD user * AD: Suppress warning Wincompatible-pointer-types with sasl callbacks * pysss: Drop unused parameter * pysss: Suppress warning Wincompatible-pointer-types * CRYPTO: Suppress warning Wstringop-truncation * INOTIFY: Fix warning Wstringop-truncation * SIFP: Suppress warning Wstringop-truncation * CLIENT: Fix warning Wstringop-overflow * pysss_murmur: Allow to have NUL character in python bindings * TESTS: Extend code coverage for murmurhash3 * mmap_cache: Remove unnecessary memchr in client code * test_memory_cache: Regression test for #3571 * SPEC: Fix systemd executions/requirements * SPEC: Reduce changes between upstream and downstream * intg: Build with optimisations and debug symbols * intg: Do not prefer builddir in PATH * intg: Install configuration for dbus daemon * intg: Install wrapper for getsockopt * intg: Add sample infopipe test in cwrap env * IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR * IPA: Fix typo in debug message in sssm_ipa_selinux_init
* Michal Židek (9):
* NSS: Move memcache setup to separate function * NSS: Specify memcache_timeout=0 semantics * MAN: Document memcache_timeout=0 meaning * MAN: GPO Security Filtering limitation * SYSDB: Better debugging for email conflicts * TESTS: Order list of entries in some lists * Revert "BUILD: Disable tests with know failures" * SELINUX: Check if SELinux is managed in selinux_child * util: Add sss_ prefix to some functions
* Niranjan M.R (1):
* Initial revision of sssd pytest framework
* Pavel Březina (10):
* sudo: document background activity * sudo: always use srv_opts from id context * AD: Remember last site discovered * sysdb: add functions to get/set client site * AD: Remember last site discovered in sysdb * dp: use void * to express empty output argument list * dp: add method to refresh access control rules * ipa: implement method to refresh HBAC rules * ifp: add method to refresh access control rules in domain * sssctl: call dbus instead of pam to refresh HBAC rules
* René Genz (12):
* Fix minor spelling mistakes * README: Add link to docs repo * Fix minor spelling mistakes * Fix minor spelling mistakes in providers/* * Fix minor spelling mistakes in responder/* * Fix minor spelling mistakes in sss_client/* * Fix minor spelling mistakes in tests/cmocka/* * Fix minor spelling mistakes * Fix minor spelling mistakes in tests/* * Fix minor spelling mistakes in tests/multihost/* * Fix minor spelling mistakes in PY files in tests/python/* * Fix minor spelling mistakes and formatting in tests/python/*
* Sumit Bose (48):
* sss_client: create nss_common.h * nss-idmap: add nss like calls with timeout and flags * NSS: add *_EX version of some requests * NSS: add support for SSS_NSS_EX_FLAG_NO_CACHE * CACHE_REQ: Add cache_req_data_set_bypass_dp() * nss: make memcache_delete_entry() public * NSS: add support for SSS_NSS_EX_FLAG_INVALIDATE_CACHE * NSS/TESTS: add unit tests for *_EX requests * nss-idmap: add timeout version of old sss_nss_* calls * nss-idmap: allow empty buffer with SSS_NSS_EX_FLAG_INVALIDATE_CACHE * p11_child: return multiple certs * PAM: handled multiple certs in the responder * pam_sss: refactoring, use struct cert_auth_info * p11_child: use options to select certificate for authentication * pam: add prompt string for certificate authentication * PAM: allow missing logon_name during certificate authentication * p11_child: add descriptions for error codes to debug messages * pam: filter certificates in the responder not in the child * PAM: add certificate's label to the selection prompt * NSS: Use enum_ctx as memory_context in _setnetgrent_set_timeout() * mmap_cache: make checks independent of input size * sysdb: be_refresh_get_values_ex() remove unused option * sysdb: do not use objectClass for users and groups * sysdb: do not use LDB_SCOPE_ONELEVEL * sysdb: remove IDXONE and objectClass from users and groups * krb5: show error message for krb5_init_context() failures * UTIL: add find_domain_by_object_name_ex() * ipa: handle users from different domains in ipa_resolve_user_list_send() * overrides: fixes for sysdb_invalidate_overrides() * ipa: check for SYSDB_OVERRIDE_DN in process_members and get_group_dn_list * IPA: use cache searches in get_groups_dns() * ipa: compare DNs instead of group names in ipa_s2n_save_objects() * p11_child: make sure OCSP checks are done * nss-idmap: allow NULL result in *_timeout calls * Revert "p11_child: make sure OCSP checks are done" * p11_child: properly check results of CERT_VerifyCertificateNow * ifp: use realloc in ifp_list_ctx_remaining_capacity() * SDAP: skip builtin AD groups in sdap_save_grpmem() * sysdb: add userMappedCertificate to the index * krb5_child: check preauth types if password is expired * pam_sss: password change with two factor authentication * nss-idmap: check timed muted return code * krb5: call krb5_auth_cache_creds() if a password is available * DESKPROFILE: Fix 'Improper use of negative value' * AD: sdap_get_ad_tokengroups_done() allocate temporary data on state * AD: do not allocate temporary data on long living context * ipa: remove SYSDB_USER_CERT from sub-domain users * ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
* Thorsten Scherf (1):
* IPA: Fixed subdomain typo
* Victor Tapia (1):
* WATCHDOG: Restart providers with SIGUSR2 after time drift
* amitkuma (3):
* cache_req: Correction of cache_req debug string ID format * cache: Check for max_id/min_id in cache_req * MAN: Explain how does auto_private_groups affect subdomains
On 9 March 2018 at 23:28, Jakub Hrozek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
I was going to wait patiently for this to flow through the regular channels but between GoScanSSH and some of the fixes available (2FA password changes, speed improvements), I'm going to ask:
Can this release get pushed to COPR please?
Cheers L.
Lachlan Musicman via FreeIPA-users wrote:
On 9 March 2018 at 23:28, Jakub Hrozek via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1 =========== The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ <https://releases.pagure.org/SSSD/sssd/> RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel <https://lists.fedorahosted.org/mailman/listinfo/sssd-devel> https://lists.fedorahosted.org/mailman/listinfo/sssd-users <https://lists.fedorahosted.org/mailman/listinfo/sssd-users>I was going to wait patiently for this to flow through the regular channels but between GoScanSSH and some of the fixes available (2FA password changes, speed improvements), I'm going to ask:
Can this release get pushed to COPR please?
What COPR is that?
rob
On 28 Mar 2018, at 21:20, Rob Crittenden rcritten@redhat.com wrote:
Lachlan Musicman via FreeIPA-users wrote:
On 9 March 2018 at 23:28, Jakub Hrozek via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users https://lists.fedorahosted.org/mailman/listinfo/sssd-users
I was going to wait patiently for this to flow through the regular channels but between GoScanSSH and some of the fixes available (2FA password changes, speed improvements), I'm going to ask:
Can this release get pushed to COPR please?
What COPR is that?
The SSSD team copr: https://copr.fedorainfracloud.org/groups/g/sssd/coprs/
Fabiano already built the packages, I just forgot to reply to this e-mail: https://copr.fedorainfracloud.org/coprs/g/sssd/sssd-1-16/
(we are working on making the builds automatically available when a new release is tagged, so far the process is manual and that’s why we forgot..)
On 29 March 2018 at 06:45, Jakub Hrozek jhrozek@redhat.com wrote:
On 28 Mar 2018, at 21:20, Rob Crittenden rcritten@redhat.com wrote:
What COPR is that?
The SSSD team copr: https://copr.fedorainfracloud.org/groups/g/sssd/coprs/
Fabiano already built the packages, I just forgot to reply to this e-mail: https://copr.fedorainfracloud.org/coprs/g/sssd/sssd-1-16/
(we are working on making the builds automatically available when a new release is tagged, so far the process is manual and that’s why we forgot..)
Thankyou Rob, Jacob and Fabiano cheers L.
How do I report a suspected Bug against sssd? I have a problem with sssd 1.14 1.15 1.16 but not 1.13.
The problem is with small tree of files that is created on /tmp/adcli-krb5-XXXXX every 5 minutes. The problem might be connected to adcli 0.8.1 and not 0.7.5
Thanks in advance, Avigdor Finkelstein
On Fri, Mar 9, 2018 at 2:29 PM Jakub Hrozek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights —————
New Features ^^^^^^^^^^^^
- A new option ``auto_private_groups`` was added. If this option is enabled, SSSD will automatically create user private groups based on user's UID number. The GID number is ignored in this case. Please see
https://docs.pagure.org/SSSD.sssd/design_pages/auto_private_groups.html for more details on the feature.
- The SSSD smart card integration now supports a special type of PAM conversation implemented by GDM which allows the user to select the appropriate smrt card certificate in GDM. Please refer to
https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_multiple_certificat... for more details about this feature.
A new API for accessing user and group information was added. This API is similar to the tradiional Name Service Switch API, but allows the consumer to talk to SSSD directly as well as to fine-tune the query with e.g. how cache should be evaluated. Please see https://docs.pagure.org/SSSD.sssd/design_pages/enhanced_nss_api.html for more information on the new API.
The ``sssctl`` command line tool gained a new command
``access-report``, which can generate who can access the client machine. Currently only generating the report on an IPA client based on HBAC rules is supported. Please see https://docs.pagure.org/SSSD.sssd/design_pages/attestation_report.html for more information about this new feature.
- The ``hostid`` provider was moved from the IPA specific code to the
generic LDAP code. This allows SSH host keys to be access by the generic LDAP provider as well. See the ``ldap_host_*`` options in the ``sssd-ldap`` manual page for more details.
- Setting the ``memcache_timeout`` option to 0 disabled creating the memory cache files altogether. This can be useful in cases there is a bug in the memory cache that needs working around.
Performance enhancements ^^^^^^^^^^^^^^^^^^^^^^^^
- Several internal changes to how objects are stored in the cache improve SSSD performance in environments with large number of objects of the
same type (e.g. many users, many groups). In particular, several useless indexes were removed and the most common object types no longer use the indexed ``objectClass`` attribute, but use unindexed ``objectCategory`` instead (#3503)
- In setups with ``id_provider=ad`` that use POSIX attributes which are replicated to the Global Catalog, SSSD uses the Global Catalog to determine which domain should be contacted for a by-ID lookup instead of iterating over all domains. More details about this feature can be found at
https://docs.pagure.org/SSSD.sssd/design_pages/uid_negative_global_catalog.h...
Notable bug fixes ^^^^^^^^^^^^^^^^^
A crash in ``sssd_nss`` that might have happened if a list of domains was refreshed while a NSS lookup using this request was fixed (#3551)
A potential crash in ``sssd_nss`` during netgroup lookup in case the netgroup object kept in memory was already freed (#3523)
Fixed a potential crash of ``sssd_be`` with two concurrent sudo
refreshes in case one of them failed (#3562)
A memory growth issue in ``sssd_nss`` that occured when an entry was removed from the memory cache was fixed (#3588)
Two potential memory growth issues in the ``sssd_be`` process that could have hit configurations with ``id_provider=ad`` were fixed (#3639)
The ``selinux_child`` process no longer crashes on a system where SSSD is compiled with SELinux support, but at the same time, the SELinux
policy is not even installed on the machine (#3618)
- The memory cache consistency detection logic was fixed. This would
prevent printing false positive memory cache corruption messages (#3571)
- SSSD now remembers the last successfuly discovered AD site and use this for DNS search to lookup a site and forest during the next lookup. This prevents time outs in case SSSD was discovering the site using the
global list of DCs where some of the global DCs might be unreachable. (#3265)
SSSD no longer starts the implicit file domain when configured with ``id_provider=proxy`` and ``proxy_lib_name=files``. This bug prevented SSSD from being used in setups that combine identities from UNIX files together with authentication against a remote source unless a files domain was explicitly configured (#3590)
The IPA provider can handle switching between different ID views better (#3579)
Previously, the IPA provider kept SSH public keys and certificates from an ID view in its cache and returned them even if the public key or certificate was then removed from the override (#3602, #3603)
FleetCommander profiles coming from IPA are applied even if they are assigned globally (to ``category: ALL``), previously, only profiles assigned to a host or a hostgroup were applied (#3449)
It is now possible to reset an expired password for users with 2FA authentication enabled (#3585)
A bug in the AD provider which could have resulted in built-in AD groups being incorrectly cached was fixed (#3610)
The SSSD watchdog can now cope better with time drifts (#3285)
The ``nss_sss`` NSS module's return codes for invalid cases were fixed
A bug in the LDAP provider that prevented setups with id_provider=proxy and auth_provider=ldap with LDAP servers that do not allow anonymous binds from working was fixed (#3451)
Packaging Changes
The FleetCommander desktop profile path now uses stricter permissions, 751 instead of 755 (#3621)
A new option ``--logger`` was added to the ``sssd(8)`` binary. This
option obsoletes old options such as ``--debug-to-files``, although the old options are kept for backwards compatibility.
- The file ``/etc/systemd/system/sssd.service.d/journal.conf`` is not installed anymore In order to change logging to journald, please use the ``--logger`` option. The logger is set using the ``Environment=DEBUG_LOGGER`` directive in the systemd unit files. The default value is ``Environment=DEBUG_LOGGER=--logger=files``
Documentation Changes
There are no notable documentation changes such as options changing default values etc in this release.
Tickets Fixed
- `3648 https://pagure.io/SSSD/sssd/issue/3648`_ - Mention in the
manpages that Fleet Commander does *not* work when SSSD is running as the unprivileged user
- `3639 https://pagure.io/SSSD/sssd/issue/3639`_ - sssd_be consumes
more memory on RHEL 7.4 systems.
- `3627 https://pagure.io/SSSD/sssd/issue/3627`_ - MAN: Explain how
does auto_private_groups affect subdomains
- `3621 https://pagure.io/SSSD/sssd/issue/3621`_ - FleetCommander
integration must not require capability DAC_OVERRIDE
- `3618 https://pagure.io/SSSD/sssd/issue/3618`_ - selinux_child
segfaults in a docker container
- `3615 https://pagure.io/SSSD/sssd/issue/3615`_ - Requesting an AD
user's private group and then the user itself returns an emty homedir
- `3613 https://pagure.io/SSSD/sssd/issue/3613`_ - auto_private_groups
does not work with trusted domains with direct AD integration
- `3610 https://pagure.io/SSSD/sssd/issue/3610`_ - AD provider - AD
BUILTIN groups are cached with gidNumber = 0
- `3608 https://pagure.io/SSSD/sssd/issue/3608`_ - dbus-send unable to
find user by CAC cert
- `3603 https://pagure.io/SSSD/sssd/issue/3603`_ - Certificate is not
removed from cache when it's removed from the override
- `3602 https://pagure.io/SSSD/sssd/issue/3602`_ - SSH public key
authentication keeps working after keys are removed from ID view
- `3601 https://pagure.io/SSSD/sssd/issue/3601`_ - race condition:
sssd_be in a one-way trust accepts request before ipa-getkeytab finishes, marking the sssd offline
- `3599 https://pagure.io/SSSD/sssd/issue/3599`_ - getent output is
not showing home directory for IPA AD trusted user
- `3594 https://pagure.io/SSSD/sssd/issue/3594`_ - sssd used wrong
search base with wrong AD server
- `3592 https://pagure.io/SSSD/sssd/issue/3592`_ - Write a regression
test for false possitive "corrupted" memory cache
- `3590 https://pagure.io/SSSD/sssd/issue/3590`_ - proxy to files does
not work with implicit_files_domain
- `3588 https://pagure.io/SSSD/sssd/issue/3588`_ - sssd_nss consumes
more memory until restarted or machine swaps
- `3586 https://pagure.io/SSSD/sssd/issue/3586`_ - Give a more
detailed debug and system-log message if krb5_init_context() failed
- `3585 https://pagure.io/SSSD/sssd/issue/3585`_ - Reset password with
two factor authentication fails
- `3579 https://pagure.io/SSSD/sssd/issue/3579`_ - SSSD fails to fetch
group information after switching IPA client to a non-default view
- `3571 https://pagure.io/SSSD/sssd/issue/3571`_ - mmap cache:
consistency check might fail if there are hash collisions
- `3570 https://pagure.io/SSSD/sssd/issue/3570`_ - The cache-req debug
string representation uses a wrong format specifier for by-ID requests
- `3569 https://pagure.io/SSSD/sssd/issue/3569`_ - The cache_req code
doesn't check the min_id/max_id boundaries for requests by ID
- `3564 https://pagure.io/SSSD/sssd/issue/3564`_ - Smartcard
authentication fails if SSSD is offline and 'krb5_store_password_if_offline = True'
- `3563 https://pagure.io/SSSD/sssd/issue/3563`_ - Some sysdb tests
fail because they expect a certain order of entries returned from ldb
- `3562 https://pagure.io/SSSD/sssd/issue/3562`_ - Use-after free if
more sudo requests run and one of them fails, causing a fail-over to a next server
- `3560 https://pagure.io/SSSD/sssd/issue/3560`_ - Improve Smartcard
integration if multiple certificates or multiple mapped identities are available
- `3551 https://pagure.io/SSSD/sssd/issue/3551`_ - Race condition
between refreshing the cr_domain list and a request that is using the list can cause a segfault is sssd_nss
- `3547 https://pagure.io/SSSD/sssd/issue/3547`_ - data from ipa
returned with id_provider=file
- `3545 https://pagure.io/SSSD/sssd/issue/3545`_ - SSSD creates bad
override search filter due to AD Trust object with parenthesis
- `3539 https://pagure.io/SSSD/sssd/issue/3539`_ - Do not autostart
the implicit files domain if sssd configures id_provider=proxy and proxy_target_files
- `3529 https://pagure.io/SSSD/sssd/issue/3529`_ - SSSD-kcm/secrets
failed to restart during/after upgrade
- `3528 https://pagure.io/SSSD/sssd/issue/3528`_ - sssd refuses to
start when pidfile is present, but the process is gone
- `3523 https://pagure.io/SSSD/sssd/issue/3523`_ - ABRT crash -
/usr/libexec/sssd/sssd_nss in setnetgrent_result_timeout
- `3503 https://pagure.io/SSSD/sssd/issue/3503`_ - Do not index
objectclass, add and index objectcategory instead
- `3496 https://pagure.io/SSSD/sssd/issue/3496`_ - [RFE] Add a
configuration option to SSSD to disable the memory cache
- `3486 https://pagure.io/SSSD/sssd/issue/3486`_ - Improve `enumerate`
documentation/troubleshooting guide
- `3484 https://pagure.io/SSSD/sssd/issue/3484`_ - MAN: Describe the
constrains of ipa_server_mode better in the man page
- `3468 https://pagure.io/SSSD/sssd/issue/3468`_ - SSSD doesn't use AD
global catalog for gidnumber lookup, resulting in unacceptable delay for large forests
- `3454 https://pagure.io/SSSD/sssd/issue/3454`_ - sssd-kcm crashes
with multiple parallel requests
- `3451 https://pagure.io/SSSD/sssd/issue/3451`_ - When sssd is
configured with id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing anonymous binds.
- `3444 https://pagure.io/SSSD/sssd/issue/3444`_ - document
information on why SSSD does not use host-based security filtering when processing AD GPOs
- `3433 https://pagure.io/SSSD/sssd/issue/3433`_ - SYSLOG_IDENTIFIER
is different
- `3293 https://pagure.io/SSSD/sssd/issue/3293`_ - Log when SSSD
authentication fails because when two IPA accounts share an email address
- `3285 https://pagure.io/SSSD/sssd/issue/3285`_ - SSSD needs restart
after incorrect clock is corrected with AD
- `3265 https://pagure.io/SSSD/sssd/issue/3265`_ - [RFE] sssd should
remember DNS sites from first search
- `3198 https://pagure.io/SSSD/sssd/issue/3198`_ - Incorrect error
code returned from krb5_child for expired/locked user with id_provider AD
- `2976 https://pagure.io/SSSD/sssd/issue/2976`_ - sdap code can mark
the whole sssd_be offline
- `2840 https://pagure.io/SSSD/sssd/issue/2840`_ - [RFE] Produce
access control attestation report for IPA domains
- `2823 https://pagure.io/SSSD/sssd/issue/2823`_ - Integration tests:
Use dbus-daemon in cwrap enviroment for test
- `2478 https://pagure.io/SSSD/sssd/issue/2478`_ - Provide sss_nss_*
API to directly query SSSD instead of nsswitch.conf route
- `1872 https://pagure.io/SSSD/sssd/issue/1872`_ - [RFE] Support User
Private Groups for main domains, too
- `1729 https://pagure.io/SSSD/sssd/issue/1729`_ - Enumerating large
number of users makes sssd_be hog the cpu for a long time.
Detailed Changelog
Andreas Schneider (1):
* Avoid double semicolon warnings on older compilersCarlos O'Donell (1):
* nss: Fix invalid enum nss_status return values.Fabiano Fidêncio (21):
* CACHE_REQ: Copy the cr_domain list for each request * LDAP: Bind to the LDAP server also in the auth * TOOLS: Double quote array expansions in sss_debuglevel * TOOLS: Call "exec" for sss_debuglevel * LDAP: Improve error treatment from sdap_cli_connect() in ldap_auth * SYSDB: Remove code causing a covscan warning * NSS: Fix covscan warning * CACHE_REQ: Fix typo: cache_reg -> cache_req * TOOLS: Fix typo: exist -> exists * SYSDB: Return EOK in case a non-fatal issue happened * SYSDB_VIEWS: Remove sshPublicKey attribute when it's not set * IPA: Remove sshPublicKey attribute when it's not set * DESKPROFILE: Add checks for user and host category * DESKPROFILE: Harden the permission of deskprofilepath * DESKPROFILE: Soften umask for the domain's dir * DESKPROFILE: Fix the permissions and soften the umask for user'sdir * DESKPROFILE: Use seteuid()/setegid() to create the profile * DESKPROFILE: Use seteuid()/setegid() to delete the profile/user's dir * DESKPROFILE: Set the profile permissions to read-only * PYSSS_MURMUR: Fix [-Wsign-compare] found by gcc * DESKPROFILE: Document it doesn't work when run as unprivileged user
Hristo Venev (1):
* providers: Move hostid from ipa to sdap, v2Jakub Hrozek (35):
* Update the version number to track 1.16.1 development * CONFIG: Add a new option auto_private_groups * CONFDB: Remove the obsolete option magic_private_groups * SDAP: Allow the mpg flag for the main domain * LDAP: Turn group request into user request for MPG domains ifneeded * SYSDB: Prevent users and groups ID collision in MPG domains except for id_provider=local * TESTS: Add integration tests for the auto_private_groups option * RESP: Add some missing NULL checks * TOOLS: Add a new sssctl command access-report * SDAP: Split out utility function sdap_get_object_domain() from sdap_object_in_domain() * LDAP: Extract the check whether to run a POSIX check to a function * LDAP: Only run the POSIX check with a GC connection * SDAP: Search with a NULL search base when looking up an ID in the Global Catalog * SDAP: Rename sdap_posix_check to sdap_gc_posix_check * DP: Create a new handler function getAccountDomain() * AD: Implement a real getAccountDomain handler for the AD provider * RESP: Expose DP method getAccountDomain() to responders * NEGCACHE: Add API for setting and checking locate-account-domain requests * TESTS: Add tests for the object-by-id cache_req interface * CACHE_REQ: Export cache_req_search_ncache_add() as cache_req private interface * CACHE_REQ: Add plugin methods required for the domain-locator request * CACHE_REQ: Add a private request cache_req_locate_domain() * CACHE_REQ: Implement the plugin methods that utilize the domain locator API * CACHE_REQ: Use the domain-locator request to only search domains where the entry was found * MAN: Document how the Global Catalog is used currently * IPA: Include SYSDB_OBJECTCATEGORY, not OBJECTCLASS in cache search results * MAN: Document that auth and access IPA and AD providers rely on id_provider being set to the same type * MAN: Improve enumeration documentation * MAN: Describe the constrains of ipa_server_mode better in the man page * IPA: Delay the first periodic refresh of trusted domains * AD: Inherit the MPG setting from the main domain * SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains * SYSDB: Use sysdb_domain_dn instead of raw ldb_dn_new_fmt * SYSDB: Read the ldb_message from loop's index counter when reading subdomain UPNs * AD: Use the right sdap_domain for the forest root
Lukas Slebodnik (51):
* KCM: Fix typo in comments * CI: Ignore source file generated by systemtap * UTIL: Add wrapper function to configure logger * Add parameter --logger to daemons * SYSTEMD: Replace parameter --debug-to-files with ${DEBUG_LOGGER} * SYSTEMD: Add environment file to responder service files * UTIL: Hide and deprecate parameter --debug-to-files * KCM: Fix restart during/after upgrade * BUILD: Properly expand variables in sssd-ifp.service * SYSTEMD: Clean pid file in corner cases * CHILD: Pass information about logger to children * BUILD: Disable tests with know failures * SPEC: Reduce build time dependencies * sysdb-test: Fix warning may be used uninitialized * responder: Fix talloc hierarchy in sized_output_name * test_responder: Check memory leak in sized_output_name * confdb: Move detection files to separate function * confdb: Fix starting of implicit files domain * confdb: Do not start implicit_files with proxy domain * test_files_provider: Regression test for implicit_files + proxy * SDAP: Fix typo in debug message * Revert "intg: Disable add_remove tests" * libnfsidmap: Use public plugin header file if available * dyndns_tests: Fix unit test with missing features in nsupdate * Remove unnecessary script for upgrading debug_levels * Remove legacy script for upgrading sssd.conf * BUILD: Add missing libs found by -Wl,-z,defs * BUILD: Fix using of libdlopen_test_providers.so in tests * SYSDB: Decrese debuglevel in sysdb_get_certmap * KRB5: Pass special flag to krb5_child * krb5_child: Distinguish between expired & disabled AD user * AD: Suppress warning Wincompatible-pointer-types with saslcallbacks * pysss: Drop unused parameter * pysss: Suppress warning Wincompatible-pointer-types * CRYPTO: Suppress warning Wstringop-truncation * INOTIFY: Fix warning Wstringop-truncation * SIFP: Suppress warning Wstringop-truncation * CLIENT: Fix warning Wstringop-overflow * pysss_murmur: Allow to have NUL character in python bindings * TESTS: Extend code coverage for murmurhash3 * mmap_cache: Remove unnecessary memchr in client code * test_memory_cache: Regression test for #3571 * SPEC: Fix systemd executions/requirements * SPEC: Reduce changes between upstream and downstream * intg: Build with optimisations and debug symbols * intg: Do not prefer builddir in PATH * intg: Install configuration for dbus daemon * intg: Install wrapper for getsockopt * intg: Add sample infopipe test in cwrap env * IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR * IPA: Fix typo in debug message in sssm_ipa_selinux_init
Michal Židek (9):
* NSS: Move memcache setup to separate function * NSS: Specify memcache_timeout=0 semantics * MAN: Document memcache_timeout=0 meaning * MAN: GPO Security Filtering limitation * SYSDB: Better debugging for email conflicts * TESTS: Order list of entries in some lists * Revert "BUILD: Disable tests with know failures" * SELINUX: Check if SELinux is managed in selinux_child * util: Add sss\_ prefix to some functionsNiranjan M.R (1):
* Initial revision of sssd pytest frameworkPavel Březina (10):
- sudo: document background activity
- sudo: always use srv_opts from id context
- AD: Remember last site discovered
- sysdb: add functions to get/set client site
- AD: Remember last site discovered in sysdb
- dp: use void * to express empty output argument list
- dp: add method to refresh access control rules
- ipa: implement method to refresh HBAC rules
- ifp: add method to refresh access control rules in domain
- sssctl: call dbus instead of pam to refresh HBAC rules
René Genz (12):
* Fix minor spelling mistakes * README: Add link to docs repo * Fix minor spelling mistakes * Fix minor spelling mistakes in providers/* * Fix minor spelling mistakes in responder/* * Fix minor spelling mistakes in sss_client/* * Fix minor spelling mistakes in tests/cmocka/* * Fix minor spelling mistakes * Fix minor spelling mistakes in tests/* * Fix minor spelling mistakes in tests/multihost/* * Fix minor spelling mistakes in PY files in tests/python/* * Fix minor spelling mistakes and formatting in tests/python/*Sumit Bose (48):
* sss_client: create nss_common.h * nss-idmap: add nss like calls with timeout and flags * NSS: add \*_EX version of some requests * NSS: add support for SSS_NSS_EX_FLAG_NO_CACHE * CACHE_REQ: Add cache_req_data_set_bypass_dp() * nss: make memcache_delete_entry() public * NSS: add support for SSS_NSS_EX_FLAG_INVALIDATE_CACHE * NSS/TESTS: add unit tests for \*_EX requests * nss-idmap: add timeout version of old sss_nss_* calls * nss-idmap: allow empty buffer with SSS_NSS_EX_FLAG_INVALIDATE_CACHE * p11_child: return multiple certs * PAM: handled multiple certs in the responder * pam_sss: refactoring, use struct cert_auth_info * p11_child: use options to select certificate for authentication * pam: add prompt string for certificate authentication * PAM: allow missing logon_name during certificate authentication * p11_child: add descriptions for error codes to debug messages * pam: filter certificates in the responder not in the child * PAM: add certificate's label to the selection prompt * NSS: Use enum_ctx as memory_context in _setnetgrent_set_timeout() * mmap_cache: make checks independent of input size * sysdb: be_refresh_get_values_ex() remove unused option * sysdb: do not use objectClass for users and groups * sysdb: do not use LDB_SCOPE_ONELEVEL * sysdb: remove IDXONE and objectClass from users and groups * krb5: show error message for krb5_init_context() failures * UTIL: add find_domain_by_object_name_ex() * ipa: handle users from different domains inipa_resolve_user_list_send() * overrides: fixes for sysdb_invalidate_overrides() * ipa: check for SYSDB_OVERRIDE_DN in process_members and get_group_dn_list * IPA: use cache searches in get_groups_dns() * ipa: compare DNs instead of group names in ipa_s2n_save_objects() * p11_child: make sure OCSP checks are done * nss-idmap: allow NULL result in *_timeout calls * Revert "p11_child: make sure OCSP checks are done" * p11_child: properly check results of CERT_VerifyCertificateNow * ifp: use realloc in ifp_list_ctx_remaining_capacity() * SDAP: skip builtin AD groups in sdap_save_grpmem() * sysdb: add userMappedCertificate to the index * krb5_child: check preauth types if password is expired * pam_sss: password change with two factor authentication * nss-idmap: check timed muted return code * krb5: call krb5_auth_cache_creds() if a password is available * DESKPROFILE: Fix 'Improper use of negative value' * AD: sdap_get_ad_tokengroups_done() allocate temporary data on state * AD: do not allocate temporary data on long living context * ipa: remove SYSDB_USER_CERT from sub-domain users * ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
Thorsten Scherf (1):
* IPA: Fixed subdomain typoVictor Tapia (1):
* WATCHDOG: Restart providers with SIGUSR2 after time driftamitkuma (3):
* cache_req: Correction of cache_req debug string ID format * cache: Check for max_id/min_id in cache_req * MAN: Explain how does auto_private_groups affect subdomains
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
AvigdorFin via FreeIPA-users wrote:
How do I report a suspected Bug against sssd? I have a problem with sssd 1.14 1.15 1.16 but not 1.13.
The problem is with small tree of files that is created on /tmp/adcli-krb5-XXXXX every 5 minutes. The problem might be connected to adcli 0.8.1 and not 0.7.5
https://docs.pagure.org/SSSD.sssd/users/reporting_bugs.html
rob
On Thu, Jun 07, 2018 at 04:39:09PM +0300, AvigdorFin via FreeIPA-users wrote:
How do I report a suspected Bug against sssd? I have a problem with sssd 1.14 1.15 1.16 but not 1.13.
The problem is with small tree of files that is created on /tmp/adcli-krb5-XXXXX every 5 minutes. The problem might be connected to adcli 0.8.1 and not 0.7.5
SSSD uses adcli to renew the most password on the AD DC. If the temporary files are not remove after adcli is run adcli most probably run into an error which prevented to check when the password was last changed on AD.
If you want to disable the whole feature please set 'ad_maximum_machine_account_password_age = 0' in sssd.conf (see man sssd-ad for details).
If you are interested why adcli fails please set debug_level=9 in the [domain/...] section of sssd.conf, restart SSSD and check the SSSD logs for the adcli debug output. See the troubleshooting page Rob sent for details.
HTH
bye, Sumit
Thanks in advance, Avigdor Finkelstein
On Fri, Mar 9, 2018 at 2:29 PM Jakub Hrozek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights —————
New Features ^^^^^^^^^^^^
- A new option ``auto_private_groups`` was added. If this option is enabled, SSSD will automatically create user private groups based on user's UID number. The GID number is ignored in this case. Please see
https://docs.pagure.org/SSSD.sssd/design_pages/auto_private_groups.html for more details on the feature.
- The SSSD smart card integration now supports a special type of PAM conversation implemented by GDM which allows the user to select the appropriate smrt card certificate in GDM. Please refer to
https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_multiple_certificat... for more details about this feature.
A new API for accessing user and group information was added. This API is similar to the tradiional Name Service Switch API, but allows the consumer to talk to SSSD directly as well as to fine-tune the query with e.g. how cache should be evaluated. Please see https://docs.pagure.org/SSSD.sssd/design_pages/enhanced_nss_api.html for more information on the new API.
The ``sssctl`` command line tool gained a new command
``access-report``, which can generate who can access the client machine. Currently only generating the report on an IPA client based on HBAC rules is supported. Please see https://docs.pagure.org/SSSD.sssd/design_pages/attestation_report.html for more information about this new feature.
- The ``hostid`` provider was moved from the IPA specific code to the
generic LDAP code. This allows SSH host keys to be access by the generic LDAP provider as well. See the ``ldap_host_*`` options in the ``sssd-ldap`` manual page for more details.
- Setting the ``memcache_timeout`` option to 0 disabled creating the memory cache files altogether. This can be useful in cases there is a bug in the memory cache that needs working around.
Performance enhancements ^^^^^^^^^^^^^^^^^^^^^^^^
- Several internal changes to how objects are stored in the cache improve SSSD performance in environments with large number of objects of the
same type (e.g. many users, many groups). In particular, several useless indexes were removed and the most common object types no longer use the indexed ``objectClass`` attribute, but use unindexed ``objectCategory`` instead (#3503)
- In setups with ``id_provider=ad`` that use POSIX attributes which are replicated to the Global Catalog, SSSD uses the Global Catalog to determine which domain should be contacted for a by-ID lookup instead of iterating over all domains. More details about this feature can be found at
https://docs.pagure.org/SSSD.sssd/design_pages/uid_negative_global_catalog.h...
Notable bug fixes ^^^^^^^^^^^^^^^^^
A crash in ``sssd_nss`` that might have happened if a list of domains was refreshed while a NSS lookup using this request was fixed (#3551)
A potential crash in ``sssd_nss`` during netgroup lookup in case the netgroup object kept in memory was already freed (#3523)
Fixed a potential crash of ``sssd_be`` with two concurrent sudo
refreshes in case one of them failed (#3562)
A memory growth issue in ``sssd_nss`` that occured when an entry was removed from the memory cache was fixed (#3588)
Two potential memory growth issues in the ``sssd_be`` process that could have hit configurations with ``id_provider=ad`` were fixed (#3639)
The ``selinux_child`` process no longer crashes on a system where SSSD is compiled with SELinux support, but at the same time, the SELinux
policy is not even installed on the machine (#3618)
- The memory cache consistency detection logic was fixed. This would
prevent printing false positive memory cache corruption messages (#3571)
- SSSD now remembers the last successfuly discovered AD site and use this for DNS search to lookup a site and forest during the next lookup. This prevents time outs in case SSSD was discovering the site using the
global list of DCs where some of the global DCs might be unreachable. (#3265)
SSSD no longer starts the implicit file domain when configured with ``id_provider=proxy`` and ``proxy_lib_name=files``. This bug prevented SSSD from being used in setups that combine identities from UNIX files together with authentication against a remote source unless a files domain was explicitly configured (#3590)
The IPA provider can handle switching between different ID views better (#3579)
Previously, the IPA provider kept SSH public keys and certificates from an ID view in its cache and returned them even if the public key or certificate was then removed from the override (#3602, #3603)
FleetCommander profiles coming from IPA are applied even if they are assigned globally (to ``category: ALL``), previously, only profiles assigned to a host or a hostgroup were applied (#3449)
It is now possible to reset an expired password for users with 2FA authentication enabled (#3585)
A bug in the AD provider which could have resulted in built-in AD groups being incorrectly cached was fixed (#3610)
The SSSD watchdog can now cope better with time drifts (#3285)
The ``nss_sss`` NSS module's return codes for invalid cases were fixed
A bug in the LDAP provider that prevented setups with id_provider=proxy and auth_provider=ldap with LDAP servers that do not allow anonymous binds from working was fixed (#3451)
Packaging Changes
The FleetCommander desktop profile path now uses stricter permissions, 751 instead of 755 (#3621)
A new option ``--logger`` was added to the ``sssd(8)`` binary. This
option obsoletes old options such as ``--debug-to-files``, although the old options are kept for backwards compatibility.
- The file ``/etc/systemd/system/sssd.service.d/journal.conf`` is not installed anymore In order to change logging to journald, please use the ``--logger`` option. The logger is set using the ``Environment=DEBUG_LOGGER`` directive in the systemd unit files. The default value is ``Environment=DEBUG_LOGGER=--logger=files``
Documentation Changes
There are no notable documentation changes such as options changing default values etc in this release.
Tickets Fixed
- `3648 https://pagure.io/SSSD/sssd/issue/3648`_ - Mention in the
manpages that Fleet Commander does *not* work when SSSD is running as the unprivileged user
- `3639 https://pagure.io/SSSD/sssd/issue/3639`_ - sssd_be consumes
more memory on RHEL 7.4 systems.
- `3627 https://pagure.io/SSSD/sssd/issue/3627`_ - MAN: Explain how
does auto_private_groups affect subdomains
- `3621 https://pagure.io/SSSD/sssd/issue/3621`_ - FleetCommander
integration must not require capability DAC_OVERRIDE
- `3618 https://pagure.io/SSSD/sssd/issue/3618`_ - selinux_child
segfaults in a docker container
- `3615 https://pagure.io/SSSD/sssd/issue/3615`_ - Requesting an AD
user's private group and then the user itself returns an emty homedir
- `3613 https://pagure.io/SSSD/sssd/issue/3613`_ - auto_private_groups
does not work with trusted domains with direct AD integration
- `3610 https://pagure.io/SSSD/sssd/issue/3610`_ - AD provider - AD
BUILTIN groups are cached with gidNumber = 0
- `3608 https://pagure.io/SSSD/sssd/issue/3608`_ - dbus-send unable to
find user by CAC cert
- `3603 https://pagure.io/SSSD/sssd/issue/3603`_ - Certificate is not
removed from cache when it's removed from the override
- `3602 https://pagure.io/SSSD/sssd/issue/3602`_ - SSH public key
authentication keeps working after keys are removed from ID view
- `3601 https://pagure.io/SSSD/sssd/issue/3601`_ - race condition:
sssd_be in a one-way trust accepts request before ipa-getkeytab finishes, marking the sssd offline
- `3599 https://pagure.io/SSSD/sssd/issue/3599`_ - getent output is
not showing home directory for IPA AD trusted user
- `3594 https://pagure.io/SSSD/sssd/issue/3594`_ - sssd used wrong
search base with wrong AD server
- `3592 https://pagure.io/SSSD/sssd/issue/3592`_ - Write a regression
test for false possitive "corrupted" memory cache
- `3590 https://pagure.io/SSSD/sssd/issue/3590`_ - proxy to files does
not work with implicit_files_domain
- `3588 https://pagure.io/SSSD/sssd/issue/3588`_ - sssd_nss consumes
more memory until restarted or machine swaps
- `3586 https://pagure.io/SSSD/sssd/issue/3586`_ - Give a more
detailed debug and system-log message if krb5_init_context() failed
- `3585 https://pagure.io/SSSD/sssd/issue/3585`_ - Reset password with
two factor authentication fails
- `3579 https://pagure.io/SSSD/sssd/issue/3579`_ - SSSD fails to fetch
group information after switching IPA client to a non-default view
- `3571 https://pagure.io/SSSD/sssd/issue/3571`_ - mmap cache:
consistency check might fail if there are hash collisions
- `3570 https://pagure.io/SSSD/sssd/issue/3570`_ - The cache-req debug
string representation uses a wrong format specifier for by-ID requests
- `3569 https://pagure.io/SSSD/sssd/issue/3569`_ - The cache_req code
doesn't check the min_id/max_id boundaries for requests by ID
- `3564 https://pagure.io/SSSD/sssd/issue/3564`_ - Smartcard
authentication fails if SSSD is offline and 'krb5_store_password_if_offline = True'
- `3563 https://pagure.io/SSSD/sssd/issue/3563`_ - Some sysdb tests
fail because they expect a certain order of entries returned from ldb
- `3562 https://pagure.io/SSSD/sssd/issue/3562`_ - Use-after free if
more sudo requests run and one of them fails, causing a fail-over to a next server
- `3560 https://pagure.io/SSSD/sssd/issue/3560`_ - Improve Smartcard
integration if multiple certificates or multiple mapped identities are available
- `3551 https://pagure.io/SSSD/sssd/issue/3551`_ - Race condition
between refreshing the cr_domain list and a request that is using the list can cause a segfault is sssd_nss
- `3547 https://pagure.io/SSSD/sssd/issue/3547`_ - data from ipa
returned with id_provider=file
- `3545 https://pagure.io/SSSD/sssd/issue/3545`_ - SSSD creates bad
override search filter due to AD Trust object with parenthesis
- `3539 https://pagure.io/SSSD/sssd/issue/3539`_ - Do not autostart
the implicit files domain if sssd configures id_provider=proxy and proxy_target_files
- `3529 https://pagure.io/SSSD/sssd/issue/3529`_ - SSSD-kcm/secrets
failed to restart during/after upgrade
- `3528 https://pagure.io/SSSD/sssd/issue/3528`_ - sssd refuses to
start when pidfile is present, but the process is gone
- `3523 https://pagure.io/SSSD/sssd/issue/3523`_ - ABRT crash -
/usr/libexec/sssd/sssd_nss in setnetgrent_result_timeout
- `3503 https://pagure.io/SSSD/sssd/issue/3503`_ - Do not index
objectclass, add and index objectcategory instead
- `3496 https://pagure.io/SSSD/sssd/issue/3496`_ - [RFE] Add a
configuration option to SSSD to disable the memory cache
- `3486 https://pagure.io/SSSD/sssd/issue/3486`_ - Improve `enumerate`
documentation/troubleshooting guide
- `3484 https://pagure.io/SSSD/sssd/issue/3484`_ - MAN: Describe the
constrains of ipa_server_mode better in the man page
- `3468 https://pagure.io/SSSD/sssd/issue/3468`_ - SSSD doesn't use AD
global catalog for gidnumber lookup, resulting in unacceptable delay for large forests
- `3454 https://pagure.io/SSSD/sssd/issue/3454`_ - sssd-kcm crashes
with multiple parallel requests
- `3451 https://pagure.io/SSSD/sssd/issue/3451`_ - When sssd is
configured with id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing anonymous binds.
- `3444 https://pagure.io/SSSD/sssd/issue/3444`_ - document
information on why SSSD does not use host-based security filtering when processing AD GPOs
- `3433 https://pagure.io/SSSD/sssd/issue/3433`_ - SYSLOG_IDENTIFIER
is different
- `3293 https://pagure.io/SSSD/sssd/issue/3293`_ - Log when SSSD
authentication fails because when two IPA accounts share an email address
- `3285 https://pagure.io/SSSD/sssd/issue/3285`_ - SSSD needs restart
after incorrect clock is corrected with AD
- `3265 https://pagure.io/SSSD/sssd/issue/3265`_ - [RFE] sssd should
remember DNS sites from first search
- `3198 https://pagure.io/SSSD/sssd/issue/3198`_ - Incorrect error
code returned from krb5_child for expired/locked user with id_provider AD
- `2976 https://pagure.io/SSSD/sssd/issue/2976`_ - sdap code can mark
the whole sssd_be offline
- `2840 https://pagure.io/SSSD/sssd/issue/2840`_ - [RFE] Produce
access control attestation report for IPA domains
- `2823 https://pagure.io/SSSD/sssd/issue/2823`_ - Integration tests:
Use dbus-daemon in cwrap enviroment for test
- `2478 https://pagure.io/SSSD/sssd/issue/2478`_ - Provide sss_nss_*
API to directly query SSSD instead of nsswitch.conf route
- `1872 https://pagure.io/SSSD/sssd/issue/1872`_ - [RFE] Support User
Private Groups for main domains, too
- `1729 https://pagure.io/SSSD/sssd/issue/1729`_ - Enumerating large
number of users makes sssd_be hog the cpu for a long time.
Detailed Changelog
Andreas Schneider (1):
* Avoid double semicolon warnings on older compilersCarlos O'Donell (1):
* nss: Fix invalid enum nss_status return values.Fabiano Fidêncio (21):
* CACHE_REQ: Copy the cr_domain list for each request * LDAP: Bind to the LDAP server also in the auth * TOOLS: Double quote array expansions in sss_debuglevel * TOOLS: Call "exec" for sss_debuglevel * LDAP: Improve error treatment from sdap_cli_connect() in ldap_auth * SYSDB: Remove code causing a covscan warning * NSS: Fix covscan warning * CACHE_REQ: Fix typo: cache_reg -> cache_req * TOOLS: Fix typo: exist -> exists * SYSDB: Return EOK in case a non-fatal issue happened * SYSDB_VIEWS: Remove sshPublicKey attribute when it's not set * IPA: Remove sshPublicKey attribute when it's not set * DESKPROFILE: Add checks for user and host category * DESKPROFILE: Harden the permission of deskprofilepath * DESKPROFILE: Soften umask for the domain's dir * DESKPROFILE: Fix the permissions and soften the umask for user'sdir * DESKPROFILE: Use seteuid()/setegid() to create the profile * DESKPROFILE: Use seteuid()/setegid() to delete the profile/user's dir * DESKPROFILE: Set the profile permissions to read-only * PYSSS_MURMUR: Fix [-Wsign-compare] found by gcc * DESKPROFILE: Document it doesn't work when run as unprivileged user
Hristo Venev (1):
* providers: Move hostid from ipa to sdap, v2Jakub Hrozek (35):
* Update the version number to track 1.16.1 development * CONFIG: Add a new option auto_private_groups * CONFDB: Remove the obsolete option magic_private_groups * SDAP: Allow the mpg flag for the main domain * LDAP: Turn group request into user request for MPG domains ifneeded * SYSDB: Prevent users and groups ID collision in MPG domains except for id_provider=local * TESTS: Add integration tests for the auto_private_groups option * RESP: Add some missing NULL checks * TOOLS: Add a new sssctl command access-report * SDAP: Split out utility function sdap_get_object_domain() from sdap_object_in_domain() * LDAP: Extract the check whether to run a POSIX check to a function * LDAP: Only run the POSIX check with a GC connection * SDAP: Search with a NULL search base when looking up an ID in the Global Catalog * SDAP: Rename sdap_posix_check to sdap_gc_posix_check * DP: Create a new handler function getAccountDomain() * AD: Implement a real getAccountDomain handler for the AD provider * RESP: Expose DP method getAccountDomain() to responders * NEGCACHE: Add API for setting and checking locate-account-domain requests * TESTS: Add tests for the object-by-id cache_req interface * CACHE_REQ: Export cache_req_search_ncache_add() as cache_req private interface * CACHE_REQ: Add plugin methods required for the domain-locator request * CACHE_REQ: Add a private request cache_req_locate_domain() * CACHE_REQ: Implement the plugin methods that utilize the domain locator API * CACHE_REQ: Use the domain-locator request to only search domains where the entry was found * MAN: Document how the Global Catalog is used currently * IPA: Include SYSDB_OBJECTCATEGORY, not OBJECTCLASS in cache search results * MAN: Document that auth and access IPA and AD providers rely on id_provider being set to the same type * MAN: Improve enumeration documentation * MAN: Describe the constrains of ipa_server_mode better in the man page * IPA: Delay the first periodic refresh of trusted domains * AD: Inherit the MPG setting from the main domain * SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains * SYSDB: Use sysdb_domain_dn instead of raw ldb_dn_new_fmt * SYSDB: Read the ldb_message from loop's index counter when reading subdomain UPNs * AD: Use the right sdap_domain for the forest root
Lukas Slebodnik (51):
* KCM: Fix typo in comments * CI: Ignore source file generated by systemtap * UTIL: Add wrapper function to configure logger * Add parameter --logger to daemons * SYSTEMD: Replace parameter --debug-to-files with ${DEBUG_LOGGER} * SYSTEMD: Add environment file to responder service files * UTIL: Hide and deprecate parameter --debug-to-files * KCM: Fix restart during/after upgrade * BUILD: Properly expand variables in sssd-ifp.service * SYSTEMD: Clean pid file in corner cases * CHILD: Pass information about logger to children * BUILD: Disable tests with know failures * SPEC: Reduce build time dependencies * sysdb-test: Fix warning may be used uninitialized * responder: Fix talloc hierarchy in sized_output_name * test_responder: Check memory leak in sized_output_name * confdb: Move detection files to separate function * confdb: Fix starting of implicit files domain * confdb: Do not start implicit_files with proxy domain * test_files_provider: Regression test for implicit_files + proxy * SDAP: Fix typo in debug message * Revert "intg: Disable add_remove tests" * libnfsidmap: Use public plugin header file if available * dyndns_tests: Fix unit test with missing features in nsupdate * Remove unnecessary script for upgrading debug_levels * Remove legacy script for upgrading sssd.conf * BUILD: Add missing libs found by -Wl,-z,defs * BUILD: Fix using of libdlopen_test_providers.so in tests * SYSDB: Decrese debuglevel in sysdb_get_certmap * KRB5: Pass special flag to krb5_child * krb5_child: Distinguish between expired & disabled AD user * AD: Suppress warning Wincompatible-pointer-types with saslcallbacks * pysss: Drop unused parameter * pysss: Suppress warning Wincompatible-pointer-types * CRYPTO: Suppress warning Wstringop-truncation * INOTIFY: Fix warning Wstringop-truncation * SIFP: Suppress warning Wstringop-truncation * CLIENT: Fix warning Wstringop-overflow * pysss_murmur: Allow to have NUL character in python bindings * TESTS: Extend code coverage for murmurhash3 * mmap_cache: Remove unnecessary memchr in client code * test_memory_cache: Regression test for #3571 * SPEC: Fix systemd executions/requirements * SPEC: Reduce changes between upstream and downstream * intg: Build with optimisations and debug symbols * intg: Do not prefer builddir in PATH * intg: Install configuration for dbus daemon * intg: Install wrapper for getsockopt * intg: Add sample infopipe test in cwrap env * IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR * IPA: Fix typo in debug message in sssm_ipa_selinux_init
Michal Židek (9):
* NSS: Move memcache setup to separate function * NSS: Specify memcache_timeout=0 semantics * MAN: Document memcache_timeout=0 meaning * MAN: GPO Security Filtering limitation * SYSDB: Better debugging for email conflicts * TESTS: Order list of entries in some lists * Revert "BUILD: Disable tests with know failures" * SELINUX: Check if SELinux is managed in selinux_child * util: Add sss\_ prefix to some functionsNiranjan M.R (1):
* Initial revision of sssd pytest frameworkPavel Březina (10):
- sudo: document background activity
- sudo: always use srv_opts from id context
- AD: Remember last site discovered
- sysdb: add functions to get/set client site
- AD: Remember last site discovered in sysdb
- dp: use void * to express empty output argument list
- dp: add method to refresh access control rules
- ipa: implement method to refresh HBAC rules
- ifp: add method to refresh access control rules in domain
- sssctl: call dbus instead of pam to refresh HBAC rules
René Genz (12):
* Fix minor spelling mistakes * README: Add link to docs repo * Fix minor spelling mistakes * Fix minor spelling mistakes in providers/* * Fix minor spelling mistakes in responder/* * Fix minor spelling mistakes in sss_client/* * Fix minor spelling mistakes in tests/cmocka/* * Fix minor spelling mistakes * Fix minor spelling mistakes in tests/* * Fix minor spelling mistakes in tests/multihost/* * Fix minor spelling mistakes in PY files in tests/python/* * Fix minor spelling mistakes and formatting in tests/python/*Sumit Bose (48):
* sss_client: create nss_common.h * nss-idmap: add nss like calls with timeout and flags * NSS: add \*_EX version of some requests * NSS: add support for SSS_NSS_EX_FLAG_NO_CACHE * CACHE_REQ: Add cache_req_data_set_bypass_dp() * nss: make memcache_delete_entry() public * NSS: add support for SSS_NSS_EX_FLAG_INVALIDATE_CACHE * NSS/TESTS: add unit tests for \*_EX requests * nss-idmap: add timeout version of old sss_nss_* calls * nss-idmap: allow empty buffer with SSS_NSS_EX_FLAG_INVALIDATE_CACHE * p11_child: return multiple certs * PAM: handled multiple certs in the responder * pam_sss: refactoring, use struct cert_auth_info * p11_child: use options to select certificate for authentication * pam: add prompt string for certificate authentication * PAM: allow missing logon_name during certificate authentication * p11_child: add descriptions for error codes to debug messages * pam: filter certificates in the responder not in the child * PAM: add certificate's label to the selection prompt * NSS: Use enum_ctx as memory_context in _setnetgrent_set_timeout() * mmap_cache: make checks independent of input size * sysdb: be_refresh_get_values_ex() remove unused option * sysdb: do not use objectClass for users and groups * sysdb: do not use LDB_SCOPE_ONELEVEL * sysdb: remove IDXONE and objectClass from users and groups * krb5: show error message for krb5_init_context() failures * UTIL: add find_domain_by_object_name_ex() * ipa: handle users from different domains inipa_resolve_user_list_send() * overrides: fixes for sysdb_invalidate_overrides() * ipa: check for SYSDB_OVERRIDE_DN in process_members and get_group_dn_list * IPA: use cache searches in get_groups_dns() * ipa: compare DNs instead of group names in ipa_s2n_save_objects() * p11_child: make sure OCSP checks are done * nss-idmap: allow NULL result in *_timeout calls * Revert "p11_child: make sure OCSP checks are done" * p11_child: properly check results of CERT_VerifyCertificateNow * ifp: use realloc in ifp_list_ctx_remaining_capacity() * SDAP: skip builtin AD groups in sdap_save_grpmem() * sysdb: add userMappedCertificate to the index * krb5_child: check preauth types if password is expired * pam_sss: password change with two factor authentication * nss-idmap: check timed muted return code * krb5: call krb5_auth_cache_creds() if a password is available * DESKPROFILE: Fix 'Improper use of negative value' * AD: sdap_get_ad_tokengroups_done() allocate temporary data on state * AD: do not allocate temporary data on long living context * ipa: remove SYSDB_USER_CERT from sub-domain users * ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
Thorsten Scherf (1):
* IPA: Fixed subdomain typoVictor Tapia (1):
* WATCHDOG: Restart providers with SIGUSR2 after time driftamitkuma (3):
* cache_req: Correction of cache_req debug string ID format * cache: Check for max_id/min_id in cache_req * MAN: Explain how does auto_private_groups affect subdomains
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
-- Best Regards, Avigdor
Avigdor Finkelstein Mobile: +972 (0)54 2278452 Fax: +972 8 9316406
Email: AvigdorFin@g Avigdor.Finkelstein@tangram-soft.co.ilmail.com Home Address: P.O.B 187 Rehovot 76101 ISRAEL
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...
Yes, I tried this option in sssd.conf, it didn't help. Please see Bug 1588596 that I opened with more information.
Thanks,
On Thu, Jun 7, 2018 at 5:50 PM Sumit Bose via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On Thu, Jun 07, 2018 at 04:39:09PM +0300, AvigdorFin via FreeIPA-users wrote:
How do I report a suspected Bug against sssd? I have a problem with sssd 1.14 1.15 1.16 but not 1.13.
The problem is with small tree of files that is created on /tmp/adcli-krb5-XXXXX every 5 minutes. The problem might be connected to adcli 0.8.1 and not 0.7.5
SSSD uses adcli to renew the most password on the AD DC. If the temporary files are not remove after adcli is run adcli most probably run into an error which prevented to check when the password was last changed on AD.
If you want to disable the whole feature please set 'ad_maximum_machine_account_password_age = 0' in sssd.conf (see man sssd-ad for details).
If you are interested why adcli fails please set debug_level=9 in the [domain/...] section of sssd.conf, restart SSSD and check the SSSD logs for the adcli debug output. See the troubleshooting page Rob sent for details.
HTH
bye, Sumit
Thanks in advance, Avigdor Finkelstein
On Fri, Mar 9, 2018 at 2:29 PM Jakub Hrozek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
SSSD 1.16.1
The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon.
The tarball can be downloaded from
https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights —————
New Features ^^^^^^^^^^^^
- A new option ``auto_private_groups`` was added. If this option is enabled, SSSD will automatically create user private groups based
on
user's UID number. The GID number is ignored in this case. Please seehttps://docs.pagure.org/SSSD.sssd/design_pages/auto_private_groups.html
for more details on the feature.
- The SSSD smart card integration now supports a special type of PAM conversation implemented by GDM which allows the user to select the appropriate smrt card certificate in GDM. Please refer to
https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_multiple_certificat...
for more details about this feature.
- A new API for accessing user and group information was added. This
API
is similar to the tradiional Name Service Switch API, but allows the consumer to talk to SSSD directly as well as to fine-tune the query with e.g. how cache should be evaluated. Please seehttps://docs.pagure.org/SSSD.sssd/design_pages/enhanced_nss_api.html
for more information on the new API.
- The ``sssctl`` command line tool gained a new command
``access-report``, which can generate who can access the client machine. Currently
only
generating the report on an IPA client based on HBAC rules is supported.
Please
see
https://docs.pagure.org/SSSD.sssd/design_pages/attestation_report.html
for more information about this new feature.
- The ``hostid`` provider was moved from the IPA specific code to the
generic LDAP code. This allows SSH host keys to be access by the generic
LDAP
provider as well. See the ``ldap_host_*`` options in the ``sssd-ldap``
manual
page for more details.
- Setting the ``memcache_timeout`` option to 0 disabled creating the memory cache files altogether. This can be useful in cases there
is a
bug in the memory cache that needs working around.Performance enhancements ^^^^^^^^^^^^^^^^^^^^^^^^
- Several internal changes to how objects are stored in the cache
improve
SSSD performance in environments with large number of objects ofthe
same type (e.g. many users, many groups). In particular, several useless indexes were removed and the most common object types no longer use the
indexed
``objectClass`` attribute, but use unindexed ``objectCategory``instead
(#3503)
- In setups with ``id_provider=ad`` that use POSIX attributes which are replicated to the Global Catalog, SSSD uses the Global Catalog
to
determine which domain should be contacted for a by-ID lookupinstead
of iterating over all domains. More details about this feature can be found athttps://docs.pagure.org/SSSD.sssd/design_pages/uid_negative_global_catalog.h...
Notable bug fixes ^^^^^^^^^^^^^^^^^
- A crash in ``sssd_nss`` that might have happened if a list of
domains
was refreshed while a NSS lookup using this request was fixed
(#3551)
- A potential crash in ``sssd_nss`` during netgroup lookup in case
the
netgroup object kept in memory was already freed (#3523)
- Fixed a potential crash of ``sssd_be`` with two concurrent sudo
refreshes in case one of them failed (#3562)
A memory growth issue in ``sssd_nss`` that occured when an entry was removed from the memory cache was fixed (#3588)
Two potential memory growth issues in the ``sssd_be`` process that
could
have hit configurations with ``id_provider=ad`` were fixed (#3639)
- The ``selinux_child`` process no longer crashes on a system where
SSSD
is compiled with SELinux support, but at the same time, the SELinux policy is not even installed on the machine (#3618)
- The memory cache consistency detection logic was fixed. This would
prevent printing false positive memory cache corruption messages (#3571)
- SSSD now remembers the last successfuly discovered AD site and use
this
for DNS search to lookup a site and forest during the next lookup.
This
prevents time outs in case SSSD was discovering the site using the global list of DCs where some of the global DCs might be unreachable.
(#3265)
- SSSD no longer starts the implicit file domain when configured with ``id_provider=proxy`` and ``proxy_lib_name=files``. This bug
prevented
SSSD from being used in setups that combine identities from UNIX
files
together with authentication against a remote source unless a files domain was explicitly configured (#3590)
- The IPA provider can handle switching between different ID views
better
(#3579)
- Previously, the IPA provider kept SSH public keys and certificates
from
an ID view in its cache and returned them even if the public key or certificate was then removed from the override (#3602, #3603)
FleetCommander profiles coming from IPA are applied even if they are assigned globally (to ``category: ALL``), previously, only profiles assigned to a host or a hostgroup were applied (#3449)
It is now possible to reset an expired password for users with 2FA authentication enabled (#3585)
A bug in the AD provider which could have resulted in built-in AD
groups
being incorrectly cached was fixed (#3610)
The SSSD watchdog can now cope better with time drifts (#3285)
The ``nss_sss`` NSS module's return codes for invalid cases were
fixed
- A bug in the LDAP provider that prevented setups with
id_provider=proxy
and auth_provider=ldap with LDAP servers that do not allow anonymous binds from working was fixed (#3451)
Packaging Changes
- The FleetCommander desktop profile path now uses stricter
permissions,
751 instead of 755 (#3621)
- A new option ``--logger`` was added to the ``sssd(8)`` binary. This
option obsoletes old options such as ``--debug-to-files``, although the old options are kept for backwards compatibility.
- The file ``/etc/systemd/system/sssd.service.d/journal.conf`` is not installed anymore In order to change logging to journald, please
use the
``--logger`` option. The logger is set using the ``Environment=DEBUG_LOGGER`` directive in the systemd unit files.
The
default value is ``Environment=DEBUG_LOGGER=--logger=files``
Documentation Changes
There are no notable documentation changes such as options changing
default
values etc in this release.
Tickets Fixed
- `3648 https://pagure.io/SSSD/sssd/issue/3648`_ - Mention in the
manpages that Fleet Commander does *not* work when SSSD is running as
the
unprivileged user
- `3639 https://pagure.io/SSSD/sssd/issue/3639`_ - sssd_be consumes
more memory on RHEL 7.4 systems.
- `3627 https://pagure.io/SSSD/sssd/issue/3627`_ - MAN: Explain how
does auto_private_groups affect subdomains
- `3621 https://pagure.io/SSSD/sssd/issue/3621`_ - FleetCommander
integration must not require capability DAC_OVERRIDE
- `3618 https://pagure.io/SSSD/sssd/issue/3618`_ - selinux_child
segfaults in a docker container
- `3615 https://pagure.io/SSSD/sssd/issue/3615`_ - Requesting an AD
user's private group and then the user itself returns an emty homedir
- `3613 https://pagure.io/SSSD/sssd/issue/3613`_ -
auto_private_groups
does not work with trusted domains with direct AD integration
- `3610 https://pagure.io/SSSD/sssd/issue/3610`_ - AD provider - AD
BUILTIN groups are cached with gidNumber = 0
- `3608 https://pagure.io/SSSD/sssd/issue/3608`_ - dbus-send
unable to
find user by CAC cert
- `3603 https://pagure.io/SSSD/sssd/issue/3603`_ - Certificate is
not
removed from cache when it's removed from the override
- `3602 https://pagure.io/SSSD/sssd/issue/3602`_ - SSH public key
authentication keeps working after keys are removed from ID view
- `3601 https://pagure.io/SSSD/sssd/issue/3601`_ - race condition:
sssd_be in a one-way trust accepts request before ipa-getkeytab
finishes,
marking the sssd offline
- `3599 https://pagure.io/SSSD/sssd/issue/3599`_ - getent output is
not showing home directory for IPA AD trusted user
- `3594 https://pagure.io/SSSD/sssd/issue/3594`_ - sssd used wrong
search base with wrong AD server
- `3592 https://pagure.io/SSSD/sssd/issue/3592`_ - Write a
regression
test for false possitive "corrupted" memory cache
- `3590 https://pagure.io/SSSD/sssd/issue/3590`_ - proxy to files
does
not work with implicit_files_domain
- `3588 https://pagure.io/SSSD/sssd/issue/3588`_ - sssd_nss
consumes
more memory until restarted or machine swaps
- `3586 https://pagure.io/SSSD/sssd/issue/3586`_ - Give a more
detailed debug and system-log message if krb5_init_context() failed
- `3585 https://pagure.io/SSSD/sssd/issue/3585`_ - Reset password
with
two factor authentication fails
- `3579 https://pagure.io/SSSD/sssd/issue/3579`_ - SSSD fails to
fetch
group information after switching IPA client to a non-default view
- `3571 https://pagure.io/SSSD/sssd/issue/3571`_ - mmap cache:
consistency check might fail if there are hash collisions
- `3570 https://pagure.io/SSSD/sssd/issue/3570`_ - The cache-req
debug
string representation uses a wrong format specifier for by-ID requests
- `3569 https://pagure.io/SSSD/sssd/issue/3569`_ - The cache_req
code
doesn't check the min_id/max_id boundaries for requests by ID
- `3564 https://pagure.io/SSSD/sssd/issue/3564`_ - Smartcard
authentication fails if SSSD is offline and
'krb5_store_password_if_offline
= True'
- `3563 https://pagure.io/SSSD/sssd/issue/3563`_ - Some sysdb tests
fail because they expect a certain order of entries returned from ldb
- `3562 https://pagure.io/SSSD/sssd/issue/3562`_ - Use-after free
if
more sudo requests run and one of them fails, causing a fail-over to a
next
server
- `3560 https://pagure.io/SSSD/sssd/issue/3560`_ - Improve
Smartcard
integration if multiple certificates or multiple mapped identities are available
- `3551 https://pagure.io/SSSD/sssd/issue/3551`_ - Race condition
between refreshing the cr_domain list and a request that is using the
list
can cause a segfault is sssd_nss
- `3547 https://pagure.io/SSSD/sssd/issue/3547`_ - data from ipa
returned with id_provider=file
- `3545 https://pagure.io/SSSD/sssd/issue/3545`_ - SSSD creates bad
override search filter due to AD Trust object with parenthesis
- `3539 https://pagure.io/SSSD/sssd/issue/3539`_ - Do not autostart
the implicit files domain if sssd configures id_provider=proxy and proxy_target_files
- `3529 https://pagure.io/SSSD/sssd/issue/3529`_ - SSSD-kcm/secrets
failed to restart during/after upgrade
- `3528 https://pagure.io/SSSD/sssd/issue/3528`_ - sssd refuses to
start when pidfile is present, but the process is gone
- `3523 https://pagure.io/SSSD/sssd/issue/3523`_ - ABRT crash -
/usr/libexec/sssd/sssd_nss in setnetgrent_result_timeout
- `3503 https://pagure.io/SSSD/sssd/issue/3503`_ - Do not index
objectclass, add and index objectcategory instead
- `3496 https://pagure.io/SSSD/sssd/issue/3496`_ - [RFE] Add a
configuration option to SSSD to disable the memory cache
- `3486 https://pagure.io/SSSD/sssd/issue/3486`_ - Improve
`enumerate`
documentation/troubleshooting guide
- `3484 https://pagure.io/SSSD/sssd/issue/3484`_ - MAN: Describe
the
constrains of ipa_server_mode better in the man page
- `3468 https://pagure.io/SSSD/sssd/issue/3468`_ - SSSD doesn't
use AD
global catalog for gidnumber lookup, resulting in unacceptable delay
for
large forests
- `3454 https://pagure.io/SSSD/sssd/issue/3454`_ - sssd-kcm crashes
with multiple parallel requests
- `3451 https://pagure.io/SSSD/sssd/issue/3451`_ - When sssd is
configured with id_provider proxy and auth_provider ldap, login fails
if
the LDAP server is not allowing anonymous binds.
- `3444 https://pagure.io/SSSD/sssd/issue/3444`_ - document
information on why SSSD does not use host-based security filtering when processing AD GPOs
- `3433 https://pagure.io/SSSD/sssd/issue/3433`_ -
SYSLOG_IDENTIFIER
is different
- `3293 https://pagure.io/SSSD/sssd/issue/3293`_ - Log when SSSD
authentication fails because when two IPA accounts share an email
address
- `3285 https://pagure.io/SSSD/sssd/issue/3285`_ - SSSD needs
restart
after incorrect clock is corrected with AD
- `3265 https://pagure.io/SSSD/sssd/issue/3265`_ - [RFE] sssd
should
remember DNS sites from first search
- `3198 https://pagure.io/SSSD/sssd/issue/3198`_ - Incorrect error
code returned from krb5_child for expired/locked user with id_provider
AD
- `2976 https://pagure.io/SSSD/sssd/issue/2976`_ - sdap code can
mark
the whole sssd_be offline
- `2840 https://pagure.io/SSSD/sssd/issue/2840`_ - [RFE] Produce
access control attestation report for IPA domains
- `2823 https://pagure.io/SSSD/sssd/issue/2823`_ - Integration
tests:
Use dbus-daemon in cwrap enviroment for test
- `2478 https://pagure.io/SSSD/sssd/issue/2478`_ - Provide
sss_nss_*
API to directly query SSSD instead of nsswitch.conf route
- `1872 https://pagure.io/SSSD/sssd/issue/1872`_ - [RFE] Support
User
Private Groups for main domains, too
- `1729 https://pagure.io/SSSD/sssd/issue/1729`_ - Enumerating
large
number of users makes sssd_be hog the cpu for a long time.
Detailed Changelog
Andreas Schneider (1):
* Avoid double semicolon warnings on older compilersCarlos O'Donell (1):
* nss: Fix invalid enum nss_status return values.Fabiano Fidêncio (21):
* CACHE_REQ: Copy the cr_domain list for each request * LDAP: Bind to the LDAP server also in the auth * TOOLS: Double quote array expansions in sss_debuglevel * TOOLS: Call "exec" for sss_debuglevel * LDAP: Improve error treatment from sdap_cli_connect() inldap_auth
* SYSDB: Remove code causing a covscan warning * NSS: Fix covscan warning * CACHE_REQ: Fix typo: cache_reg -> cache_req * TOOLS: Fix typo: exist -> exists * SYSDB: Return EOK in case a non-fatal issue happened * SYSDB_VIEWS: Remove sshPublicKey attribute when it's not set * IPA: Remove sshPublicKey attribute when it's not set * DESKPROFILE: Add checks for user and host category * DESKPROFILE: Harden the permission of deskprofilepath * DESKPROFILE: Soften umask for the domain's dir * DESKPROFILE: Fix the permissions and soften the umask foruser's
dir * DESKPROFILE: Use seteuid()/setegid() to create the profile * DESKPROFILE: Use seteuid()/setegid() to delete the
profile/user's
dir * DESKPROFILE: Set the profile permissions to read-only * PYSSS_MURMUR: Fix [-Wsign-compare] found by gcc * DESKPROFILE: Document it doesn't work when run as unprivileged
user
Hristo Venev (1):
* providers: Move hostid from ipa to sdap, v2Jakub Hrozek (35):
* Update the version number to track 1.16.1 development * CONFIG: Add a new option auto_private_groups * CONFDB: Remove the obsolete option magic_private_groups * SDAP: Allow the mpg flag for the main domain * LDAP: Turn group request into user request for MPG domains ifneeded * SYSDB: Prevent users and groups ID collision in MPG domains
except
for id_provider=local * TESTS: Add integration tests for the auto_private_groups option * RESP: Add some missing NULL checks * TOOLS: Add a new sssctl command access-report * SDAP: Split out utility function sdap_get_object_domain() from sdap_object_in_domain() * LDAP: Extract the check whether to run a POSIX check to a
function
* LDAP: Only run the POSIX check with a GC connection * SDAP: Search with a NULL search base when looking up an ID inthe
Global Catalog * SDAP: Rename sdap_posix_check to sdap_gc_posix_check * DP: Create a new handler function getAccountDomain() * AD: Implement a real getAccountDomain handler for the AD
provider
* RESP: Expose DP method getAccountDomain() to responders * NEGCACHE: Add API for setting and checkinglocate-account-domain
requests * TESTS: Add tests for the object-by-id cache_req interface * CACHE_REQ: Export cache_req_search_ncache_add() as cache_req private interface * CACHE_REQ: Add plugin methods required for the domain-locator request * CACHE_REQ: Add a private request cache_req_locate_domain() * CACHE_REQ: Implement the plugin methods that utilize the domain locator API * CACHE_REQ: Use the domain-locator request to only search
domains
where the entry was found * MAN: Document how the Global Catalog is used currently * IPA: Include SYSDB_OBJECTCATEGORY, not OBJECTCLASS in cache
search
results * MAN: Document that auth and access IPA and AD providers rely on id_provider being set to the same type * MAN: Improve enumeration documentation * MAN: Describe the constrains of ipa_server_mode better in the
man
page * IPA: Delay the first periodic refresh of trusted domains * AD: Inherit the MPG setting from the main domain * SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains * SYSDB: Use sysdb_domain_dn instead of raw ldb_dn_new_fmt * SYSDB: Read the ldb_message from loop's index counter when
reading
subdomain UPNs * AD: Use the right sdap_domain for the forest root
Lukas Slebodnik (51):
* KCM: Fix typo in comments * CI: Ignore source file generated by systemtap * UTIL: Add wrapper function to configure logger * Add parameter --logger to daemons * SYSTEMD: Replace parameter --debug-to-files with${DEBUG_LOGGER}
* SYSTEMD: Add environment file to responder service files * UTIL: Hide and deprecate parameter --debug-to-files * KCM: Fix restart during/after upgrade * BUILD: Properly expand variables in sssd-ifp.service * SYSTEMD: Clean pid file in corner cases * CHILD: Pass information about logger to children * BUILD: Disable tests with know failures * SPEC: Reduce build time dependencies * sysdb-test: Fix warning may be used uninitialized * responder: Fix talloc hierarchy in sized_output_name * test_responder: Check memory leak in sized_output_name * confdb: Move detection files to separate function * confdb: Fix starting of implicit files domain * confdb: Do not start implicit_files with proxy domain * test_files_provider: Regression test for implicit_files + proxy * SDAP: Fix typo in debug message * Revert "intg: Disable add_remove tests" * libnfsidmap: Use public plugin header file if available * dyndns_tests: Fix unit test with missing features in nsupdate * Remove unnecessary script for upgrading debug_levels * Remove legacy script for upgrading sssd.conf * BUILD: Add missing libs found by -Wl,-z,defs * BUILD: Fix using of libdlopen_test_providers.so in tests * SYSDB: Decrese debuglevel in sysdb_get_certmap * KRB5: Pass special flag to krb5_child * krb5_child: Distinguish between expired & disabled AD user * AD: Suppress warning Wincompatible-pointer-types with saslcallbacks * pysss: Drop unused parameter * pysss: Suppress warning Wincompatible-pointer-types * CRYPTO: Suppress warning Wstringop-truncation * INOTIFY: Fix warning Wstringop-truncation * SIFP: Suppress warning Wstringop-truncation * CLIENT: Fix warning Wstringop-overflow * pysss_murmur: Allow to have NUL character in python bindings * TESTS: Extend code coverage for murmurhash3 * mmap_cache: Remove unnecessary memchr in client code * test_memory_cache: Regression test for #3571 * SPEC: Fix systemd executions/requirements * SPEC: Reduce changes between upstream and downstream * intg: Build with optimisations and debug symbols * intg: Do not prefer builddir in PATH * intg: Install configuration for dbus daemon * intg: Install wrapper for getsockopt * intg: Add sample infopipe test in cwrap env * IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR * IPA: Fix typo in debug message in sssm_ipa_selinux_init
Michal Židek (9):
* NSS: Move memcache setup to separate function * NSS: Specify memcache_timeout=0 semantics * MAN: Document memcache_timeout=0 meaning * MAN: GPO Security Filtering limitation * SYSDB: Better debugging for email conflicts * TESTS: Order list of entries in some lists * Revert "BUILD: Disable tests with know failures" * SELINUX: Check if SELinux is managed in selinux_child * util: Add sss\_ prefix to some functionsNiranjan M.R (1):
* Initial revision of sssd pytest frameworkPavel Březina (10):
- sudo: document background activity
- sudo: always use srv_opts from id context
- AD: Remember last site discovered
- sysdb: add functions to get/set client site
- AD: Remember last site discovered in sysdb
- dp: use void * to express empty output argument list
- dp: add method to refresh access control rules
- ipa: implement method to refresh HBAC rules
- ifp: add method to refresh access control rules in domain
- sssctl: call dbus instead of pam to refresh HBAC rules
René Genz (12):
* Fix minor spelling mistakes * README: Add link to docs repo * Fix minor spelling mistakes * Fix minor spelling mistakes in providers/* * Fix minor spelling mistakes in responder/* * Fix minor spelling mistakes in sss_client/* * Fix minor spelling mistakes in tests/cmocka/* * Fix minor spelling mistakes * Fix minor spelling mistakes in tests/* * Fix minor spelling mistakes in tests/multihost/* * Fix minor spelling mistakes in PY files in tests/python/* * Fix minor spelling mistakes and formatting in tests/python/*Sumit Bose (48):
* sss_client: create nss_common.h * nss-idmap: add nss like calls with timeout and flags * NSS: add \*_EX version of some requests * NSS: add support for SSS_NSS_EX_FLAG_NO_CACHE * CACHE_REQ: Add cache_req_data_set_bypass_dp() * nss: make memcache_delete_entry() public * NSS: add support for SSS_NSS_EX_FLAG_INVALIDATE_CACHE * NSS/TESTS: add unit tests for \*_EX requests * nss-idmap: add timeout version of old sss_nss_* calls * nss-idmap: allow empty buffer withSSS_NSS_EX_FLAG_INVALIDATE_CACHE
* p11_child: return multiple certs * PAM: handled multiple certs in the responder * pam_sss: refactoring, use struct cert_auth_info * p11_child: use options to select certificate for authentication * pam: add prompt string for certificate authentication * PAM: allow missing logon_name during certificate authentication * p11_child: add descriptions for error codes to debug messages * pam: filter certificates in the responder not in the child * PAM: add certificate's label to the selection prompt * NSS: Use enum_ctx as memory_context in_setnetgrent_set_timeout()
* mmap_cache: make checks independent of input size * sysdb: be_refresh_get_values_ex() remove unused option * sysdb: do not use objectClass for users and groups * sysdb: do not use LDB_SCOPE_ONELEVEL * sysdb: remove IDXONE and objectClass from users and groups * krb5: show error message for krb5_init_context() failures * UTIL: add find_domain_by_object_name_ex() * ipa: handle users from different domains inipa_resolve_user_list_send() * overrides: fixes for sysdb_invalidate_overrides() * ipa: check for SYSDB_OVERRIDE_DN in process_members and get_group_dn_list * IPA: use cache searches in get_groups_dns() * ipa: compare DNs instead of group names in
ipa_s2n_save_objects()
* p11_child: make sure OCSP checks are done * nss-idmap: allow NULL result in \*_timeout calls * Revert "p11_child: make sure OCSP checks are done" * p11_child: properly check results of CERT_VerifyCertificateNow * ifp: use realloc in ifp_list_ctx_remaining_capacity() * SDAP: skip builtin AD groups in sdap_save_grpmem() * sysdb: add userMappedCertificate to the index * krb5_child: check preauth types if password is expired * pam_sss: password change with two factor authentication * nss-idmap: check timed muted return code * krb5: call krb5_auth_cache_creds() if a password is available * DESKPROFILE: Fix 'Improper use of negative value' * AD: sdap_get_ad_tokengroups_done() allocate temporary data onstate
* AD: do not allocate temporary data on long living context * ipa: remove SYSDB_USER_CERT from sub-domain users * ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
Thorsten Scherf (1):
* IPA: Fixed subdomain typoVictor Tapia (1):
* WATCHDOG: Restart providers with SIGUSR2 after time driftamitkuma (3):
* cache_req: Correction of cache_req debug string ID format * cache: Check for max_id/min_id in cache_req * MAN: Explain how does auto_private_groups affect subdomains
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
-- Best Regards, Avigdor
Avigdor Finkelstein Mobile: +972 (0)54 2278452 Fax: +972 8 9316406
Email: AvigdorFin@g Avigdor.Finkelstein@tangram-soft.co.ilmail.com Home Address: P.O.B 187 Rehovot 76101 ISRAEL
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost... _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...
freeipa-users@lists.fedorahosted.org
-
AvigdorFin -
Jakub Hrozek -
Lachlan Musicman -
Rob Crittenden -
Sumit Bose