=== SSSD 1.10 Beta 1 ===
The SSSD team is proud to announce the beta release of version 1.10 of the System Security Services Daemon.
This beta release includes several new features, mostly targeted at better integration with Microsoft Active Directory.
As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora 19 and rawhide shortly.
The SSSD 1.10 Beta 2 release is tentatively scheduled for next week, before the Fedora Test Day which will happen on May 9th. The Beta 2 release will contain the remaining features we finish before the Test Day.
There might be another pre-release if any of the planned features are not ready for the test day, after this last pre-release, the SSSD will enter a period of string-freeze and the 1.10 development will switch to bug fixing in preparation for the 1.10 final release.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights == * The Active Directory provider now includes support for Site-based discovery. This feature allows the Active Directory clients to find the most suitable Domain Controller to connect to. * Support for dynamic DNS updates in the Active Directory provider. This feature enables the clients to automatically update or refresh their DNS records stored in the AD server. * A new library, called libsss_nss_idmap was introduced. This library allows the user to convert Windows Security Identifiers (SIDs) to names and vice versa. The library also includes Python bindings. * Setting the SELinux context on the IPA server now also works for users coming from a trusted Active Directory domain * Fixed a serious performance issue when enumerating large number of users * The subdomain_homedir configuration option gained a new template expansion %F that expands to the flat name (NetBIOS name) of the trusted AD domain
== Packaging Changes == * The SSSD python ConfigAPI was moved to its own noarch subpackage to make the SSSD packaging more compliant with the Fedora packaging guidelines * The libsss_nss_idmap library and its Python bindings are packaged in separate subpackages
== Tickets Fixed == https://fedorahosted.org/sssd/ticket/453 [RFE] Replace pam status codes with sssd specific codes https://fedorahosted.org/sssd/ticket/902 [RFE] Allow setting krb5_renew_interval with a delimiter https://fedorahosted.org/sssd/ticket/1032 [RFE] sssd should support DNS sites https://fedorahosted.org/sssd/ticket/1414 [RFE] Improve syslog message when configuration cannot be loaded https://fedorahosted.org/sssd/ticket/1609 [RFE] Subdomain homedir template should be configurable/use flatname by default https://fedorahosted.org/sssd/ticket/1625 Confusing error messages for invalid sssd.conf https://fedorahosted.org/sssd/ticket/1741 sss_cache doesn't support subdomains https://fedorahosted.org/sssd/ticket/1767 unify sss_mc_set_recycled https://fedorahosted.org/sssd/ticket/1774 move processing of password expiration back to PAM provider only https://fedorahosted.org/sssd/ticket/1784 rewrite nested group processing to follow the tevent_req coding style https://fedorahosted.org/sssd/ticket/1786 Use new interface from ding-libs ini interface https://fedorahosted.org/sssd/ticket/1809 Document that SSSD domains should only be named using ASCII characters https://fedorahosted.org/sssd/ticket/1830 make the authtok structure really opaque https://fedorahosted.org/sssd/ticket/1839 Incorrect *.py[co] files placement https://fedorahosted.org/sssd/ticket/1842 Allow usage of enterprise principals https://fedorahosted.org/sssd/ticket/1844 add a call to calculated the range for a given domain SID to libsss_idmap https://fedorahosted.org/sssd/ticket/1848 unused parameter in ipa_selinux handler https://fedorahosted.org/sssd/ticket/1860 pidfile() may leak memory on error https://fedorahosted.org/sssd/ticket/1861 potential out-of-bounds-write in sss_idmap_sid_to_dom_sid https://fedorahosted.org/sssd/ticket/1862 negative return in files.c https://fedorahosted.org/sssd/ticket/1864 Bad comparisons in checks found by new Coverity instance https://fedorahosted.org/sssd/ticket/1865 Logically dead code in tools_util.c https://fedorahosted.org/sssd/ticket/1867 document that AD provider is always case insensitive https://fedorahosted.org/sssd/ticket/1877 ding-libs.dhash: uninitialized pointer read https://fedorahosted.org/sssd/ticket/1888 freeipa 3.2 trusted ad user not listed in external group https://fedorahosted.org/sssd/ticket/1889 coverity: dead code in sudo client https://fedorahosted.org/sssd/ticket/1890 SSSD doesn't display warning for last grace login. https://fedorahosted.org/sssd/ticket/1892 In IPA AD trust setup, the sssd logs throws 'sysdb_search_user_by_name failed' error when AD user tries to login via ipa client.
== Detailed Changelog == Abhishek Singh (3): * cmocka unittest for find_uid added * cmocka unittest for io added * Fix segmentation fault in test_io.
Ariel Barria (2): * Allow setting krb5_renew_interval with a delimiter * Confusing error messages for invalid sssd.conf
Jakub Hrozek (38): * Updating the version for the 1.10 beta1 release * krb5 child: Use the correct type when processing OTP * pidfile(): Do not leak fd on error * Fix potential out-of-bounds write in sss_idmap_sid_to_dom_sid * Return errno, not -1 on failure in files.c * Check for correct variable name * Init failover with be_res options * Centralize resolv_init, remove resolv context list * dyndns: Fix initializing sdap_id_ctx * Check for the correct variables * Allocate PAM DP request data on responder context * LDAP: Always fail if a map can't be found * Put the override_homedir into an included xml file * Allow using flatname for subdomain home dir template * Fix simple access group control in case-insensitive domains * Make leak checks usable in tests that do not utilize check * tests: Fix the order of key/values * LDAP: do not invalidate pointer with realloc while processing ghost users * Convert the simple access check to new error codes * tests: Link the simple access tests with -ldl * Do not keep growing event context * Document the naming convention for SSSD domains * Document that the AD provider is case-insensitive * selinux: if no domain matches, make the debug message louder * Only try to relink ghost users if we're not enumerating * Display the last grace warning, too * Refactor dynamic DNS updates * Convert IPA-specific options to be back-end agnostic * dyndns: new option dyndns_refresh_interval * resolver: Return PTR record as string * dyndns: New option dyndns_update_ptr * dyndns: new option dyndns_force_tcp * dyndns: new option dyndns_auth * Split out the common code from timed DNS updates * Active Directory dynamic DNS updates * AD: Always initialize ID mapping * Only check UPN if enterprise principals are not used * Updating the translations for the 1.10 beta1 release
Jan Cholasta (1): * Add exit status section to sss_ssh_* man pages
Lukas Slebodnik (5): * LDAP: Fix value initialization warnings * Incorrect *.py[co] files placement * Fix krbcc dir creation issue with MIT krb5 1.11 * Default TEST_DIR to cwd, not empty string if not set explicitly * SUDO: IPA provider
Michal Zidek (6): * Check for waitpid failure at wrong place. * Wrong condition after waitpid. * sss_cache: support for subdomains * sss_cache: Remove annoying messages * Inform about function duplication. * libsss_idmap: function to calculate range
Ondrej Kos (3): * DB: Switch to new libini_config API * CONFDB: prevent double free * IDMAP: Fix variable initialization
Pavel Březina (18): * resolv: add resolv_get_domain request to resolv utils * resolv: add resolv_discover_srv request to resolv utils * DNS sites support - SRV lookup plugin interface * DNS sites support - SRV DNS lookup plugin * fail over - add function to insert multiple servers to the list * DNS sites support - replace SRV lookup code with a plugin call * DNS sites support - use SRV DNS lookup plugin in all providers * DNS sites support - add IPA SRV plugin * sudo client: remove dead code * add fo_discover_servers request * IPA SRV plugin: use fo_discover_servers request * IPA SRV plugin: improve debugging * sdap: add sdap_connect_host request * add sss_ldap_encode_ndr_uint32 * DNS sites support - add AD SRV plugin * dns srv plugin: compare domain names case insensitive * AD SRV plugin: check if site name is empty * fo_discover_servers_send: don't crash when backup_domain is NULL
Simo Sorce (1): * Further restrict become_user drop of privileges.
Sumit Bose (21): * Fix and rename get_my_domain_data() * Refactoring: remove duplicated code in nss responder * Allow usage of enterprise principals * Make IPA SELinux provider aware of subdomain users * Add override_homedir.xml to po4a.cfg * Remove unused TALLOC_CTX from responder_get_domain() * responder_get_domain: do not return disabled domains * responder_get_domain(): remove timeout calculation * LDAP: always store SID if available * Add secid filter to responder-dp protocol * Add two new request types to the data-provider interface * Add idmap context to nss context * Add responder_get_domain_by_id() * sysdb: add sysdb_search_object_by_sid() * Add sss_ncache_set_sid() and sss_ncache_check_sid() * Remove unused attribute list * Use struct to hold different types of request parameters * Add SID related lookups to IPA subdomains * Add SID related calls to the NSS responder * Add client library for SID related lookups * Add python interface to libsss_nss_idmap
Yuri Chornoivan (1): * Fix typos in man pages
Wow! Thanks for implementing features I was calling for few months ago! It is really highly appreciated :)
Few questions:
- From the man page it is not clear which DNS zone is being used to start the site discovery. I suppose dns_discovery_domain has to be defined for this feature to work, right? Can be the man page be little bit more clear about this?
- The concept of DNS sites definition seems to me very good. Does the pure IPA domain use something similar for large IPA domains or we have a different approach for this goal?
- It would probably not hurt to say in the man page that sssd is going to use gss-tsig signed DNS update packets so there is no need to allow unsecure updates on the MS based DNS server. Side note: It is still not clear to me who is responsible of updating the DNS zone if the client is using DHCP. MS says in some cases it is the client itself, but in most cases the DHCP server is responsible for this task. I do not know.
- When (if) will this find its way into RHEL-6?
Thanks, Ondrej ________________________________________ From: sssd-users-bounces@lists.fedorahosted.org [sssd-users-bounces@lists.fedorahosted.org] on behalf of Jakub Hrozek [jhrozek@redhat.com] Sent: Friday, May 03, 2013 10:16 PM To: sssd-devel@lists.fedorahosted.org; sssd-users@lists.fedorahosted.org; freeipa-interest@redhat.com Subject: [SSSD-users] Announcing SSSD 1.10.0 Beta 1
=== SSSD 1.10 Beta 1 ===
The SSSD team is proud to announce the beta release of version 1.10 of the System Security Services Daemon.
This beta release includes several new features, mostly targeted at better integration with Microsoft Active Directory.
As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora 19 and rawhide shortly.
The SSSD 1.10 Beta 2 release is tentatively scheduled for next week, before the Fedora Test Day which will happen on May 9th. The Beta 2 release will contain the remaining features we finish before the Test Day.
There might be another pre-release if any of the planned features are not ready for the test day, after this last pre-release, the SSSD will enter a period of string-freeze and the 1.10 development will switch to bug fixing in preparation for the 1.10 final release.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights == * The Active Directory provider now includes support for Site-based discovery. This feature allows the Active Directory clients to find the most suitable Domain Controller to connect to. * Support for dynamic DNS updates in the Active Directory provider. This feature enables the clients to automatically update or refresh their DNS records stored in the AD server. * A new library, called libsss_nss_idmap was introduced. This library allows the user to convert Windows Security Identifiers (SIDs) to names and vice versa. The library also includes Python bindings. * Setting the SELinux context on the IPA server now also works for users coming from a trusted Active Directory domain * Fixed a serious performance issue when enumerating large number of users * The subdomain_homedir configuration option gained a new template expansion %F that expands to the flat name (NetBIOS name) of the trusted AD domain
== Packaging Changes == * The SSSD python ConfigAPI was moved to its own noarch subpackage to make the SSSD packaging more compliant with the Fedora packaging guidelines * The libsss_nss_idmap library and its Python bindings are packaged in separate subpackages
== Tickets Fixed == https://fedorahosted.org/sssd/ticket/453 [RFE] Replace pam status codes with sssd specific codes https://fedorahosted.org/sssd/ticket/902 [RFE] Allow setting krb5_renew_interval with a delimiter https://fedorahosted.org/sssd/ticket/1032 [RFE] sssd should support DNS sites https://fedorahosted.org/sssd/ticket/1414 [RFE] Improve syslog message when configuration cannot be loaded https://fedorahosted.org/sssd/ticket/1609 [RFE] Subdomain homedir template should be configurable/use flatname by default https://fedorahosted.org/sssd/ticket/1625 Confusing error messages for invalid sssd.conf https://fedorahosted.org/sssd/ticket/1741 sss_cache doesn't support subdomains https://fedorahosted.org/sssd/ticket/1767 unify sss_mc_set_recycled https://fedorahosted.org/sssd/ticket/1774 move processing of password expiration back to PAM provider only https://fedorahosted.org/sssd/ticket/1784 rewrite nested group processing to follow the tevent_req coding style https://fedorahosted.org/sssd/ticket/1786 Use new interface from ding-libs ini interface https://fedorahosted.org/sssd/ticket/1809 Document that SSSD domains should only be named using ASCII characters https://fedorahosted.org/sssd/ticket/1830 make the authtok structure really opaque https://fedorahosted.org/sssd/ticket/1839 Incorrect *.py[co] files placement https://fedorahosted.org/sssd/ticket/1842 Allow usage of enterprise principals https://fedorahosted.org/sssd/ticket/1844 add a call to calculated the range for a given domain SID to libsss_idmap https://fedorahosted.org/sssd/ticket/1848 unused parameter in ipa_selinux handler https://fedorahosted.org/sssd/ticket/1860 pidfile() may leak memory on error https://fedorahosted.org/sssd/ticket/1861 potential out-of-bounds-write in sss_idmap_sid_to_dom_sid https://fedorahosted.org/sssd/ticket/1862 negative return in files.c https://fedorahosted.org/sssd/ticket/1864 Bad comparisons in checks found by new Coverity instance https://fedorahosted.org/sssd/ticket/1865 Logically dead code in tools_util.c https://fedorahosted.org/sssd/ticket/1867 document that AD provider is always case insensitive https://fedorahosted.org/sssd/ticket/1877 ding-libs.dhash: uninitialized pointer read https://fedorahosted.org/sssd/ticket/1888 freeipa 3.2 trusted ad user not listed in external group https://fedorahosted.org/sssd/ticket/1889 coverity: dead code in sudo client https://fedorahosted.org/sssd/ticket/1890 SSSD doesn't display warning for last grace login. https://fedorahosted.org/sssd/ticket/1892 In IPA AD trust setup, the sssd logs throws 'sysdb_search_user_by_name failed' error when AD user tries to login via ipa client.
== Detailed Changelog == Abhishek Singh (3): * cmocka unittest for find_uid added * cmocka unittest for io added * Fix segmentation fault in test_io.
Ariel Barria (2): * Allow setting krb5_renew_interval with a delimiter * Confusing error messages for invalid sssd.conf
Jakub Hrozek (38): * Updating the version for the 1.10 beta1 release * krb5 child: Use the correct type when processing OTP * pidfile(): Do not leak fd on error * Fix potential out-of-bounds write in sss_idmap_sid_to_dom_sid * Return errno, not -1 on failure in files.c * Check for correct variable name * Init failover with be_res options * Centralize resolv_init, remove resolv context list * dyndns: Fix initializing sdap_id_ctx * Check for the correct variables * Allocate PAM DP request data on responder context * LDAP: Always fail if a map can't be found * Put the override_homedir into an included xml file * Allow using flatname for subdomain home dir template * Fix simple access group control in case-insensitive domains * Make leak checks usable in tests that do not utilize check * tests: Fix the order of key/values * LDAP: do not invalidate pointer with realloc while processing ghost users * Convert the simple access check to new error codes * tests: Link the simple access tests with -ldl * Do not keep growing event context * Document the naming convention for SSSD domains * Document that the AD provider is case-insensitive * selinux: if no domain matches, make the debug message louder * Only try to relink ghost users if we're not enumerating * Display the last grace warning, too * Refactor dynamic DNS updates * Convert IPA-specific options to be back-end agnostic * dyndns: new option dyndns_refresh_interval * resolver: Return PTR record as string * dyndns: New option dyndns_update_ptr * dyndns: new option dyndns_force_tcp * dyndns: new option dyndns_auth * Split out the common code from timed DNS updates * Active Directory dynamic DNS updates * AD: Always initialize ID mapping * Only check UPN if enterprise principals are not used * Updating the translations for the 1.10 beta1 release
Jan Cholasta (1): * Add exit status section to sss_ssh_* man pages
Lukas Slebodnik (5): * LDAP: Fix value initialization warnings * Incorrect *.py[co] files placement * Fix krbcc dir creation issue with MIT krb5 1.11 * Default TEST_DIR to cwd, not empty string if not set explicitly * SUDO: IPA provider
Michal Zidek (6): * Check for waitpid failure at wrong place. * Wrong condition after waitpid. * sss_cache: support for subdomains * sss_cache: Remove annoying messages * Inform about function duplication. * libsss_idmap: function to calculate range
Ondrej Kos (3): * DB: Switch to new libini_config API * CONFDB: prevent double free * IDMAP: Fix variable initialization
Pavel Březina (18): * resolv: add resolv_get_domain request to resolv utils * resolv: add resolv_discover_srv request to resolv utils * DNS sites support - SRV lookup plugin interface * DNS sites support - SRV DNS lookup plugin * fail over - add function to insert multiple servers to the list * DNS sites support - replace SRV lookup code with a plugin call * DNS sites support - use SRV DNS lookup plugin in all providers * DNS sites support - add IPA SRV plugin * sudo client: remove dead code * add fo_discover_servers request * IPA SRV plugin: use fo_discover_servers request * IPA SRV plugin: improve debugging * sdap: add sdap_connect_host request * add sss_ldap_encode_ndr_uint32 * DNS sites support - add AD SRV plugin * dns srv plugin: compare domain names case insensitive * AD SRV plugin: check if site name is empty * fo_discover_servers_send: don't crash when backup_domain is NULL
Simo Sorce (1): * Further restrict become_user drop of privileges.
Sumit Bose (21): * Fix and rename get_my_domain_data() * Refactoring: remove duplicated code in nss responder * Allow usage of enterprise principals * Make IPA SELinux provider aware of subdomain users * Add override_homedir.xml to po4a.cfg * Remove unused TALLOC_CTX from responder_get_domain() * responder_get_domain: do not return disabled domains * responder_get_domain(): remove timeout calculation * LDAP: always store SID if available * Add secid filter to responder-dp protocol * Add two new request types to the data-provider interface * Add idmap context to nss context * Add responder_get_domain_by_id() * sysdb: add sysdb_search_object_by_sid() * Add sss_ncache_set_sid() and sss_ncache_check_sid() * Remove unused attribute list * Use struct to hold different types of request parameters * Add SID related lookups to IPA subdomains * Add SID related calls to the NSS responder * Add client library for SID related lookups * Add python interface to libsss_nss_idmap
Yuri Chornoivan (1): * Fix typos in man pages
_______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On Sat, May 04, 2013 at 07:47:20AM +0000, Ondrej Valousek wrote:
Wow! Thanks for implementing features I was calling for few months ago! It is really highly appreciated :)
This is very nice to hear. You can join the F19 test day this Thursday to experiment with the features: https://fedoraproject.org/wiki/Test_Day:2013-05-09_SSSD_Improvements_and_AD_...
Few questions:
- From the man page it is not clear which DNS zone is being used to start
the site discovery. I suppose dns_discovery_domain has to be defined for this feature to work, right? Can be the man page be little bit more clear about this?
It should be dns_discovery domain with a fallback to the domain part of the machine's host name. I opened: https://fedorahosted.org/sssd/ticket/1909
Maybe we could just point to the Service Discovery more loudly.
- The concept of DNS sites definition seems to me very good. Does the
pure IPA domain use something similar for large IPA domains or we have a different approach for this goal?
Yes, here is the design document for the IPA service discovery: http://www.freeipa.org/page/V3/DNS_Location_Mechanism
The SSSD already has support for the discovery, but there is no UI on the IPA side yet. You'd need to put the records into the Bind's LDAP database manually.
- It would probably not hurt to say in the man page that sssd is going
to use gss-tsig signed DNS update packets so there is no need to allow unsecure updates on the MS based DNS server.
I agree: https://fedorahosted.org/sssd/ticket/1910
Side note: It is still not clear to me who is responsible of updating the DNS zone if the client is using DHCP. MS says in some cases it is the client itself, but in most cases the DHCP server is responsible for this task. I do not know.
The way I read some technet articles (for instance http://technet.microsoft.com/en-us/library/cc757041%28v=ws.10%29.aspx) it seemed that both the server refreshes the address halfway into the lease and clients refresh the record every 24 hours.
- When (if) will this find its way into RHEL-6?
This is a good question for RHEL PM, but I don't think a RHEL6 backport is planned at the moment.
Thanks, Ondrej
sssd-users@lists.fedorahosted.org
-
Jakub Hrozek -
Ondrej Valousek