import RHEL 10 Beta sssd-2.10.0~beta2-3.el10

2024-11-20 13:50:38 +00:00
15 changed files with 1277 additions and 2093 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/sssd-2.9.4.tar.gz
+sssd-2.10.0-beta2.tar.gz
--- a/.sssd.metadata
+++ b/.sssd.metadata
@ -1 +0,0 @@
 574f6cec9ee12dd943e4305286845343ab7bb891 SOURCES/sssd-2.9.4.tar.gz
--- a/0001-BUILD-configure-logrotate-to-work-with-non-root-grou.patch
+++ b/0001-BUILD-configure-logrotate-to-work-with-non-root-grou.patch
@ -0,0 +1,68 @@
 From e4ae4d6129e85fe99bbb82438ed90352400ecdf3 Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Fri, 26 Jul 2024 15:55:01 +0200
 Subject: [PATCH] BUILD: configure logrotate to work with non-root-group
 writable folder
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Otherwise logrotate complains:
 ```
 error: skipping "/var/log/sssd/sssd_kcm.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
 ```
 See https://bugzilla.redhat.com/show_bug.cgi?id=2299733 for details
 Reviewed-by: Jakub Vávra <jvavra@redhat.com>
 Reviewed-by: Justin Stephenson <jstephen@redhat.com>
 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
 ---
 Makefile.am                              | 1 +
 configure.ac                             | 1 +
 src/examples/{logrotate => logrotate.in} | 1 +
 3 files changed, 3 insertions(+)
 rename src/examples/{logrotate => logrotate.in} (90%)
 diff --git a/Makefile.am b/Makefile.am
 index f4cadee6f..82e0c5882 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -5706,6 +5706,7 @@ endif
 	rm -f $(builddir)/src/sysv/systemd/sssd-kcm.socket
 	rm -f $(builddir)/src/sysv/systemd/sssd-kcm.service
 	rm -f $(builddir)/src/tools/wrappers/sss_debuglevel
 +	rm -Rf $(builddir)/src/examples
 	rm -Rf $(builddir)/contrib
 CLEANFILES += *.X */*.X */*/*.X
 diff --git a/configure.ac b/configure.ac
 index 105d77a4d..380c16ba8 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -563,6 +563,7 @@ AC_DEFINE_UNQUOTED([ABS_SRC_DIR], ["$my_srcdir"], [Absolute path to the source d
 AC_CONFIG_FILES([Makefile contrib/sssd.spec src/examples/rwtab src/doxy.config
                  contrib/sssd-pcsc.rules contrib/90-sssd-token-access.rules
                  contrib/sssd-tmpfiles.conf
 +                 src/examples/logrotate
                  src/sysv/sssd src/sysv/gentoo/sssd src/sysv/gentoo/sssd-kcm
                  po/Makefile.in src/man/Makefile src/tests/cwrap/Makefile
                  src/tests/intg/Makefile src/tests/test_CA/Makefile
 diff --git a/src/examples/logrotate b/src/examples/logrotate.in
 similarity index 90%
 rename from src/examples/logrotate
 rename to src/examples/logrotate.in
 index 6e769451c..0421946a2 100644
 --- a/src/examples/logrotate
 +++ b/src/examples/logrotate.in
@@ -6,6 +6,7 @@
     rotate 2
     compress
     delaycompress
 +    su @SSSD_USER@ @SSSD_USER@
     postrotate
         /bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null || true
         /bin/pkill -HUP sssd_kcm 2> /dev/null || true
 -- 
 2.45.2
--- a/0002-TS_CACHE-never-try-to-upgrade-timestamps-cache.patch
+++ b/0002-TS_CACHE-never-try-to-upgrade-timestamps-cache.patch
@ -0,0 +1,207 @@
 From fc2a26c306e51b66680aef85aa0d2c41d8049a7f Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Tue, 16 Jul 2024 13:08:02 +0200
 Subject: [PATCH 2/3] TS_CACHE: never try to upgrade timestamps cache
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 It's easier and more consistent to recreate it instead.
 This is a natural extension of 3b67fc6488ac10ca13561d9032f59951f82203e6
 Reviewed-by: Alejandro López <allopez@redhat.com>
 Reviewed-by: Sumit Bose <sbose@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 ---
 src/db/sysdb_init.c    | 103 +----------------------------------------
 src/db/sysdb_upgrade.c |  45 ------------------
 2 files changed, 1 insertion(+), 147 deletions(-)
 diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
 index 85db5f9e1..ecf16fd11 100644
 --- a/src/db/sysdb_init.c
 +++ b/src/db/sysdb_init.c
@@ -348,57 +348,6 @@ static errno_t sysdb_cache_create_empty(struct ldb_context *ldb,
     return EOK;
 }
 -static errno_t sysdb_ts_cache_upgrade(TALLOC_CTX *mem_ctx,
 -                                      struct sysdb_ctx *sysdb,
 -                                      struct ldb_context *ldb,
 -                                      struct sss_domain_info *domain,
 -                                      const char *cur_version,
 -                                      const char **_new_version)
 -{
 -    errno_t ret;
 -    TALLOC_CTX *tmp_ctx;
 -    const char *version;
 -    struct ldb_context *save_ldb;
 -
 -    tmp_ctx = talloc_new(NULL);
 -    if (tmp_ctx == NULL) {
 -        return ENOMEM;
 -    }
 -
 -    /* The upgrade process depends on having ldb around, yet the upgrade
 -     * function shouldn't set the ldb pointer, only the connect function
 -     * should after it's successful. To avoid hard refactoring, save the
 -     * ldb pointer here and restore in the 'done' handler
 -     */
 -    save_ldb = sysdb->ldb;
 -    sysdb->ldb = ldb;
 -
 -    version = talloc_strdup(tmp_ctx, cur_version);
 -    if (version == NULL) {
 -        ret = ENOMEM;
 -        goto done;
 -    }
 -
 -    DEBUG(SSSDBG_CONF_SETTINGS,
 -          "Upgrading timstamp cache of DB [%s] from version: %s\n",
 -          domain->name, version);
 -
 -    if (strcmp(version, SYSDB_TS_VERSION_0_1) == 0) {
 -        ret = sysdb_ts_upgrade_01(sysdb, &version);
 -        if (ret != EOK) {
 -            goto done;
 -        }
 -    }
 -
 -    ret = EOK;
 -
 -done:
 -    sysdb->ldb = save_ldb;
 -    *_new_version = version;
 -    talloc_free(tmp_ctx);
 -    return ret;
 -}
 -
 static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
                                           struct sysdb_ctx *sysdb,
                                           struct sysdb_dom_upgrade_ctx *upgrade_ctx,
@@ -856,56 +805,6 @@ static int sysdb_timestamp_cache_connect(struct sysdb_ctx *sysdb,
     }
     ret = sysdb_ts_cache_connect(tmp_ctx, sysdb, domain, &ldb, &version);
 -    switch (ret) {
 -    case ERR_SYSDB_VERSION_TOO_OLD:
 -        if (upgrade_ctx == NULL) {
 -            DEBUG(SSSDBG_FATAL_FAILURE,
 -                  "DB version too old [%s], expected [%s] for domain %s!\n",
 -                   version, SYSDB_VERSION, domain->name);
 -            break;
 -        }
 -
 -        ret = sysdb_ts_cache_upgrade(tmp_ctx, sysdb, ldb, domain, version,
 -                                     &version);
 -        if (ret != EOK) {
 -            DEBUG(SSSDBG_MINOR_FAILURE,
 -                  "Could not upgrade the timestamp ldb file (%d) (%s)\n",
 -                  ret, sss_strerror(ret));
 -            break;
 -        }
 -
 -        /* The version should now match SYSDB_VERSION.
 -         * If not, it means we didn't match any of the
 -         * known older versions. The DB might be
 -         * corrupt or generated by a newer version of
 -         * SSSD.
 -         */
 -        ret = sysdb_version_check(SYSDB_TS_VERSION, version);
 -        if (ret == EOK) {
 -            /* The cache has been upgraded.
 -             * We need to reopen the LDB to ensure that
 -             * any changes made above take effect.
 -             */
 -            ret = sysdb_ldb_reconnect(tmp_ctx,
 -                                      sysdb->ldb_ts_file,
 -                                      LDB_FLG_NOSYNC,
 -                                      &ldb);
 -            if (ret != EOK) {
 -                DEBUG(SSSDBG_MINOR_FAILURE,
 -                      "Could not reopen the timestamp ldb file (%d) (%s)\n",
 -                      ret, sss_strerror(ret));
 -            }
 -        }
 -        break;
 -    case ERR_SYSDB_VERSION_TOO_NEW:
 -        DEBUG(SSSDBG_MINOR_FAILURE,
 -              "DB version too new [%s], expected [%s] for domain %s!\n",
 -              version, SYSDB_TS_VERSION, domain->name);
 -        break;
 -    default:
 -        break;
 -    }
 -
     if (ret != EOK) {
         DEBUG(SSSDBG_MINOR_FAILURE,
               "The timestamps cache could not be opened. "
@@ -925,7 +824,7 @@ static int sysdb_timestamp_cache_connect(struct sysdb_ctx *sysdb,
         ret = sysdb_ts_cache_connect(tmp_ctx, sysdb, domain, &ldb, &version);
         if (ret != EOK) {
             DEBUG(SSSDBG_MINOR_FAILURE,
 -                  "Could not delete the timestamp ldb file (%d) (%s)\n",
 +                  "sysdb_ts_cache_connect() failed after cache deletion [%d]: %s\n",
                   ret, sss_strerror(ret));
         }
     }
 diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
 index 8fb17c6bb..05142d972 100644
 --- a/src/db/sysdb_upgrade.c
 +++ b/src/db/sysdb_upgrade.c
@@ -2820,51 +2820,6 @@ done:
     return ret;
 }
 -int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver)
 -{
 -    struct upgrade_ctx *ctx;
 -    errno_t ret;
 -    struct ldb_message *msg = NULL;
 -
 -    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_TS_VERSION_0_2, &ctx);
 -    if (ret) {
 -        return ret;
 -    }
 -
 -    /* Remove @IDXONE from index */
 -    talloc_free(msg);
 -    msg = ldb_msg_new(ctx);
 -    if (msg == NULL) {
 -        ret = ENOMEM;
 -        goto done;
 -    }
 -
 -    msg->dn = ldb_dn_new(msg, sysdb->ldb, "@INDEXLIST");
 -    if (msg->dn == NULL) {
 -        ret = ENOMEM;
 -        goto done;
 -    }
 -
 -    ret = ldb_msg_add_empty(msg, "@IDXONE", LDB_FLAG_MOD_DELETE, NULL);
 -    if (ret != LDB_SUCCESS) {
 -        ret = ENOMEM;
 -        goto done;
 -    }
 -
 -    ret = ldb_modify(sysdb->ldb, msg);
 -    if (ret != LDB_SUCCESS) {
 -        ret = sysdb_error_to_errno(ret);
 -        goto done;
 -    }
 -
 -    /* conversion done, update version number */
 -    ret = update_version(ctx);
 -
 -done:
 -    ret = finish_upgrade(ret, &ctx, ver);
 -    return ret;
 -}
 -
 /*
  * Example template for future upgrades.
  * Copy and change version numbers as appropriate.
 -- 
 2.45.2
--- a/0003-SYSDB-remove-index-on-dataExpireTimestamp.patch
+++ b/0003-SYSDB-remove-index-on-dataExpireTimestamp.patch
@ -0,0 +1,146 @@
 From f0d45464cee1d2a6a2719dbffe5bbf6189d0554a Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Fri, 21 Jun 2024 19:09:29 +0200
 Subject: [PATCH 3/3] SYSDB: remove index on `dataExpireTimestamp`
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This index was only used in cleanup tasks that don't run often.
 On the other hand, this index is huge and degrades performance of libldb
 in general.
 Reviewed-by: Alejandro López <allopez@redhat.com>
 Reviewed-by: Sumit Bose <sbose@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 ---
 src/db/sysdb_init.c    |  8 ++++++++
 src/db/sysdb_private.h |  9 +++++----
 src/db/sysdb_upgrade.c | 27 +++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 4 deletions(-)
 diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
 index ecf16fd11..507a97f63 100644
 --- a/src/db/sysdb_init.c
 +++ b/src/db/sysdb_init.c
@@ -531,6 +531,13 @@ static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
         }
     }
 +    if (strcmp(version, SYSDB_VERSION_0_24) == 0) {
 +        ret = sysdb_upgrade_24(sysdb, &version);
 +        if (ret != EOK) {
 +            goto done;
 +        }
 +    }
 +
     ret = EOK;
 done:
     sysdb->ldb = save_ldb;
@@ -737,6 +744,7 @@ static int sysdb_domain_cache_connect(struct sysdb_ctx *sysdb,
         ret = sysdb_domain_cache_upgrade(tmp_ctx, sysdb, upgrade_ctx,
                                          ldb, domain, version, &version);
         if (ret != EOK) {
 +            DEBUG(SSSDBG_TRACE_FUNC, "sysdb_domain_cache_upgrade() failed\n");
             goto done;
         }
 diff --git a/src/db/sysdb_private.h b/src/db/sysdb_private.h
 index 2d7d6f62d..32d3f1c7e 100644
 --- a/src/db/sysdb_private.h
 +++ b/src/db/sysdb_private.h
@@ -23,6 +23,7 @@
 #ifndef __INT_SYS_DB_H__
 #define __INT_SYS_DB_H__
 +#define SYSDB_VERSION_0_25 "0.25"
 #define SYSDB_VERSION_0_24 "0.24"
 #define SYSDB_VERSION_0_23 "0.23"
 #define SYSDB_VERSION_0_22 "0.22"
@@ -48,7 +49,7 @@
 #define SYSDB_VERSION_0_2 "0.2"
 #define SYSDB_VERSION_0_1 "0.1"
 -#define SYSDB_VERSION SYSDB_VERSION_0_24
 +#define SYSDB_VERSION SYSDB_VERSION_0_25
 #define SYSDB_BASE_LDIF \
      "dn: @ATTRIBUTES\n" \
@@ -73,7 +74,6 @@
      "@IDXATTR: uidNumber\n" \
      "@IDXATTR: gidNumber\n" \
      "@IDXATTR: lastUpdate\n" \
 -     "@IDXATTR: dataExpireTimestamp\n" \
      "@IDXATTR: originalDN\n" \
      "@IDXATTR: nameAlias\n" \
      "@IDXATTR: servicePort\n" \
@@ -106,10 +106,11 @@
      "\n"
 /* The timestamp cache has its own versioning */
 +#define SYSDB_TS_VERSION_0_3 "0.3"
 #define SYSDB_TS_VERSION_0_2 "0.2"
 #define SYSDB_TS_VERSION_0_1 "0.1"
 -#define SYSDB_TS_VERSION SYSDB_TS_VERSION_0_2
 +#define SYSDB_TS_VERSION SYSDB_TS_VERSION_0_3
 #define SYSDB_TS_BASE_LDIF \
      "dn: @ATTRIBUTES\n" \
@@ -117,7 +118,6 @@
      "\n" \
      "dn: @INDEXLIST\n" \
      "@IDXATTR: lastUpdate\n" \
 -     "@IDXATTR: dataExpireTimestamp\n" \
      "\n" \
      "dn: cn=sysdb\n" \
      "cn: sysdb\n" \
@@ -196,6 +196,7 @@ int sysdb_upgrade_20(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_21(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_22(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver);
 +int sysdb_upgrade_24(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver);
 diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
 index 05142d972..c0c8e13ee 100644
 --- a/src/db/sysdb_upgrade.c
 +++ b/src/db/sysdb_upgrade.c
@@ -2820,6 +2820,33 @@ done:
     return ret;
 }
 +int sysdb_upgrade_24(struct sysdb_ctx *sysdb, const char **ver)
 +{
 +    struct upgrade_ctx *ctx;
 +    errno_t ret;
 +
 +    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_VERSION_0_25, &ctx);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    ret = sysdb_ldb_mod_index(sysdb, SYSDB_IDX_DELETE, sysdb->ldb, "dataExpireTimestamp");
 +    if (ret == ENOENT) { /*nothing to delete */
 +        ret = EOK;
 +    }
 +    if (ret != EOK) {
 +        DEBUG(SSSDBG_TRACE_FUNC, "sysdb_ldb_mod_index() failed [%d]: %s\n",
 +              ret, sss_strerror(ret));
 +        goto done;
 +    }
 +
 +    ret = update_version(ctx);
 +
 +done:
 +    ret = finish_upgrade(ret, &ctx, ver);
 +    return ret;
 +}
 +
 /*
  * Example template for future upgrades.
  * Copy and change version numbers as appropriate.
 -- 
 2.45.2
--- a/0004-SPEC-merge-sssd-polkit-rules-into-sssd-common.patch
+++ b/0004-SPEC-merge-sssd-polkit-rules-into-sssd-common.patch
@ -0,0 +1,70 @@
 From a7d0bbeb5a8a41e80fec91d7d38b5dcb35eebe8f Mon Sep 17 00:00:00 2001
 From: Alexey Tikhonov <atikhono@redhat.com>
 Date: Tue, 23 Jul 2024 18:07:09 +0200
 Subject: [PATCH] SPEC: merge 'sssd-polkit-rules' into 'sssd-common'
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 'p11_child' runs under non-privileged user and thus requires
 polkit-rules by default.
 Reviewed-by: Scott Poore <spoore@redhat.com>
 Reviewed-by: Sumit Bose <sbose@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 ---
 contrib/sssd.spec.in | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)
 diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
 index c65be0d27..4edabce56 100644
 --- a/contrib/sssd.spec.in
 +++ b/contrib/sssd.spec.in
@@ -210,6 +210,9 @@ License: GPL-3.0-or-later
 Obsoletes: libsss_simpleifp < 2.9.0
 Obsoletes: libsss_simpleifp-debuginfo < 2.9.0
 %endif
 +%if %{use_sssd_user}
 +Obsoletes: sssd-polkit-rules < 2.10.0
 +%endif
 # Requires
 # due to ABI changes in 1.1.30/1.2.0
 Requires: libldb >= %{ldb_version}
@@ -470,19 +473,6 @@ Requires: sssd-common = %{version}-%{release}
 Provides the D-Bus responder of the SSSD, called the InfoPipe, that allows
 the information from the SSSD to be transmitted over the system bus.
 -%if %{use_sssd_user}
 -%package polkit-rules
 -Summary: Rules for polkit integration for SSSD
 -Group: Applications/System
 -License: GPL-3.0-or-later
 -Requires: polkit >= 0.106
 -Requires: sssd-common = %{version}-%{release}
 -
 -%description polkit-rules
 -Provides rules for polkit integration with SSSD. This is required
 -for smartcard support.
 -%endif
 -
 %if 0%{?rhel} == 9
 %package -n libsss_simpleifp
 Summary: The SSSD D-Bus responder helper library
@@ -885,13 +875,11 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
 %if %{use_sysusers}
 %{_sysusersdir}/sssd.conf
 %endif
 -
 -
 %if %{use_sssd_user}
 -%files polkit-rules
 %{_datadir}/polkit-1/rules.d/*
 %endif
 +
 %files ldap -f sssd_ldap.lang
 %license COPYING
 %{_libdir}/%{name}/libsss_ldap.so
 -- 
 2.45.2
--- a/SOURCES/0001-sssd-adding-mail-as-case-insensitive.patch
+++ b/SOURCES/0001-sssd-adding-mail-as-case-insensitive.patch
@ -1,144 +0,0 @@
 From dd0f63246aa75d5f53b44cbc185e88833e79976e Mon Sep 17 00:00:00 2001
 From: Andre Boscatto <andreboscatto@gmail.com>
 Date: Wed, 7 Feb 2024 12:28:28 +0100
 Subject: [PATCH] sssd: adding mail as case insensitive
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Resolves: https://github.com/SSSD/sssd/issues/7173
 Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 (cherry picked from commit 945cebcf72ef53ea0368f19c09e710f7fff11b51)
 ---
 src/db/sysdb_init.c    |  7 ++++++
 src/db/sysdb_private.h |  5 +++-
 src/db/sysdb_upgrade.c | 56 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+), 1 deletion(-)
 diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
 index c2ea6c369..38a9cd64a 100644
 --- a/src/db/sysdb_init.c
 +++ b/src/db/sysdb_init.c
@@ -603,6 +603,13 @@ static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
         }
     }
 +    if (strcmp(version, SYSDB_VERSION_0_23) == 0) {
 +        ret = sysdb_upgrade_23(sysdb, &version);
 +        if (ret != EOK) {
 +            goto done;
 +        }
 +    }
 +
     ret = EOK;
 done:
     sysdb->ldb = save_ldb;
 diff --git a/src/db/sysdb_private.h b/src/db/sysdb_private.h
 index 1f55007bc..63f7b5601 100644
 --- a/src/db/sysdb_private.h
 +++ b/src/db/sysdb_private.h
@@ -23,6 +23,7 @@
 #ifndef __INT_SYS_DB_H__
 #define __INT_SYS_DB_H__
 +#define SYSDB_VERSION_0_24 "0.24"
 #define SYSDB_VERSION_0_23 "0.23"
 #define SYSDB_VERSION_0_22 "0.22"
 #define SYSDB_VERSION_0_21 "0.21"
@@ -47,7 +48,7 @@
 #define SYSDB_VERSION_0_2 "0.2"
 #define SYSDB_VERSION_0_1 "0.1"
 -#define SYSDB_VERSION SYSDB_VERSION_0_23
 +#define SYSDB_VERSION SYSDB_VERSION_0_24
 #define SYSDB_BASE_LDIF \
      "dn: @ATTRIBUTES\n" \
@@ -60,6 +61,7 @@
      "objectclass: CASE_INSENSITIVE\n" \
      "ipHostNumber: CASE_INSENSITIVE\n" \
      "ipNetworkNumber: CASE_INSENSITIVE\n" \
 +     "mail: CASE_INSENSITIVE\n" \
      "\n" \
      "dn: @INDEXLIST\n" \
      "@IDXATTR: cn\n" \
@@ -191,6 +193,7 @@ int sysdb_upgrade_19(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_20(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_21(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_upgrade_22(struct sysdb_ctx *sysdb, const char **ver);
 +int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver);
 int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver);
 diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
 index 346a1cb0b..56083e6be 100644
 --- a/src/db/sysdb_upgrade.c
 +++ b/src/db/sysdb_upgrade.c
@@ -2718,6 +2718,62 @@ done:
     return ret;
 }
 +int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver)
 +{
 +    TALLOC_CTX *tmp_ctx;
 +    int ret;
 +    struct ldb_message *msg;
 +    struct upgrade_ctx *ctx;
 +
 +    tmp_ctx = talloc_new(NULL);
 +    if (!tmp_ctx) {
 +        return ENOMEM;
 +    }
 +
 +    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_VERSION_0_24, &ctx);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    /* Add new indexes */
 +    msg = ldb_msg_new(tmp_ctx);
 +    if (!msg) {
 +        ret = ENOMEM;
 +        goto done;
 +    }
 +    msg->dn = ldb_dn_new(tmp_ctx, sysdb->ldb, "@ATTRIBUTES");
 +    if (!msg->dn) {
 +        ret = ENOMEM;
 +        goto done;
 +    }
 +
 +    /* Case insensitive search for mail */
 +    ret = ldb_msg_add_empty(msg, SYSDB_USER_EMAIL, LDB_FLAG_MOD_ADD, NULL);
 +    if (ret != LDB_SUCCESS) {
 +        ret = ENOMEM;
 +        goto done;
 +    }
 +    ret = ldb_msg_add_string(msg, SYSDB_USER_EMAIL, "CASE_INSENSITIVE");
 +    if (ret != LDB_SUCCESS) {
 +        ret = ENOMEM;
 +        goto done;
 +    }
 +
 +    ret = ldb_modify(sysdb->ldb, msg);
 +    if (ret != LDB_SUCCESS) {
 +        ret = sysdb_error_to_errno(ret);
 +        goto done;
 +    }
 +
 +    /* conversion done, update version number */
 +    ret = update_version(ctx);
 +
 +done:
 +    ret = finish_upgrade(ret, &ctx, ver);
 +    talloc_free(tmp_ctx);
 +    return ret;
 +}
 +
 int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver)
 {
     struct upgrade_ctx *ctx;
 -- 
 2.41.0
--- a/SOURCES/0002-sdap-add-search_bases-option-to-groups_by_user_send.patch
+++ b/SOURCES/0002-sdap-add-search_bases-option-to-groups_by_user_send.patch
@ -1,154 +0,0 @@
 From a7621a5b464af7a3c8409dcbde038b35fee2c895 Mon Sep 17 00:00:00 2001
 From: Sumit Bose <sbose@redhat.com>
 Date: Tue, 23 Jan 2024 13:47:53 +0100
 Subject: [PATCH 2/3] sdap: add search_bases option to groups_by_user_send()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 AD handles users and computer objects very similar and so does SSSD's
 GPO code when lookup up the host's group-memberships. But users and
 computers might be stored in different sub-tree of the AD LDAP tree and
 if a dedicated user search base is given with the ldap_user_search_base
 option in sssd.conf the host object might be in a different sub-tree. To
 make sure the host can still be found this patch uses the base DN of
 the LDAP tree when searching for hosts in the GPO code.
 Resolves: https://github.com/SSSD/sssd/issues/5708
 Reviewed-by: Alejandro López <allopez@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 (cherry picked from commit 29a77c6e79020d7e8cb474b4d3b394d390eba196)
 ---
 src/providers/ad/ad_gpo.c                  | 10 ++++++++++
 src/providers/ldap/ldap_common.h           |  1 +
 src/providers/ldap/ldap_id.c               |  6 +++++-
 src/providers/ldap/sdap_async.h            |  1 +
 src/providers/ldap/sdap_async_initgroups.c |  4 +++-
 5 files changed, 20 insertions(+), 2 deletions(-)
 diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
 index 94959c36b..b0ee3e616 100644
 --- a/src/providers/ad/ad_gpo.c
 +++ b/src/providers/ad/ad_gpo.c
@@ -2091,6 +2091,7 @@ ad_gpo_connect_done(struct tevent_req *subreq)
     char *server_uri;
     LDAPURLDesc *lud;
     struct sdap_domain *sdom;
 +    struct sdap_search_base **search_bases;
     req = tevent_req_callback_data(subreq, struct tevent_req);
     state = tevent_req_data(req, struct ad_gpo_access_state);
@@ -2184,9 +2185,18 @@ ad_gpo_connect_done(struct tevent_req *subreq)
         goto done;
     }
 +    ret = common_parse_search_base(state, sdom->basedn, state->ldb_ctx,
 +                                   "AD_HOSTS", NULL, &search_bases);
 +    if (ret != EOK) {
 +        DEBUG(SSSDBG_OP_FAILURE,
 +              "Failed to create dedicated search base for host lookups, "
 +              "trying with user search base.");
 +    }
 +
     subreq = groups_by_user_send(state, state->ev,
                                  state->access_ctx->ad_id_ctx->sdap_id_ctx,
                                  sdom, state->conn,
 +                                 search_bases,
                                  state->host_fqdn,
                                  BE_FILTER_NAME,
                                  NULL,
 diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
 index 7159d6356..2c984ef50 100644
 --- a/src/providers/ldap/ldap_common.h
 +++ b/src/providers/ldap/ldap_common.h
@@ -304,6 +304,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        struct sdap_id_ctx *ctx,
                                        struct sdap_domain *sdom,
                                        struct sdap_id_conn_ctx *conn,
 +                                       struct sdap_search_base **search_bases,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
 diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
 index da54816bd..b3ea2333f 100644
 --- a/src/providers/ldap/ldap_id.c
 +++ b/src/providers/ldap/ldap_id.c
@@ -1139,6 +1139,7 @@ struct groups_by_user_state {
     struct sdap_id_op *op;
     struct sysdb_ctx *sysdb;
     struct sss_domain_info *domain;
 +    struct sdap_search_base **search_bases;
     const char *filter_value;
     int filter_type;
@@ -1160,6 +1161,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
                                        struct sdap_id_ctx *ctx,
                                        struct sdap_domain *sdom,
                                        struct sdap_id_conn_ctx *conn,
 +                                       struct sdap_search_base **search_bases,
                                        const char *filter_value,
                                        int filter_type,
                                        const char *extra_value,
@@ -1192,6 +1194,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
     state->extra_value = extra_value;
     state->domain = sdom->dom;
     state->sysdb = sdom->dom->sysdb;
 +    state->search_bases = search_bases;
     if (state->domain->type == DOM_TYPE_APPLICATION || set_non_posix) {
         state->non_posix = true;
@@ -1254,6 +1257,7 @@ static void groups_by_user_connect_done(struct tevent_req *subreq)
                                   sdap_id_op_handle(state->op),
                                   state->ctx,
                                   state->conn,
 +                                  state->search_bases,
                                   state->filter_value,
                                   state->filter_type,
                                   state->extra_value,
@@ -1449,7 +1453,7 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
         }
         subreq = groups_by_user_send(state, be_ctx->ev, id_ctx,
 -                                     sdom, conn,
 +                                     sdom, conn, NULL,
                                      ar->filter_value,
                                      ar->filter_type,
                                      ar->extra_value,
 diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
 index 5458d21f1..89245f41f 100644
 --- a/src/providers/ldap/sdap_async.h
 +++ b/src/providers/ldap/sdap_async.h
@@ -158,6 +158,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
 +                                        struct sdap_search_base **search_bases,
                                         const char *name,
                                         int filter_type,
                                         const char *extra_value,
 diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
 index 97be594a3..fb3d8fe24 100644
 --- a/src/providers/ldap/sdap_async_initgroups.c
 +++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -2732,6 +2732,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
                                         struct sdap_handle *sh,
                                         struct sdap_id_ctx *id_ctx,
                                         struct sdap_id_conn_ctx *conn,
 +                                        struct sdap_search_base **search_bases,
                                         const char *filter_value,
                                         int filter_type,
                                         const char *extra_value,
@@ -2764,7 +2765,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
     state->orig_user = NULL;
     state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
     state->user_base_iter = 0;
 -    state->user_search_bases = sdom->user_search_bases;
 +    state->user_search_bases = (search_bases == NULL) ? sdom->user_search_bases
 +                                                      : search_bases;
     if (!state->user_search_bases) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Initgroups lookup request without a user search base\n");
 -- 
 2.41.0
--- a/SOURCES/0003-sdap-add-naming_context-as-new-member-of-struct-sdap.patch
+++ b/SOURCES/0003-sdap-add-naming_context-as-new-member-of-struct-sdap.patch
@ -1,194 +0,0 @@
 From 6a8e60df84d5d2565bec36be19c2def25a6ece1f Mon Sep 17 00:00:00 2001
 From: Sumit Bose <sbose@redhat.com>
 Date: Wed, 24 Jan 2024 14:21:12 +0100
 Subject: [PATCH 3/3] sdap: add naming_context as new member of struct
 sdap_domain
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The naming_context could be a more reliable source than basedn for the
 actual base DN because basedn is set very early from the domain name
 given in sssd.conf. Although it is recommended to use the fully
 qualified DNS domain name here it is not required. As a result basedn
 might not reflect the actual based DN of the LDAP server. Also pure LDAP
 server (i.e. not AD or FreeIPA) might use different schemes to set the
 base DN which will not be based on the DNS domain of the LDAP server.
 Resolves: https://github.com/SSSD/sssd/issues/5708
 Reviewed-by: Alejandro López <allopez@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 (cherry picked from commit a153f13f296401247a862df2b99048bb1bbb8e2e)
 ---
 src/providers/ad/ad_gpo.c |  6 ++++--
 src/providers/ldap/sdap.c | 36 +++++++++++++-----------------------
 src/providers/ldap/sdap.h | 11 +++++++++++
 3 files changed, 28 insertions(+), 25 deletions(-)
 diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
 index b0ee3e616..3d1ad39c7 100644
 --- a/src/providers/ad/ad_gpo.c
 +++ b/src/providers/ad/ad_gpo.c
@@ -2185,8 +2185,10 @@ ad_gpo_connect_done(struct tevent_req *subreq)
         goto done;
     }
 -    ret = common_parse_search_base(state, sdom->basedn, state->ldb_ctx,
 -                                   "AD_HOSTS", NULL, &search_bases);
 +    ret = common_parse_search_base(state,
 +                                   sdom->naming_context == NULL ? sdom->basedn
 +                                                                : sdom->naming_context,
 +                                   state->ldb_ctx, "AD_HOSTS", NULL, &search_bases);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
               "Failed to create dedicated search base for host lookups, "
 diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
 index f5637c5fb..956eba93a 100644
 --- a/src/providers/ldap/sdap.c
 +++ b/src/providers/ldap/sdap.c
@@ -1252,19 +1252,10 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
                                              struct sdap_domain *sdom)
 {
     int ret;
 -    char *naming_context = NULL;
 -    if (!sdom->search_bases
 -            || !sdom->user_search_bases
 -            || !sdom->group_search_bases
 -            || !sdom->netgroup_search_bases
 -            || !sdom->host_search_bases
 -            || !sdom->sudo_search_bases
 -            || !sdom->iphost_search_bases
 -            || !sdom->ipnetwork_search_bases
 -            || !sdom->autofs_search_bases) {
 -        naming_context = get_naming_context(opts->basic, rootdse);
 -        if (naming_context == NULL) {
 +    if (!sdom->naming_context) {
 +        sdom->naming_context = get_naming_context(sdom, rootdse);
 +        if (sdom->naming_context == NULL) {
             DEBUG(SSSDBG_CRIT_FAILURE, "get_naming_context failed.\n");
             /* This has to be non-fatal, since some servers offer
@@ -1280,7 +1271,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1288,7 +1279,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->user_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_USER_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1296,7 +1287,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->group_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_GROUP_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1304,7 +1295,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->netgroup_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_NETGROUP_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1312,7 +1303,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->host_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_HOST_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1320,7 +1311,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->sudo_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                    SDAP_SUDO_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1328,7 +1319,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->service_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                   SDAP_SERVICE_SEARCH_BASE,
 -                                  naming_context);
 +                                  sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1336,7 +1327,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->autofs_search_bases) {
        ret = sdap_set_search_base(opts, sdom,
                                   SDAP_AUTOFS_SEARCH_BASE,
 -                                  naming_context);
 +                                  sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1344,7 +1335,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->iphost_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_IPHOST_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
@@ -1352,14 +1343,13 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
     if (!sdom->ipnetwork_search_bases) {
         ret = sdap_set_search_base(opts, sdom,
                                    SDAP_IPNETWORK_SEARCH_BASE,
 -                                   naming_context);
 +                                   sdom->naming_context);
         if (ret != EOK) goto done;
     }
     ret = EOK;
 done:
 -    talloc_free(naming_context);
     return ret;
 }
 diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
 index 161bc5c26..103d50ed4 100644
 --- a/src/providers/ldap/sdap.h
 +++ b/src/providers/ldap/sdap.h
@@ -454,6 +454,17 @@ struct sdap_domain {
     char *basedn;
 +    /* The naming_context could be a more reliable source than basedn for the
 +     * actual base DN because basedn is set very early from the domain name
 +     * given in sssd.conf. Although it is recommended to use the fully
 +     * qualified DNS domain name here it is not required. As a result basedn
 +     * might not reflect the actual based DN of the LDAP server. Also pure
 +     * LDAP server (i.e. not AD or FreeIPA) might use different schemes to set
 +     * the base DN which will not be based on the DNS domain of the LDAP
 +     * server. naming_context might be NULL even after connection to an LDAP
 +     * server. */
 +    char *naming_context;
 +
     struct sdap_search_base **search_bases;
     struct sdap_search_base **user_search_bases;
     struct sdap_search_base **group_search_bases;
 -- 
 2.41.0
--- a/SOURCES/0004-pam-fix-SC-auth-with-multiple-certs-and-missing-logi.patch
+++ b/SOURCES/0004-pam-fix-SC-auth-with-multiple-certs-and-missing-logi.patch
@ -1,233 +0,0 @@
 From 50077c3255177fe1b01837fbe31a7f8fd47dee74 Mon Sep 17 00:00:00 2001
 From: Sumit Bose <sbose@redhat.com>
 Date: Thu, 18 Jan 2024 13:08:17 +0100
 Subject: [PATCH] pam: fix SC auth with multiple certs and missing login name
 While introducing the local_auth_policy option a quite specific use-case
 was not covered correctly. If there are multiple matching certificates
 on the Smartcard, 'local_auth_policy = only' is set and GDM's Smartcard
 mode was used for login, i.e. there is no user name given and the user
 has to be derived from the certificate used for login, authentication
 failed. The main reason for the failure is that in this case the
 Smartcard interaction and the user mapping has to be done first to
 determine the user before local_auth_policy is evaluated. As a result
 when checking if the authentication can be finished the request was in
 an unexpected state because the indicator for local Smartcard
 authentication was not enabled.
 Resolves: https://github.com/SSSD/sssd/issues/7109
 Reviewed-by: Justin Stephenson <jstephen@redhat.com>
 Reviewed-by: Scott Poore <spoore@redhat.com>
 (cherry picked from commit 44ec3e4638b0c6f7f45a3390a28c2e8745d52bc3)
 ---
 src/responder/pam/pamsrv.h           | 10 ++++
 src/responder/pam/pamsrv_cmd.c       | 17 +++++--
 src/tests/intg/Makefile.am           |  2 +
 src/tests/intg/test_pam_responder.py | 74 +++++++++++++++++++++++++++-
 4 files changed, 96 insertions(+), 7 deletions(-)
 diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h
 index 7013a8edd..618836189 100644
 --- a/src/responder/pam/pamsrv.h
 +++ b/src/responder/pam/pamsrv.h
@@ -93,7 +93,17 @@ struct pam_auth_req {
     struct ldb_message *user_obj;
     struct cert_auth_info *cert_list;
     struct cert_auth_info *current_cert;
 +    /* Switched to 'true' if the backend indicates that it cannot handle
 +     * Smartcard authentication, but Smartcard authentication is
 +     * possible and local Smartcard authentication is allowed. */
     bool cert_auth_local;
 +    /* Switched to 'true' if authentication (not pre-authentication) was
 +     * started without a login name and the name had to be lookup up with the
 +     * certificate used for authentication. Since reading the certificate from
 +     * the Smartcard already involves the PIN validation in this case there
 +     * would be no need for an additional Smartcard interaction if only local
 +     * Smartcard authentication is possible. */
 +    bool initial_cert_auth_successful;
     bool passkey_data_exists;
     uint32_t client_id_num;
 diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
 index c23ea7ba4..a7c181733 100644
 --- a/src/responder/pam/pamsrv_cmd.c
 +++ b/src/responder/pam/pamsrv_cmd.c
@@ -2200,8 +2200,8 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
                 ret = ENOENT;
                 goto done;
             }
 -
 -            if (cert_count > 1) {
 +            /* Multiple certificates are only expected during pre-auth */
 +            if (cert_count > 1 && preq->pd->cmd == SSS_PAM_PREAUTH) {
                 for (preq->current_cert = preq->cert_list;
                      preq->current_cert != NULL;
                      preq->current_cert = sss_cai_get_next(preq->current_cert)) {
@@ -2285,7 +2285,9 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
             }
             /* If logon_name was not given during authentication add a
 -             * SSS_PAM_CERT_INFO message to send the name to the caller. */
 +             * SSS_PAM_CERT_INFO message to send the name to the caller.
 +             * Additionally initial_cert_auth_successful is set to
 +             * indicate that the user is already authenticated. */
             if (preq->pd->cmd == SSS_PAM_AUTHENTICATE
                     && preq->pd->logon_name == NULL) {
                 ret = add_pam_cert_response(preq->pd,
@@ -2297,6 +2299,8 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
                     preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL;
                     goto done;
                 }
 +
 +                preq->initial_cert_auth_successful = true;
             }
             /* cert_user will be returned to the PAM client as user name, so
@@ -2851,12 +2855,15 @@ static void pam_dom_forwarder(struct pam_auth_req *preq)
         if (found) {
             if (local_policy != NULL && strcasecmp(local_policy, "only") == 0) {
                 talloc_free(tmp_ctx);
 -                DEBUG(SSSDBG_IMPORTANT_INFO, "Local auth only set, skipping online auth\n");
 +                DEBUG(SSSDBG_IMPORTANT_INFO,
 +                      "Local auth only set and matching certificate was found, "
 +                      "skipping online auth\n");
                 if (preq->pd->cmd == SSS_PAM_PREAUTH) {
                     preq->pd->pam_status = PAM_SUCCESS;
                 } else if (preq->pd->cmd == SSS_PAM_AUTHENTICATE
                                 && IS_SC_AUTHTOK(preq->pd->authtok)
 -                                && preq->cert_auth_local) {
 +                                && (preq->cert_auth_local
 +                                        || preq->initial_cert_auth_successful)) {
                     preq->pd->pam_status = PAM_SUCCESS;
                     preq->callback = pam_reply;
                 }
 diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
 index 3866d3ca6..0cfd268dc 100644
 --- a/src/tests/intg/Makefile.am
 +++ b/src/tests/intg/Makefile.am
@@ -199,6 +199,7 @@ clean-local:
 PAM_CERT_DB_PATH="$(abs_builddir)/../test_CA/SSSD_test_CA.pem"
 SOFTHSM2_CONF="$(abs_builddir)/../test_CA/softhsm2_one.conf"
 +SOFTHSM2_TWO_CONF="$(abs_builddir)/../test_CA/softhsm2_two.conf"
 intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service pam_sss_sc_required pam_sss_try_sc pam_sss_allow_missing_name pam_sss_domains sss_netgroup_thread_test
 	pipepath="$(DESTDIR)$(pipepath)"; \
@@ -233,6 +234,7 @@ intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service
 	PAM_CERT_DB_PATH=$(PAM_CERT_DB_PATH) \
 	ABS_SRCDIR=$(abs_srcdir) \
 	SOFTHSM2_CONF=$(SOFTHSM2_CONF) \
 +	SOFTHSM2_TWO_CONF=$(SOFTHSM2_TWO_CONF) \
 	KCM_RENEW=$(KCM_RENEW) \
 	FILES_PROVIDER=$(FILES_PROVIDER) \
 	DBUS_SOCK_DIR="$(DESTDIR)$(runstatedir)/dbus/" \
 diff --git a/src/tests/intg/test_pam_responder.py b/src/tests/intg/test_pam_responder.py
 index 1fc3937e6..0fbf8065e 100644
 --- a/src/tests/intg/test_pam_responder.py
 +++ b/src/tests/intg/test_pam_responder.py
@@ -168,7 +168,7 @@ def format_pam_cert_auth_conf(config, provider):
         {provider.p}
         [certmap/auth_only/user1]
 -        matchrule = <SUBJECT>.*CN=SSSD test cert 0001.*
 +        matchrule = <SUBJECT>.*CN=SSSD test cert 000[12].*
     """).format(**locals())
@@ -201,7 +201,7 @@ def format_pam_cert_auth_conf_name_format(config, provider):
         {provider.p}
         [certmap/auth_only/user1]
 -        matchrule = <SUBJECT>.*CN=SSSD test cert 0001.*
 +        matchrule = <SUBJECT>.*CN=SSSD test cert 000[12].*
     """).format(**locals())
@@ -380,6 +380,28 @@ def simple_pam_cert_auth_no_cert(request, passwd_ops_setup):
     return None
 +@pytest.fixture
 +def simple_pam_cert_auth_two_certs(request, passwd_ops_setup):
 +    """Setup SSSD with pam_cert_auth=True"""
 +    config.PAM_CERT_DB_PATH = os.environ['PAM_CERT_DB_PATH']
 +
 +    old_softhsm2_conf = os.environ['SOFTHSM2_CONF']
 +    softhsm2_two_conf = os.environ['SOFTHSM2_TWO_CONF']
 +    os.environ['SOFTHSM2_CONF'] = softhsm2_two_conf
 +
 +    conf = format_pam_cert_auth_conf(config, provider_switch(request.param))
 +    create_conf_fixture(request, conf)
 +    create_sssd_fixture(request)
 +
 +    os.environ['SOFTHSM2_CONF'] = old_softhsm2_conf
 +
 +    passwd_ops_setup.useradd(**USER1)
 +    passwd_ops_setup.useradd(**USER2)
 +    sync_files_provider(USER2['name'])
 +
 +    return None
 +
 +
 @pytest.fixture
 def simple_pam_cert_auth_name_format(request, passwd_ops_setup):
     """Setup SSSD with pam_cert_auth=True and full_name_format"""
@@ -522,6 +544,54 @@ def test_sc_auth(simple_pam_cert_auth, env_for_sssctl):
     assert err.find("pam_authenticate for user [user1]: Success") != -1
 +@pytest.mark.parametrize('simple_pam_cert_auth_two_certs', provider_list(), indirect=True)
 +def test_sc_auth_two(simple_pam_cert_auth_two_certs, env_for_sssctl):
 +
 +    sssctl = subprocess.Popen(["sssctl", "user-checks", "user1",
 +                               "--action=auth", "--service=pam_sss_service"],
 +                              universal_newlines=True,
 +                              env=env_for_sssctl, stdin=subprocess.PIPE,
 +                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 +
 +    try:
 +        out, err = sssctl.communicate(input="2\n123456")
 +    except Exception:
 +        sssctl.kill()
 +        out, err = sssctl.communicate()
 +
 +    sssctl.stdin.close()
 +    sssctl.stdout.close()
 +
 +    if sssctl.wait() != 0:
 +        raise Exception("sssctl failed")
 +
 +    assert err.find("pam_authenticate for user [user1]: Success") != -1
 +
 +
 +@pytest.mark.parametrize('simple_pam_cert_auth_two_certs', provider_list(), indirect=True)
 +def test_sc_auth_two_missing_name(simple_pam_cert_auth_two_certs, env_for_sssctl):
 +
 +    sssctl = subprocess.Popen(["sssctl", "user-checks", "",
 +                               "--action=auth", "--service=pam_sss_allow_missing_name"],
 +                              universal_newlines=True,
 +                              env=env_for_sssctl, stdin=subprocess.PIPE,
 +                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 +
 +    try:
 +        out, err = sssctl.communicate(input="2\n123456")
 +    except Exception:
 +        sssctl.kill()
 +        out, err = sssctl.communicate()
 +
 +    sssctl.stdin.close()
 +    sssctl.stdout.close()
 +
 +    if sssctl.wait() != 0:
 +        raise Exception("sssctl failed")
 +
 +    assert err.find("pam_authenticate for user [user1]: Success") != -1
 +
 +
 @pytest.mark.parametrize('simple_pam_cert_auth', ['proxy_password'], indirect=True)
 def test_sc_proxy_password_fallback(simple_pam_cert_auth, env_for_sssctl):
     """
 -- 
 2.41.0
--- a/SOURCES/0005-ad-gpo-use-hash-to-store-intermediate-results.patch
+++ b/SOURCES/0005-ad-gpo-use-hash-to-store-intermediate-results.patch
@ -1,218 +0,0 @@
 From e1bfbc2493c4194988acc3b2413df3dde0735ae3 Mon Sep 17 00:00:00 2001
 From: Sumit Bose <sbose@redhat.com>
 Date: Wed, 8 Nov 2023 14:50:24 +0100
 Subject: [PATCH] ad-gpo: use hash to store intermediate results
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Currently after the evaluation of a single GPO file the intermediate
 results are stored in the cache and this cache entry is updated until
 all applicable GPO files are evaluated. Finally the data in the cache is
 used to make the decision of access is granted or rejected.
 If there are two or more access-control request running in parallel one
 request might overwrite the cache object with intermediate data while
 another request reads the cached data for the access decision and as a
 result will do this decision based on intermediate data.
 To avoid this the intermediate results are not stored in the cache
 anymore but in hash tables which are specific to the request. Only the
 final result is written to the cache to have it available for offline
 authentication.
 Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 (cherry picked from commit d7db7971682da2dbf7642ac94940d6b0577ec35a)
 ---
 src/providers/ad/ad_gpo.c | 116 +++++++++++++++++++++++++++++++++-----
 1 file changed, 102 insertions(+), 14 deletions(-)
 diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
 index 3d1ad39c7..b879b0a08 100644
 --- a/src/providers/ad/ad_gpo.c
 +++ b/src/providers/ad/ad_gpo.c
@@ -1431,6 +1431,33 @@ ad_gpo_extract_policy_setting(TALLOC_CTX *mem_ctx,
     return ret;
 }
 +static errno_t
 +add_result_to_hash(hash_table_t *hash, const char *key, char *value)
 +{
 +    int hret;
 +    hash_key_t k;
 +    hash_value_t v;
 +
 +    if (hash == NULL || key == NULL || value == NULL) {
 +        return EINVAL;
 +    }
 +
 +    k.type = HASH_KEY_CONST_STRING;
 +    k.c_str = key;
 +
 +    v.type = HASH_VALUE_PTR;
 +    v.ptr = value;
 +
 +    hret = hash_enter(hash, &k, &v);
 +    if (hret != HASH_SUCCESS) {
 +        DEBUG(SSSDBG_OP_FAILURE, "Failed to add [%s][%s] to hash: [%s].\n",
 +                                 key, value, hash_error_string(hret));
 +        return EIO;
 +    }
 +
 +    return EOK;
 +}
 +
 /*
  * This function parses the cse-specific (GP_EXT_GUID_SECURITY) filename,
  * and stores the allow_key and deny_key of all of the gpo_map_types present
@@ -1438,6 +1465,7 @@ ad_gpo_extract_policy_setting(TALLOC_CTX *mem_ctx,
  */
 static errno_t
 ad_gpo_store_policy_settings(struct sss_domain_info *domain,
 +                             hash_table_t *allow_maps, hash_table_t *deny_maps,
                              const char *filename)
 {
     struct ini_cfgfile *file_ctx = NULL;
@@ -1571,14 +1599,14 @@ ad_gpo_store_policy_settings(struct sss_domain_info *domain,
                 goto done;
             } else if (ret != ENOENT) {
                 const char *value = allow_value ? allow_value : empty_val;
 -                ret = sysdb_gpo_store_gpo_result_setting(domain,
 -                                                         allow_key,
 -                                                         value);
 +                ret = add_result_to_hash(allow_maps, allow_key,
 +                                         talloc_strdup(allow_maps, value));
                 if (ret != EOK) {
 -                    DEBUG(SSSDBG_CRIT_FAILURE,
 -                          "sysdb_gpo_store_gpo_result_setting failed for key:"
 -                          "'%s' value:'%s' [%d][%s]\n", allow_key, allow_value,
 -                          ret, sss_strerror(ret));
 +                    DEBUG(SSSDBG_CRIT_FAILURE, "Failed to add key: [%s] "
 +                                               "value: [%s] to allow maps "
 +                                               "[%d][%s].\n",
 +                                               allow_key, value, ret,
 +                                               sss_strerror(ret));
                     goto done;
                 }
             }
@@ -1598,14 +1626,14 @@ ad_gpo_store_policy_settings(struct sss_domain_info *domain,
                 goto done;
             } else if (ret != ENOENT) {
                 const char *value = deny_value ? deny_value : empty_val;
 -                ret = sysdb_gpo_store_gpo_result_setting(domain,
 -                                                         deny_key,
 -                                                         value);
 +                ret = add_result_to_hash(deny_maps, deny_key,
 +                                         talloc_strdup(deny_maps, value));
                 if (ret != EOK) {
 -                    DEBUG(SSSDBG_CRIT_FAILURE,
 -                          "sysdb_gpo_store_gpo_result_setting failed for key:"
 -                          "'%s' value:'%s' [%d][%s]\n", deny_key, deny_value,
 -                          ret, sss_strerror(ret));
 +                    DEBUG(SSSDBG_CRIT_FAILURE, "Failed to add key: [%s] "
 +                                               "value: [%s] to deny maps "
 +                                               "[%d][%s].\n",
 +                                               deny_key, value, ret,
 +                                               sss_strerror(ret));
                     goto done;
                 }
             }
@@ -1902,6 +1930,8 @@ struct ad_gpo_access_state {
     int num_cse_filtered_gpos;
     int cse_gpo_index;
     const char *ad_domain;
 +    hash_table_t *allow_maps;
 +    hash_table_t *deny_maps;
 };
 static void ad_gpo_connect_done(struct tevent_req *subreq);
@@ -2023,6 +2053,19 @@ ad_gpo_access_send(TALLOC_CTX *mem_ctx,
         goto immediately;
     }
 +    ret = sss_hash_create(state, 0, &state->allow_maps);
 +    if (ret != EOK) {
 +        DEBUG(SSSDBG_FATAL_FAILURE, "Could not create allow maps "
 +              "hash table [%d]: %s\n", ret, sss_strerror(ret));
 +        goto immediately;
 +    }
 +
 +    ret = sss_hash_create(state, 0, &state->deny_maps);
 +    if (ret != EOK) {
 +        DEBUG(SSSDBG_FATAL_FAILURE, "Could not create deny maps "
 +              "hash table [%d]: %s\n", ret, sss_strerror(ret));
 +        goto immediately;
 +    }
     subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
     if (subreq == NULL) {
@@ -2713,6 +2756,43 @@ ad_gpo_cse_step(struct tevent_req *req)
     return EAGAIN;
 }
 +static errno_t
 +store_hash_maps_in_cache(struct sss_domain_info *domain,
 +                         hash_table_t *allow_maps, hash_table_t *deny_maps)
 +{
 +    int ret;
 +    struct hash_iter_context_t *iter;
 +    hash_entry_t *entry;
 +    size_t c;
 +    hash_table_t *hash_list[] = { allow_maps, deny_maps, NULL};
 +
 +
 +    for (c = 0; hash_list[c] != NULL; c++) {
 +        iter = new_hash_iter_context(hash_list[c]);
 +        if (iter == NULL) {
 +            DEBUG(SSSDBG_OP_FAILURE, "Failed to create hash iterator.\n");
 +            return EINVAL;
 +        }
 +
 +        while ((entry = iter->next(iter)) != NULL) {
 +            ret = sysdb_gpo_store_gpo_result_setting(domain,
 +                                                     entry->key.c_str,
 +                                                     entry->value.ptr);
 +            if (ret != EOK) {
 +                free(iter);
 +                DEBUG(SSSDBG_OP_FAILURE,
 +                      "sysdb_gpo_store_gpo_result_setting failed for key:"
 +                      "[%s] value:[%s] [%d][%s]\n", entry->key.c_str,
 +                      (char *) entry->value.ptr, ret, sss_strerror(ret));
 +                return ret;
 +            }
 +        }
 +        talloc_free(iter);
 +    }
 +
 +    return EOK;
 +}
 +
 /*
  * This cse-specific function (GP_EXT_GUID_SECURITY) increments the
  * cse_gpo_index until the policy settings for all applicable GPOs have been
@@ -2754,6 +2834,7 @@ ad_gpo_cse_done(struct tevent_req *subreq)
      * (as part of the GPO Result object in the sysdb cache).
      */
     ret = ad_gpo_store_policy_settings(state->host_domain,
 +                                       state->allow_maps, state->deny_maps,
                                        cse_filtered_gpo->policy_filename);
     if (ret != EOK && ret != ENOENT) {
         DEBUG(SSSDBG_OP_FAILURE,
@@ -2767,6 +2848,13 @@ ad_gpo_cse_done(struct tevent_req *subreq)
     if (ret == EOK) {
         /* ret is EOK only after all GPO policy files have been downloaded */
 +        ret = store_hash_maps_in_cache(state->host_domain,
 +                                       state->allow_maps, state->deny_maps);
 +        if (ret != EOK) {
 +            DEBUG(SSSDBG_OP_FAILURE, "Failed to store evaluated GPO maps "
 +                                     "[%d][%s].\n", ret, sss_strerror(ret));
 +            goto done;
 +        }
         ret = ad_gpo_perform_hbac_processing(state,
                                              state->gpo_mode,
                                              state->gpo_map_type,
 -- 
 2.44.0
--- a/SOURCES/0006-ad-refresh-root-domain-when-read-directly.patch
+++ b/SOURCES/0006-ad-refresh-root-domain-when-read-directly.patch
@ -1,81 +0,0 @@
 From db27a51f274640e1aa2f13476c80955a3ec9e91c Mon Sep 17 00:00:00 2001
 From: Sumit Bose <sbose@redhat.com>
 Date: Fri, 1 Mar 2024 10:50:07 +0100
 Subject: [PATCH] ad: refresh root domain when read directly
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If the domain object of the forest root domain cannot be found in the
 LDAP tree of the local AD domain SSSD tries to read the request data
 from an LDAP server of the forest root domain directly. After reading
 this data the information is stored in the cache but currently the
 information about the domain store in memory is not updated with the
 additional data. As a result e.g. the domain SID is missing in this data
 and only becomes available after a restart where it is read from the
 cache.
 With this patch an unconditional refresh is triggered at the end of the
 fallback code path.
 Resolves: https://github.com/SSSD/sssd/issues/7250
 Reviewed-by: Dan Lavu <dlavu@redhat.com>
 Reviewed-by: Tomáš Halman <thalman@redhat.com>
 (cherry picked from commit 0de6c33047ac7a2b5316ec5ec936d6b675671c53)
 ---
 src/providers/ad/ad_subdomains.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
 index a8d1892cc..d8f3738ce 100644
 --- a/src/providers/ad/ad_subdomains.c
 +++ b/src/providers/ad/ad_subdomains.c
@@ -1395,7 +1395,7 @@ struct ad_get_root_domain_state {
 static void ad_get_root_domain_done(struct tevent_req *subreq);
 static void ad_check_root_domain_done(struct tevent_req *subreq);
 static errno_t
 -ad_get_root_domain_refresh(struct ad_get_root_domain_state *state);
 +ad_get_root_domain_refresh(struct ad_get_root_domain_state *state, bool refresh);
 struct tevent_req *
 ad_check_domain_send(TALLOC_CTX *mem_ctx,
@@ -1582,7 +1582,7 @@ static void ad_get_root_domain_done(struct tevent_req *subreq)
         return;
     }
 -    ret = ad_get_root_domain_refresh(state);
 +    ret = ad_get_root_domain_refresh(state, false);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "ad_get_root_domain_refresh() failed.\n");
     }
@@ -1682,7 +1682,7 @@ static void ad_check_root_domain_done(struct tevent_req *subreq)
     state->reply_count = 1;
 -    ret = ad_get_root_domain_refresh(state);
 +    ret = ad_get_root_domain_refresh(state, true);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "ad_get_root_domain_refresh() failed.\n");
     }
@@ -1697,7 +1697,7 @@ done:
 }
 static errno_t
 -ad_get_root_domain_refresh(struct ad_get_root_domain_state *state)
 +ad_get_root_domain_refresh(struct ad_get_root_domain_state *state, bool refresh)
 {
     struct sss_domain_info *root_domain;
     bool has_changes;
@@ -1713,7 +1713,7 @@ ad_get_root_domain_refresh(struct ad_get_root_domain_state *state)
         goto done;
     }
 -    if (has_changes) {
 +    if (has_changes || refresh) {
         ret = ad_subdom_reinit(state->sd_ctx);
         if (ret != EOK) {
             DEBUG(SSSDBG_OP_FAILURE, "Could not reinitialize subdomains\n");
 -- 
 2.45.0
--- a/1
+++ b/1
@ -0,0 +1 @@
 SHA512 (sssd-2.10.0-beta2.tar.gz) = 0de63006d6c9d1658edcdb76c6eca2b2a7858a0805ff3a81c96959e599dc55c09098c34b3a3e38730fbb59edd7e7d7d12eb17ede06411c8131e9dce938e0e810
--- a/SPECS/sssd.spec
+++ b/SPECS/sssd.spec
--- a/sssd.sysusers
+++ b/sssd.sysusers
@ -0,0 +1 @@
 u     sssd   -   "User for sssd"     /run/sssd/      /sbin/nologin
`@ -1 +1 @@`
	`SOURCES/sssd-2.9.4.tar.gz`	`sssd-2.10.0-beta2.tar.gz`
		`@ -1 +0,0 @@`
			`574f6cec9ee12dd943e4305286845343ab7bb891 SOURCES/sssd-2.9.4.tar.gz`
		`@ -0,0 +1 @@`
							`SHA512 (sssd-2.10.0-beta2.tar.gz) = 0de63006d6c9d1658edcdb76c6eca2b2a7858a0805ff3a81c96959e599dc55c09098c34b3a3e38730fbb59edd7e7d7d12eb17ede06411c8131e9dce938e0e810`
		`@ -0,0 +1 @@`
							`u sssd - "User for sssd" /run/sssd/ /sbin/nologin`