679b5f7a1b
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0 Add host access control support for LDAP (similar to pam_host_attr) Finer-grained control on principals used with Kerberos (such as for FAST or validation) Added a new tool sss_cache to allow selective expiring of cached entries Added support for LDAP DEREF and ASQ controls Added access control features for Novell Directory Server FreeIPA dynamic DNS update now checks first to see if an update is needed Complete rewrite of the HBAC library New libraries: libipa_hbac and libipa_hbac-python
791 lines
28 KiB
RPMSpec
791 lines
28 KiB
RPMSpec
%if ! (0%{?fedora} > 12 || 0%{?rhel} > 5)
|
|
%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
|
|
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
|
|
%endif
|
|
|
|
# Determine the location of the LDB modules directory
|
|
%global ldb_modulesdir %(pkg-config --variable=modulesdir ldb)
|
|
%global ldb_version 1.1.0
|
|
|
|
Name: sssd
|
|
Version: 1.6.0
|
|
Release: 1%{?dist}
|
|
Group: Applications/System
|
|
Summary: System Security Services Daemon
|
|
License: GPLv3+
|
|
URL: http://fedorahosted.org/sssd/
|
|
Source0: https://fedorahosted.org/released/sssd/%{name}-%{version}.tar.gz
|
|
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
|
|
|
|
### Patches ###
|
|
|
|
|
|
### Dependencies ###
|
|
|
|
Requires: libldb = %{ldb_version}
|
|
Requires: libtdb >= 1.1.3
|
|
Requires: sssd-client = %{version}-%{release}
|
|
Requires: cyrus-sasl-gssapi
|
|
Requires: krb5-libs >= 1.9
|
|
Requires(post): systemd-units initscripts chkconfig /sbin/ldconfig
|
|
Requires(preun): systemd-units initscripts chkconfig
|
|
Requires(postun): systemd-units initscripts chkconfig /sbin/ldconfig
|
|
|
|
%global servicename sssd
|
|
%global sssdstatedir %{_localstatedir}/lib/sss
|
|
%global dbpath %{sssdstatedir}/db
|
|
%global pipepath %{sssdstatedir}/pipes
|
|
%global pubconfpath %{sssdstatedir}/pubconf
|
|
|
|
### Build Dependencies ###
|
|
|
|
BuildRequires: autoconf
|
|
BuildRequires: automake
|
|
BuildRequires: libtool
|
|
BuildRequires: m4
|
|
%{?fedora:BuildRequires: popt-devel}
|
|
%if 0%{?rhel} <= 5
|
|
BuildRequires: popt
|
|
%endif
|
|
%if 0%{?rhel} >= 6
|
|
BuildRequires: popt-devel
|
|
%endif
|
|
BuildRequires: libtalloc-devel
|
|
BuildRequires: libtevent-devel
|
|
BuildRequires: libtdb-devel
|
|
BuildRequires: libldb-devel = %{ldb_version}
|
|
BuildRequires: libdhash-devel >= 0.4.2
|
|
BuildRequires: libcollection-devel
|
|
BuildRequires: libini_config-devel
|
|
BuildRequires: dbus-devel
|
|
BuildRequires: dbus-libs
|
|
BuildRequires: openldap-devel
|
|
BuildRequires: pam-devel
|
|
BuildRequires: nss-devel
|
|
BuildRequires: nspr-devel
|
|
BuildRequires: pcre-devel
|
|
BuildRequires: libxslt
|
|
BuildRequires: libxml2
|
|
BuildRequires: docbook-style-xsl
|
|
BuildRequires: krb5-devel >= 1.9
|
|
BuildRequires: c-ares-devel
|
|
BuildRequires: python-devel
|
|
BuildRequires: check-devel
|
|
BuildRequires: doxygen
|
|
BuildRequires: libselinux-devel
|
|
BuildRequires: libsemanage-devel
|
|
BuildRequires: bind-utils
|
|
BuildRequires: keyutils-libs-devel
|
|
BuildRequires: libnl-devel
|
|
BuildRequires: nscd
|
|
BuildRequires: gettext-devel
|
|
BuildRequires: libunistring-devel
|
|
|
|
%description
|
|
Provides a set of daemons to manage access to remote directories and
|
|
authentication mechanisms. It provides an NSS and PAM interface toward
|
|
the system and a pluggable backend system to connect to multiple different
|
|
account sources. It is also the basis to provide client auditing and policy
|
|
services for projects like FreeIPA.
|
|
|
|
%package client
|
|
Summary: SSSD Client libraries for NSS and PAM
|
|
Group: Applications/System
|
|
License: LGPLv3+
|
|
|
|
%description client
|
|
Provides the libraries needed by the PAM and NSS stacks to connect to the SSSD
|
|
service.
|
|
|
|
%package tools
|
|
Summary: Userspace tools for use with the SSSD
|
|
Group: Applications/System
|
|
License: GPLv3+
|
|
Requires: sssd = %{version}-%{release}
|
|
|
|
%description tools
|
|
Provides userspace tools for manipulating users, groups, and nested groups in
|
|
SSSD when using id_provider = local in /etc/sssd/sssd.conf.
|
|
|
|
Also provides a userspace tool for generating an obfuscated LDAP password for
|
|
use with ldap_default_authtok_type = obfuscated_password.
|
|
|
|
%package -n libipa_hbac
|
|
Summary: FreeIPA HBAC Evaluator library
|
|
Group: Development/Libraries
|
|
License: LGPLv3+
|
|
|
|
%description -n libipa_hbac
|
|
Utility library to validate FreeIPA HBAC rules for authorization requests
|
|
|
|
%package -n libipa_hbac-devel
|
|
Summary: FreeIPA HBAC Evaluator library
|
|
Group: Development/Libraries
|
|
License: LGPLv3+
|
|
Requires: libipa_hbac = %{version}-%{release}
|
|
|
|
%description -n libipa_hbac-devel
|
|
Utility library to validate FreeIPA HBAC rules for authorization requests
|
|
|
|
%package -n libipa_hbac-python
|
|
Summary: Python bindings for the FreeIPA HBAC Evaluator library
|
|
Group: Development/Libraries
|
|
License: LGPLv3+
|
|
Requires: libipa_hbac = %{version}-%{release}
|
|
|
|
%description -n libipa_hbac-python
|
|
The libipa_hbac-python contains the bindings so that libipa_hbac can be
|
|
used by Python applications.
|
|
|
|
|
|
%prep
|
|
%setup -q
|
|
|
|
%build
|
|
autoreconf -ivf
|
|
%configure \
|
|
--with-db-path=%{dbpath} \
|
|
--with-pipe-path=%{pipepath} \
|
|
--with-pubconf-path=%{pubconfpath} \
|
|
--with-init-dir=%{_initrddir} \
|
|
--enable-nsslibdir=/%{_lib} \
|
|
--enable-pammoddir=/%{_lib}/security \
|
|
--disable-static \
|
|
--disable-rpath \
|
|
--with-test-dir=/dev/shm
|
|
|
|
make %{?_smp_mflags}
|
|
|
|
%check
|
|
export CK_TIMEOUT_MULTIPLIER=10
|
|
make %{?_smp_mflags} check
|
|
unset CK_TIMEOUT_MULTIPLIER
|
|
|
|
%install
|
|
rm -rf $RPM_BUILD_ROOT
|
|
|
|
make install DESTDIR=$RPM_BUILD_ROOT
|
|
|
|
# Prepare language files
|
|
/usr/lib/rpm/find-lang.sh $RPM_BUILD_ROOT sssd
|
|
|
|
# Copy default sssd.conf file
|
|
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sssd
|
|
install -m600 src/examples/sssd.conf $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.conf
|
|
install -m400 src/config/etc/sssd.api.conf $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.api.conf
|
|
install -m400 src/config/etc/sssd.api.d/* $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.api.d/
|
|
|
|
# Copy default logrotate file
|
|
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d
|
|
install -m644 src/examples/logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sssd
|
|
|
|
# Make sure SSSD is able to run on read-only root
|
|
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rwtab.d
|
|
install -m644 src/examples/rwtab $RPM_BUILD_ROOT%{_sysconfdir}/rwtab.d/sssd
|
|
|
|
# Replace sysv init script with systemd unit file
|
|
rm -f $RPM_BUILD_ROOT/%{_initrddir}/%{name}
|
|
mkdir -p $RPM_BUILD_ROOT/%{_unitdir}/
|
|
cp src/sysv/systemd/sssd.service $RPM_BUILD_ROOT/%{_unitdir}/
|
|
|
|
# Remove .la files created by libtool
|
|
rm -f \
|
|
$RPM_BUILD_ROOT/%{_lib}/libnss_sss.la \
|
|
$RPM_BUILD_ROOT/%{_lib}/security/pam_sss.la \
|
|
$RPM_BUILD_ROOT/%{ldb_modulesdir}/memberof.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_ldap.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_proxy.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_krb5.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_ipa.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_simple.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.la \
|
|
$RPM_BUILD_ROOT/%{_libdir}/libipa_hbac.la \
|
|
$RPM_BUILD_ROOT/%{python_sitearch}/pysss.la \
|
|
$RPM_BUILD_ROOT/%{python_sitearch}/pyhbac.la
|
|
|
|
# Older versions of rpmbuild can only handle one -f option
|
|
# So we need to append to the sssd.lang file
|
|
for file in `ls $RPM_BUILD_ROOT/%{python_sitelib}/*.egg-info 2> /dev/null`
|
|
do
|
|
echo %{python_sitelib}/`basename $file` >> sssd.lang
|
|
done
|
|
|
|
touch sssd_tools.lang
|
|
for man in `find $RPM_BUILD_ROOT/%{_mandir}/??/man?/ -type f | sed -e "s#$RPM_BUILD_ROOT/%{_mandir}/##"`
|
|
do
|
|
lang=`echo $man | cut -c 1-2`
|
|
case `basename $man` in
|
|
sss_*)
|
|
echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_tools.lang
|
|
;;
|
|
*)
|
|
echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd.lang
|
|
;;
|
|
esac
|
|
done
|
|
|
|
%clean
|
|
rm -rf $RPM_BUILD_ROOT
|
|
|
|
%files -f sssd.lang
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING
|
|
%{_unitdir}/sssd.service
|
|
%{_sbindir}/sssd
|
|
%{_libexecdir}/%{servicename}/
|
|
%{_libdir}/%{name}/
|
|
%{ldb_modulesdir}/memberof.so
|
|
%dir %{sssdstatedir}
|
|
%attr(700,root,root) %dir %{dbpath}
|
|
%attr(755,root,root) %dir %{pipepath}
|
|
%attr(755,root,root) %dir %{pubconfpath}
|
|
%attr(700,root,root) %dir %{pipepath}/private
|
|
%attr(750,root,root) %dir %{_var}/log/%{name}
|
|
%attr(700,root,root) %dir %{_sysconfdir}/sssd
|
|
%config(noreplace) %{_sysconfdir}/sssd/sssd.conf
|
|
%config(noreplace) %{_sysconfdir}/logrotate.d/sssd
|
|
%config(noreplace) %{_sysconfdir}/rwtab.d/sssd
|
|
%config %{_sysconfdir}/sssd/sssd.api.conf
|
|
%attr(700,root,root) %dir %{_sysconfdir}/sssd/sssd.api.d
|
|
%config %{_sysconfdir}/sssd/sssd.api.d/
|
|
%{_mandir}/man5/sssd.conf.5*
|
|
%{_mandir}/man5/sssd-ipa.5*
|
|
%{_mandir}/man5/sssd-krb5.5*
|
|
%{_mandir}/man5/sssd-ldap.5*
|
|
%{_mandir}/man5/sssd-simple.5*
|
|
%{_mandir}/man8/sssd.8*
|
|
%{python_sitearch}/pysss.so
|
|
%{python_sitelib}/*.py*
|
|
|
|
%files client -f sssd_tools.lang
|
|
%defattr(-,root,root,-)
|
|
%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
|
|
/%{_lib}/libnss_sss.so.2
|
|
/%{_lib}/security/pam_sss.so
|
|
%{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
|
|
%{_mandir}/man8/pam_sss.8*
|
|
%{_mandir}/man8/sssd_krb5_locator_plugin.8*
|
|
|
|
%files tools
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING
|
|
%{_sbindir}/sss_useradd
|
|
%{_sbindir}/sss_userdel
|
|
%{_sbindir}/sss_usermod
|
|
%{_sbindir}/sss_groupadd
|
|
%{_sbindir}/sss_groupdel
|
|
%{_sbindir}/sss_groupmod
|
|
%{_sbindir}/sss_groupshow
|
|
%{_sbindir}/sss_obfuscate
|
|
%{_sbindir}/sss_cache
|
|
%{_mandir}/man8/sss_groupadd.8*
|
|
%{_mandir}/man8/sss_groupdel.8*
|
|
%{_mandir}/man8/sss_groupmod.8*
|
|
%{_mandir}/man8/sss_groupshow.8*
|
|
%{_mandir}/man8/sss_useradd.8*
|
|
%{_mandir}/man8/sss_userdel.8*
|
|
%{_mandir}/man8/sss_usermod.8*
|
|
%{_mandir}/man8/sss_obfuscate.8*
|
|
%{_mandir}/man8/sss_cache.8*
|
|
|
|
%files -n libipa_hbac
|
|
%defattr(-,root,root,-)
|
|
%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
|
|
%{_libdir}/libipa_hbac.so.*
|
|
|
|
%files -n libipa_hbac-devel
|
|
%defattr(-,root,root,-)
|
|
%{_includedir}/ipa_hbac.h
|
|
%{_libdir}/libipa_hbac.so
|
|
%{_libdir}/pkgconfig/ipa_hbac.pc
|
|
|
|
%files -n libipa_hbac-python
|
|
%defattr(-,root,root,-)
|
|
%{python_sitearch}/pyhbac.so
|
|
|
|
%post
|
|
/sbin/ldconfig
|
|
|
|
if [ $1 -ge 1 ] ; then
|
|
# Initial installation
|
|
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
%preun
|
|
if [ $1 = 0 ]; then
|
|
# Package removal, not upgrade
|
|
/bin/systemctl --no-reload disable sssd.service > /dev/null 2>&1 || :
|
|
/bin/systemctl stop sssd.service > /dev/null 2>&1 || :
|
|
fi
|
|
|
|
%triggerun -- sssd < %{version}-%{release}
|
|
if /sbin/chkconfig --level 3 sssd ; then
|
|
/bin/systemctl --no-reload enable sssd.service >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
if /sbin/chkconfig --level 5 sssd ; then
|
|
/bin/systemctl --no-reload enable sssd.service >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
/sbin/chkconfig --del sssd >/dev/null 2>&1 || :
|
|
|
|
|
|
|
|
%postun
|
|
/sbin/ldconfig
|
|
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
|
|
if [ $1 -ge 1 ] ; then
|
|
# On upgrade, reload init system configuration if we changed unit files
|
|
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
|
|
/bin/systemctl try-restart sssd.service >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
%post client -p /sbin/ldconfig
|
|
|
|
%postun client -p /sbin/ldconfig
|
|
|
|
%post -n libipa_hbac -p /sbin/ldconfig
|
|
|
|
%postun -n libipa_hbac -p /sbin/ldconfig
|
|
|
|
%changelog
|
|
* Wed Aug 03 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
|
|
- New upstream release 1.6.0
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
|
|
- Add host access control support for LDAP (similar to pam_host_attr)
|
|
- Finer-grained control on principals used with Kerberos (such as for FAST or
|
|
- validation)
|
|
- Added a new tool sss_cache to allow selective expiring of cached entries
|
|
- Added support for LDAP DEREF and ASQ controls
|
|
- Added access control features for Novell Directory Server
|
|
- FreeIPA dynamic DNS update now checks first to see if an update is needed
|
|
- Complete rewrite of the HBAC library
|
|
- New libraries: libipa_hbac and libipa_hbac-python
|
|
|
|
* Tue Jul 05 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
|
|
- New upstream release 1.5.11
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
|
|
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
|
|
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
|
|
- address being saved to the AAAA record
|
|
|
|
* Fri Jul 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
|
|
- New upstream release 1.5.10
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
|
|
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
|
|
- to LDAP
|
|
|
|
* Thu Jun 30 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
|
|
- New upstream release 1.5.9
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
|
|
- Support for overriding home directory, shell and primary GID locally
|
|
- Properly honor TTL values from SRV record lookups
|
|
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
|
|
- servers)
|
|
- Properly escape IPv6 addresses in the failover code
|
|
- Do not crash if inotify fails (e.g. resource exhaustion)
|
|
- Don't add multiple TGT renewal callbacks (too many log messages)
|
|
|
|
* Fri May 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
|
|
- New upstream release 1.5.8
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
|
|
- Support for the LDAP paging control
|
|
- Support for multiple DNS servers for name resolution
|
|
- Fixes for several group membership bugs
|
|
- Fixes for rare crash bugs
|
|
|
|
* Mon May 23 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
|
|
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
|
|
- Make sure to properly convert to systemd if upgrading from newer
|
|
- updates for Fedora 14
|
|
|
|
* Mon May 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-2
|
|
- Fix segfault in TGT renewal
|
|
|
|
* Fri Apr 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
|
|
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
|
|
- cached password with predicatable filename
|
|
|
|
* Wed Apr 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.6.1-1
|
|
- Re-add manpage translations
|
|
|
|
* Wed Apr 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
|
|
- New upstream release 1.5.6
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
|
|
- Fixed a serious memory leak in the memberOf plugin
|
|
- Fixed a regression with the negative cache that caused it to be essentially
|
|
- nonfunctional
|
|
- Fixed an issue where the user's full name would sometimes be removed from
|
|
- the cache
|
|
- Fixed an issue with password changes in the kerberos provider not working
|
|
- with kpasswd
|
|
|
|
* Wed Apr 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
|
|
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
|
|
- kadmin server != kdc server
|
|
- Upgrades from SysV should now maintain enabled/disabled status
|
|
|
|
* Mon Apr 18 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-4
|
|
- Fix %%postun
|
|
|
|
* Thu Apr 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
|
|
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
|
|
- enabling the systemd service.
|
|
- Fix a serious memory leak in the memberOf plugin
|
|
- Fix an issue where the user's full name would sometimes be removed
|
|
- from the cache
|
|
|
|
* Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-2
|
|
- Install systemd unit file instead of sysv init script
|
|
|
|
* Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
|
|
- New upstream release 1.5.5
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
|
|
- Fixes for several crash bugs
|
|
- LDAP group lookups will no longer abort if there is a zero-length member
|
|
- attribute
|
|
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
|
|
|
|
* Thu Mar 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
|
|
- New upstream release 1.5.4
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
|
|
- Fixes for Active Directory when not all users and groups have POSIX attributes
|
|
- Fixes for handling users and groups that have name aliases (aliases are ignored)
|
|
- Fix group memberships after initgroups in the IPA provider
|
|
|
|
* Thu Mar 17 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.3-2
|
|
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
|
|
|
|
* Fri Mar 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.3-1
|
|
- New upstream release 1.5.3
|
|
- Support for libldb >= 1.0.0
|
|
|
|
* Thu Mar 10 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
|
|
- New upstream release 1.5.2
|
|
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
|
|
- Fixes for support of FreeIPA v2
|
|
- Fixes for failover if DNS entries change
|
|
- Improved sss_obfuscate tool with better interactive mode
|
|
- Fix several crash bugs
|
|
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
|
|
- Delete users from the local cache if initgroups calls return 'no such user'
|
|
- (previously only worked for getpwnam/getpwuid)
|
|
- Use new Transifex.net translations
|
|
- Better support for automatic TGT renewal (now survives restart)
|
|
- Netgroup fixes
|
|
|
|
* Sun Feb 27 2011 Simo Sorce <ssorce@redhat.com> - 1.5.1-9
|
|
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
|
|
- Related: rhbz#677425
|
|
|
|
* Mon Feb 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
|
|
- Resolves: rhbz#677768 - name service caches names, so id command shows
|
|
- recently deleted users
|
|
|
|
* Fri Feb 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
|
|
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
|
|
- Remove .la for memberOf
|
|
|
|
* Fri Feb 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
|
|
- Fix memberOf install path
|
|
|
|
* Fri Feb 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
|
|
- Add support for libldb 1.0.0
|
|
|
|
* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.1-4
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
|
|
|
* Tue Feb 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
|
|
- Fix nested group member filter sanitization for RFC2307bis
|
|
- Put translated tool manpages into the sssd-tools subpackage
|
|
|
|
* Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-2
|
|
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
|
|
- rpmbuild
|
|
|
|
* Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
|
|
- New upstream release 1.5.1
|
|
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
|
|
- Vast performance improvements when enumerate = true
|
|
- All PAM actions will now perform a forced initgroups lookup instead of just
|
|
- a user information lookup
|
|
- This guarantees that all group information is available to other
|
|
- providers, such as the simple provider.
|
|
- For backwards-compatibility, DNS lookups will also fall back to trying the
|
|
- SSSD domain name as a DNS discovery domain.
|
|
- Support for more password expiration policies in LDAP
|
|
- 389 Directory Server
|
|
- FreeIPA
|
|
- ActiveDirectory
|
|
- Support for ldap_tls_{cert,key,cipher_suite} config options
|
|
-Assorted bugfixes
|
|
|
|
* Tue Jan 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-2
|
|
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
|
|
|
|
* Wed Dec 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
|
|
- New upstream release 1.5.0
|
|
- Fixed issues with LDAP search filters that needed to be escaped
|
|
- Add Kerberos FAST support on platforms that support it
|
|
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
|
|
- Added a Kerberos access provider to honor .k5login
|
|
- Addressed several thread-safety issues in the sss_client code
|
|
- Improved support for delayed online Kerberos auth
|
|
- Significantly reduced time between connecting to the network/VPN and
|
|
- acquiring a TGT
|
|
- Added feature for automatic Kerberos ticket renewal
|
|
- Provides the kerberos ticket for long-lived processes or cron jobs
|
|
- even when the user logs out
|
|
- Added several new features to the LDAP access provider
|
|
- Support for 'shadow' access control
|
|
- Support for authorizedService access control
|
|
- Ability to mix-and-match LDAP access control features
|
|
- Added an option for a separate password-change LDAP server for those
|
|
- platforms where LDAP referrals are not supported
|
|
- Added support for manpage translations
|
|
|
|
|
|
* Thu Nov 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
|
|
- Solve a shutdown race-condition that sometimes left processes running
|
|
- Resolves: rhbz#606887 - SSSD stops on upgrade
|
|
|
|
* Tue Nov 16 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-2
|
|
- Log startup errors to the syslog
|
|
- Allow cache cleanup to be disabled in sssd.conf
|
|
|
|
* Mon Nov 01 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
|
|
- New upstream release 1.4.1
|
|
- Add support for netgroups to the proxy provider
|
|
- Fixes a minor bug with UIDs/GIDs >= 2^31
|
|
- Fixes a segfault in the kerberos provider
|
|
- Fixes a segfault in the NSS responder if a data provider crashes
|
|
- Correctly use sdap_netgroup_search_base
|
|
|
|
* Mon Oct 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-2
|
|
- Fix incorrect tarball URL
|
|
|
|
* Mon Oct 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
|
|
- New upstream release 1.4.0
|
|
- Added support for netgroups to the LDAP provider
|
|
- Performance improvements made to group processing of RFC2307 LDAP servers
|
|
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
|
|
- Build-system improvements to support Gentoo
|
|
- Split out several libraries into the ding-libs tarball
|
|
- Manpage reviewed and updated
|
|
|
|
* Mon Oct 04 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-35
|
|
- Fix pre and post script requirements
|
|
|
|
* Mon Oct 04 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-34
|
|
- Resolves: rhbz#606887 - sssd stops on upgrade
|
|
|
|
* Fri Oct 01 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-33
|
|
- Resolves: rhbz#626205 - Unable to unlock screen
|
|
|
|
* Tue Sep 28 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
|
|
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
|
|
- doesn't require it
|
|
|
|
* Thu Sep 16 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-31
|
|
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
|
|
|
|
* Tue Aug 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
|
|
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
|
|
- against LDAP
|
|
|
|
* Thu Jul 22 2010 David Malcolm <dmalcolm@redhat.com> - 1.2.91-21
|
|
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
|
|
|
|
* Fri Jul 09 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
|
|
- New upstream version 1.2.91 (1.3.0rc1)
|
|
- Improved LDAP failover
|
|
- Synchronous sysdb API (provides performance enhancements)
|
|
- Better online reconnection detection
|
|
|
|
* Mon Jun 21 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
|
|
- New stable upstream version 1.2.1
|
|
- Resolves: rhbz#595529 - spec file should eschew %%define in favor of
|
|
- %%global
|
|
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
|
|
- to fail while restart.
|
|
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
|
|
- keyring
|
|
- Resolves: rhbz#599724 - sssd is broken on Rawhide
|
|
|
|
* Mon May 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
|
|
- New stable upstream version 1.2.0
|
|
- Support ServiceGroups for FreeIPA v2 HBAC rules
|
|
- Fix long-standing issue with auth_provider = proxy
|
|
- Better logging for TLS issues in LDAP
|
|
|
|
* Tue May 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
|
|
- New LDAP access provider allows for filtering user access by LDAP attribute
|
|
- Reduced default timeout for detecting offline status with LDAP
|
|
- GSSAPI ticket lifetime made configurable
|
|
- Better offline->online transition support in Kerberos
|
|
|
|
* Fri May 07 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
|
|
- Release new upstream version 1.1.91
|
|
- Enhancements when using SSSD with FreeIPA v2
|
|
- Support for deferred kinit
|
|
- Support for DNS SRV records for failover
|
|
|
|
* Fri Apr 02 2010 Simo Sorce <ssorce@redhat.com> - 1.1.1-3
|
|
- Bump up release number to avoid library sub-packages version issues with
|
|
previous releases.
|
|
|
|
* Thu Apr 01 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
|
|
- New upstream release 1.1.1
|
|
- Fixed the IPA provider (which was segfaulting at start)
|
|
- Fixed a bug in the SSSDConfig API causing some options to revert to
|
|
- their defaults
|
|
- This impacted the Authconfig UI
|
|
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
|
|
|
|
* Tue Mar 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
|
|
- Release SSSD 1.1.0 final
|
|
- Fix two potential segfaults
|
|
- Fix memory leak in monitor
|
|
- Better error message for unusable confdb
|
|
|
|
* Wed Mar 17 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
|
|
- Release candidate for SSSD 1.1
|
|
- Add simple access provider
|
|
- Create subpackages for libcollection, libini_config, libdhash and librefarray
|
|
- Support IPv6
|
|
- Support LDAP referrals
|
|
- Fix cache issues
|
|
- Better feedback from PAM when offline
|
|
|
|
* Wed Feb 24 2010 Stephen Gallagehr <sgallagh@redhat.com> - 1.0.5-2
|
|
- Rebuild against new libtevent
|
|
|
|
* Fri Feb 19 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.5-1
|
|
- Fix licenses in sources and on RPMs
|
|
|
|
* Mon Jan 25 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.4-1
|
|
- Fix regression on 64-bit platforms
|
|
|
|
* Fri Jan 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
|
|
- Fixes link error on platforms that do not do implicit linking
|
|
- Fixes double-free segfault in PAM
|
|
- Fixes double-free error in async resolver
|
|
- Fixes support for TCP-based DNS lookups in async resolver
|
|
- Fixes memory alignment issues on ARM processors
|
|
- Manpage fixes
|
|
|
|
* Thu Jan 14 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
|
|
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
|
|
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
|
|
- Several segfault bugfixes
|
|
|
|
* Mon Jan 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.1-1
|
|
- Fix CVE-2010-0014
|
|
|
|
* Mon Dec 21 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-2
|
|
- Patch SSSDConfig API to address
|
|
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
|
|
|
|
* Fri Dec 18 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-1
|
|
- New upstream stable release 1.0.0
|
|
|
|
* Fri Dec 11 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.1-1
|
|
- New upstream bugfix release 0.99.1
|
|
|
|
* Mon Nov 30 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.0-1
|
|
- New upstream release 0.99.0
|
|
|
|
* Tue Oct 27 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
|
|
- Fix segfault in sssd_pam when cache_credentials was enabled
|
|
- Update the sample configuration
|
|
- Fix upgrade issues caused by data provider service removal
|
|
|
|
* Mon Oct 26 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-2
|
|
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
|
|
|
|
* Fri Oct 23 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-1
|
|
- New upstream release 0.7.0
|
|
|
|
* Thu Oct 15 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-2
|
|
- Fix missing file permissions for sssd-clients
|
|
|
|
* Tue Oct 13 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
|
|
- Add SSSDConfig API
|
|
- Update polish translation for 0.6.0
|
|
- Fix long timeout on ldap operation
|
|
- Make dp requests more robust
|
|
|
|
* Tue Sep 29 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
|
|
- Ensure that the configuration upgrade script always writes the config
|
|
file with 0600 permissions
|
|
- Eliminate an infinite loop in group enumerations
|
|
|
|
* Mon Sep 28 2009 Sumit Bose <sbose@redhat.com> - 0.6.0-0
|
|
- New upstream release 0.6.0
|
|
|
|
* Mon Aug 24 2009 Simo Sorce <ssorce@redhat.com> - 0.5.0-0
|
|
- New upstream release 0.5.0
|
|
|
|
* Wed Jul 29 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
|
|
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
|
|
without a password. (Patch by Stephen Gallagher)
|
|
|
|
* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.1-3
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
|
|
|
|
* Mon Jun 22 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-2
|
|
- Fix a couple of segfaults that may happen on reload
|
|
|
|
* Thu Jun 11 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-1
|
|
- add missing configure check that broke stopping the daemon
|
|
- also fix default config to add a missing required option
|
|
|
|
* Mon Jun 8 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-0
|
|
- latest upstream release.
|
|
- also add a patch that fixes debugging output (potential segfault)
|
|
|
|
* Mon Apr 20 2009 Simo Sorce <ssorce@redhat.com> - 0.3.2-2
|
|
- release out of the official 0.3.2 tarball
|
|
|
|
* Mon Apr 20 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
|
|
- bugfix release 0.3.2
|
|
- includes previous release patches
|
|
- change permissions of the /etc/sssd/sssd.conf to 0600
|
|
|
|
* Tue Apr 14 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-2
|
|
- Add last minute bug fixes, found in testing the package
|
|
|
|
* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-1
|
|
- Version 0.3.1
|
|
- includes previous release patches
|
|
|
|
* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-2
|
|
- Try to fix build adding automake as an explicit BuildRequire
|
|
- Add also a couple of last minute patches from upstream
|
|
|
|
* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-1
|
|
- Version 0.3.0
|
|
- Provides file based configuration and lots of improvements
|
|
|
|
* Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.1-1
|
|
- Version 0.2.1
|
|
|
|
* Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.0-1
|
|
- Version 0.2.0
|
|
|
|
* Sun Mar 08 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-5.20090309git691c9b3
|
|
- package git snapshot
|
|
|
|
* Fri Mar 06 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-4
|
|
- fixed items found during review
|
|
- added initscript
|
|
|
|
* Thu Mar 05 2009 Sumit Bose <sbose@redhat.com> - 0.1.0-3
|
|
- added sss_client
|
|
|
|
* Mon Feb 23 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-2
|
|
- Small cleanup and fixes in the spec file
|
|
|
|
* Thu Feb 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.1.0-1
|
|
- Initial release (based on version 0.1.0 upstream code)
|