- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd
service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
One serious security issue was resolved related to the kerberos provider.
Users who authenticate against Kerberos and have cached credentials could
log in with a zero-length password
The network exposure of this bug was limited, as users logged in this way
would not have valid network credentials (by lucky accident).
This issue was present only in the 0.99.x preview releases and not in any
of the stable releases (0.7.1 and earlier)
Stability fixes since the 0.99.1 preview release
Added or updated several translations
Fixed long-standing "I have no name!" issue with X-based terminals
SSSD now passes "make distcheck" cleanly
SSSD PAM now conforms better to standards regarding PAM_PRELIM_CHECK
== Detailed Changelog == Göran Uddeborg (2):
Update SV translation
Update SV translation
Marina Latini (1):
Update IT translation
Martin Nagy (2):
Don't consider one address with different port numbers as the same
Change the first server pick logic
Sergei V. Kovylov (1):
sssd.spec for SLES
Simo Sorce (2):
Fix upgrade bug #323
Fix ldap child memory hierarchy and other issues
Stephen Gallagher (14):
Properly close STDERR when daemonizing
Fix tight loop in monitor
Don't set explicit default for "timeout" in domains
Fix warning in server.c
Raise DEBUG level of sdap_get_generic_done()
Change default for enumeration to TRUE
Fix tight-loop in monitor part 2
Properly handle EINTR from poll()
Updating ES translation
Add DEBUG messages to getpwnam_callback and getpwuid_callback
Clarify access_provider manpage entry
Do not blindly accept zero-length passwords
Fix broken password changes for local users
Release SSSD 1.0
Sumit Bose (9):
Use sys.exit instead of exit
Check for minimal version of check
Build python modules in builddir
Use --with-ldb-lib-dir while running make distcheck
Cleanup db files after test run
disable password migration code
Handle chauthtok with PAM_PRELIM_CHECK separately
Do not overwrite valid TGTs when offline
Fix for #345
Copy-edit sssd-ipa man page
Dmitri Pal (5):
COMMON Improvements to the trace macro
COLLECTION Create reference to the top level collection
Cleaning FIXME comments
Cleaning FIXME comments.
INI Correcting build warnings.
Fabian Affolter (1):
Add German translation
Göran Uddeborg (2):
Add Swedish translation for sss_client
Add Swedish translation for SSSD server
Jakub Hrozek (13):
Warn visibly about permission problems with the config file
Better error message when there is no local domain configured
Setup ldap child logging from IPA backend
Check the services started against a list of known services
Handle spaces in config parser
Fail on nonexistent input file
Do not start with provider=files
Reduce code duplication between LDAP child and Kerberos child
Change ares usage to be c-ares 1.7.0 compatible
Import ares 1.7.0 helpers
Don't build the SRV and TXT parsing code except for tests
Document the failover feature in manpages
Consolidate code for splitting strings by separator
Martin Nagy (3):
Fix egg-info file generation in the spec file
Add some debugging statements to fail_over and resolver
Correctly restart server status after the timeout
Simo Sorce (17):
Fix tabs
Fix memberof plugin
Compute and save memberuid in cache as well
Use memberuid and not member in group enumerations
Use the custom password field in groups too.
Resolve nested groups also when rfc2307bis is used
Make strdn build functions more available
Fix nested group memberships
Allow nesting to fix#310
Fix bug #311, properly set callback attribute
Change dhash API to be talloc-friendly
Add private pointer for delete callback
Add comments to document latest changes
Add rebuild task to memberof plugin
Handle the special 02 upgrade case for 04->05
Fix for #316
Fix for #322, update from old database versions.
Stephen Gallagher (28):
Remove ELAPI from build and tarball
Stop configuring ELAPI
Make debug log timestamps human-readable
Raise debug log level for LDB_DEBUG_WARNING
Add allocation error check
Avoid returning uninitialized result.
Fix potential uninitialized value errors in nsssrv_cmd.c
Fix potential uninitialized value error in responder_dp.c
SSSDDomain.remove_provider() requires only the provider type
Make SSSDDomain.remove_provider() remove configured options
Run dhash tests
Add SSSDDomain.set_name() function to SSSDConfig API
Reduce the verbosity of the SSSDConfigTest
Fix broken SSSDChangeConf.set() function
Fix SSSDConfig API bugs around [de-]activation of domains
Fix RPM spec for RHEL6
fix deactivate_domain()
SSSDConfig.get_domain() should properly detect active state
Ensure that list_active_domains returns the real value
Properly deny id_provider=files
Add missing options to sssd-ipa configuraion
Add missing SSSDConfig file for IPA for make install
Fix processing of Boolean values in SSSDConfig
Add 'permit' and 'deny' access providers to SSSDConfig API
Remove default for ldap_use_start_tls in IPA providers
Run SSSDConfig tests during 'make check'
Fix stupid copy-paste error
Updating to version 0.99.1
Sumit Bose (13):
Do not include libsss_ipa.la in rpm package
Immediately return a krb5 change password request when offline
Check LDAP structure before calling ldap_unbind_ext()
Add sysdb_search_custom request
Do not treat missing proc files as errors.
Add basic OS detection
Make packaging of *.egg-info files more flexible
Try to renew Kerberos credentials
Add checks to test the memberuid handling
Add offline support for ipa_access
Add dummy credentials to an empty ccache file
Always update sysdb to the latest version
Fix DEBUG message for sysdb_init
beckerde (1):
Add Spanish translation
ruigo (1):
Add Portuguese translation
Enhanced IPA provider with host-based access control support
Added server failover feature
Vast performance enhancements to enumerations
Performance enhancements to offline user lookups
Improvements to the SSSDConfig API and configuration upgrade scripts. They
will now retain comments and ordering.
Several new translations
== Known Bugs ==
Nested groups are known to be broken in 0.99. A fix is basically ready, but
was too late for inclusion in this release. This will be fixed before
the 1.0 release.
== Detailed changes since 0.7.1 == Bouska (1):
Add French translation to sss_client
Jakub Hrozek (17):
Fix migration script for pre-0.5 local domains
Do not migrate Data Provider
Free the PCRE regexp with destructor
Do not delete users, groups outside domain range
Add missing include
IPA time rules parsing routines
Fix regression in error message when deleting groups
Assorted manpage fixes
Make the password field configurable in NSS
Add Simo's ipachangeconf
SSSDChangeConf - a wrapper around ipachangeconf
Change the upgrade script to use ipachangeconf
Convert SSSDConfig API to ipachangeconf
SSSDConfigAPI fixes
upgrade_config fixes for SSSD 0.6 and later
Split helpers for child processes
Get TGT in a child process.
Martin Nagy (5):
Add missing include file to files-tests.c
Fix a bad free in async_resolv.c
Add DLIST_FOR_EACH() macro
Add simple reference counting wrappers for talloc
Add fail over utility functions
Piotr Drąg (1):
Updating polish translation for 0.7.0
Simo Sorce (48):
Copy option overrides.
Read the right buffer, avoids potential segfaults
Add IPA conf template
Zero pointers on free
Use standard coding practice to set last login
Fix segfault
Add proper support for IPA/AD schemas
Move responsibility for entry expiration timeout
Kill the ldap connection when we go offline
Tidy up ipa options
Add support to get rootDSE from the LDAP server.
Fix segfault when SASL is not used at all
Rename sdap_id_map to sdap_attr_map
Make available method to quickly retrive string
Make useful function more broadly available.
Store the original memberof attributes if any
Unify parse routines, use maps in generic searches
Fix and enhance initgroups call
Unify code to use the generic search interface
Reorganize ldap id provider files
Split async helpers in multiple files
Always set last update and expire time
Fix build
Fix ldap driver
Check return, zero free hostent, adhere to style
Fix enumerations
Fix tevent_req error checking.
Refactor delete functions and add a few
Add cleanup task
Try to fix offline logins
Fix double free case.
Fix check_cache bug in dealing with the callback
Change var name to make its use more clear.
Fix crash due to uninitialized timeout variable
Change initgroups code to use and check the cache
Change the pam code to perform an initgroups call
Store initgr expire time on initgr call
Failover fixes and additions
Better behavior on cleanup
Correctly escape DN value.
Add reference to sssd-krb5 man page.
Optimize sysdb_enumgrent
Filter by id range before actually storing entries.
Raise some timeouts
Add initial failover support for ldap and ipa
Fix ticket #289
Fix internal options numbers test
In IPA, the realm is always the domain uppercased.
Stephen Gallagher (32):
Remove DP from example configuration
Remove [dp] section from example config
Fix sssd.api.conf with correct entry_cache_timeout
Clean up warnings in dhash tests
Make config_file_version a hidden setting in SSSDConfig API
Remove magic_private_groups from SSSDConfig API schema
Add support for option descriptions to SSSDConfig API
Localize SSSDConfig strings
Add complete pydoc for SSSDConfig API
cyrus-sasl-gssapi
Simplify debug_fn()
Add configure check for sasl.h
Update midpoint refresh logic to be relative to cache timeout
Increase the sbus dispatch DEBUG level to 9
Build files.c only for tools
Clean up unused dependencies
Update sssd.spec to use only the required KRB5_LIBS and NSS_LIBS
Fix segfault on unknown user/domain
sssd-client line in specfile
Make the sysdb user and group names case-sensitive
Upgrade cache and local databases to case-sensitive names
Update translatable strings
Fix sysdb upgrade bug
Add empty NL translation
Only display errors in unit tests
Update PL translation
Update NL translation
Make backend request type a bitfield
Speed up user requests while offline
Update translation strings for string freeze
Fix bug with bad ldb pkg-config files
Update version to 0.99.0
Sumit Bose (32):
store original DN with cached group objects if available
added a ASQ search API for sysdb
Allow sysdb_search_entry request to return more than one result
Add AM_CFLAGS to unit tests
Fix compiler warnings in krb5_utils-tests.
remove old sysdb file before starting tests
set ipa_hostname if not given in config file
Make debug message less irritating.
add sysdb_delete_recursive request to sysdb API
Add sysdb_attrs_replace_name to sysdb API.
Fix for a seg fault during recursive delete
add replacements for missing Kerberos calls
Check is ccache structure is initialized before calling krb5_cc_destroy
added access module of IPA provider
Simplify krb5 child handler
Add check for access-time rules to ipa_access.
Add support for host, source host and user category
Fix inconsistent use of krb5_ccname_template
Fixes for proxy provider
Make 'permit' the default for the access target
Fix option name krb5_changepw_principal
Validate Kerberos credentials with local keytab
Improve handling of ccache files
Add ipa_auth
Enhance check for remote hosts
Add ldap_pwd_policy option
Read KDC info from file instead from environment
Really check return value from pam_set_item
Use ldb modules from build root for tests
Make ldb lib dir configurable
Fix an internal error when cache_credentials=FALSE
Remove unneeded debugging code
deneb (1):
Add Italian translation for sss_client
noriko (1):
Adding Japanese translation
raven (1):
Update PL translation
