Changelog for
sssd-ipa-1.16.2-13.el7.x86_64.rpm :
Wed Sep 5 14:00:00 2018 Jakub Hrozek
- 1.16.2-13
- Resolves: rhbz#1593756 - sssd needs to require a newer version of
libtalloc and libtevent to avoid an issue
in GPO processing
Thu Aug 9 14:00:00 2018 Fabiano Fidêncio - 1.16.2-12
- Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
- Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled
Thu Aug 2 14:00:00 2018 Jakub Hrozek - 1.16.2-11
- Resolves: rhbz#1602781 - Local users failed to login with same password
Wed Aug 1 14:00:00 2018 Jakub Hrozek - 1.16.2-10
- Resolves: rhbz#1586127 - Spurious check in the sssd nss memcache can cause the memory cache to be skipped
Thu Jul 26 14:00:00 2018 Jakub Hrozek - 1.16.2-9
- Resolves: rhbz#1522928 - sssd doesn\'t allow user with expired password
Thu Jul 26 14:00:00 2018 Jakub Hrozek - 1.16.2-8
- Resolves: rhbz#1607313 - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails
Fri Jul 13 14:00:00 2018 Fabiano Fidêncio - 1.16.2-7
- Resolves: rhbz#1600822 - SSSD bails out saving desktop profiles in case an invalid profile is found
Wed Jul 11 14:00:00 2018 Fabiano Fidêncio - 1.16.2-6
- Resolves: rhbz#1582975 - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers
Fri Jun 29 14:00:00 2018 Fabiano Fidêncio - 1.16.2-5
- Resolves: rhbz#1583725 - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries
- Resolves: rhbz#1416528 - sssd in cross realm trust configuration should be able to use AD KDCs from a client site defined in sssd.conf or a snippet
- Resolves: rhbz#1592964 - Groups go missing with PAC enabled in sssd
Mon Jun 25 14:00:00 2018 Fabiano Fidêncio - 1.16.2-4
- Resolves: rhbz#1590603 - EMBARGOED CVE-2018-10852 sssd: information leak from the sssd-sudo responder [rhel-7]
- Resolves: rhbz#1450778 - Full information regarding priority of lookup of principal in keytab not in man page
Fri Jun 22 14:00:00 2018 Fabiano Fidêncio - 1.16.2-3
- Resolves: rhbz#1494690 - kdcinfo files are not created for subdomains of a directly joined AD client
- Resolves: rhbz#1583343 - Login with sshkeys stored in ipa not working after update to RHEL-7.5
- Resolves: rhbz#1527662 - Handle conflicting e-mail addresses more gracefully
- Resolves: rhbz#1509691 - Document how to change the regular expression for SSSD so that group names with an AATT-sign can be parsed
Fri Jun 22 14:00:00 2018 Fabiano Fidêncio - 1.16.2-2
- Related: rhbz#1558498 - Rebase sssd to the latests upstream release of the 1.16 branch
Mon Jun 11 14:00:00 2018 Fabiano Fidêncio - 1.16.2-1
- Resolves: rhbz#1558498 - Rebase sssd to the latests upstream release of the 1.16 branch
- Resolves: rhbz#1523019 - Reset password with two factor authentication fails
- Resolves: rhbz#1534749 - Requesting an AD user\'s private group and then the user itself returns an emty homedir
- Resolves: rhbz#1537272 - SSH public key authentication keeps working after keys are removed from ID view
- Resolves: rhbz#1537279 - Certificate is not removed from cache when it\'s removed from the override
- Resolves: rhbz#1562025 - externalUser sudo attribute must be fully-qualified
- Resolves: rhbz#1577335 - /usr/libexec/sssd/sssd_autofs SIGABRT crash daily
- Resolves: rhbz#1508530 - How should sudo behave without sudoHost attribute?
- Resolves: rhbz#1546754 - The man page of sss_ssh_authorizedkeys can be enhanced to better explain how the keys are retrieved and how X.509 certificates can be used
- Resolves: rhbz#1572790 - getgrgid/getpwuid fails in setups with multiple domains if the first domain uses mid_id/max_id
- Resolves: rhbz#1561562 - sssd not honoring dyndns_server if the DNS update process is terminated with a signal
- Resolves: rhbz#1583251 - home dir disappear in sssd cache on the IPA master for AD users
- Resolves: rhbz#1514061 - ID override GID from Default Trust View is not properly resolved in case domain resolution order is set
- Resolves: rhbz#1571466 - Utilizing domain_resolution_order in sssd.conf breaks SELinux user map
- Resolves: rhbz#1571526 - SSSD with ID provider \'ad\' should give a warning in case the ldap schema is manually changed to something different than \'ad\'.
Thu May 31 14:00:00 2018 Fabiano Fidêncio - 1.16.0-25
- Resolves: rhbz#1547782 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process
Sat May 19 14:00:00 2018 Fabiano Fidêncio - 1.16.0-24
- Related: rhbz#1578291 - Samba can not register sss idmap module because it\'s using an outdated SMB_IDMAP_INTERFACE_VERSION
Fri May 18 14:00:00 2018 Fabiano Fidêncio - 1.16.0-23
- Resolves: rhbz#1578291 - Samba can not register sss idmap module because it\'s using an outdated SMB_IDMAP_INTERFACE_VERSION
Fri May 18 14:00:00 2018 Fabiano Fidêncio - 1.16.0-22
- Resolves: rhbz#1516266 - Give a more detailed debug and system-log message if krb5_init_context() failed
- Resolves: rhbz#1503802 - Smartcard authentication fails if SSSD is offline and \'krb5_store_password_if_offline = True\'
- Resolves: rhbz#1385665 - Incorrect error code returned from krb5_child (updated)
- Resolves: rhbz#1547234 - SSSD\'s GPO code ignores ad_site option
- Resolves: rhbz#1459348 - extend sss-certmap man page regarding priority processing
- Resolves: rhbz#1220767 - Group renaming issue when \"id_provider = ldap\" is set
- Resolves: rhbz#1538555 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000]
Wed Apr 25 14:00:00 2018 Jakub Hrozek - 1.16.0-21
- Resolves: rhbz#1565774 - After updating to RHEL 7.5 failing to clear the sssd cache
Fri Apr 20 14:00:00 2018 Fabiano Fidêncio - 1.16.0-20
- Resolves: rhbz#1566782 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash
Wed Feb 21 13:00:00 2018 Fabiano Fidêncio - 1.16.0-19
- Related: rhbzrhbz#1544943 - sssd goes offline when renewing expired ticket
Wed Feb 21 13:00:00 2018 Fabiano Fidêncio - 1.16.0-18
- Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
- Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket
Mon Feb 19 13:00:00 2018 Fabiano Fidêncio - 1.16.0-17
- Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
server
Tue Feb 6 13:00:00 2018 Fabiano Fidêncio - 1.16.0-16
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
on RHEL clients joined to AD via sssd [RHEL 7]
Wed Jan 24 13:00:00 2018 Fabiano Fidêncio - 1.16.0-15
- Resolves: rhbz#1517971 - AD Domain goes offline immediately during
subdomain initialization - IPA AD Trust
- Related: rhbz#1482555 - sysdb index improvements - missing ghost
attribute indexing, unneeded objectclass index
etc..
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
on RHEL clients joined to AD via sssd [RHEL 7]
- Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
gidNumber = 0
- Related: rhbz#1461899 - Loading enterprise principals doesn\'t work with
a primed cache
- Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Fri Dec 15 13:00:00 2017 Fabiano Fidêncio - 1.16.0-14
- Resolves: rhbz#1525644 - dbus-send unable to find user by CAC cert
Thu Dec 14 13:00:00 2017 Fabiano Fidêncio - 1.16.0-13
- Resolves: rhbz#1523010 - IPA user able to authenticate with revoked cert
on smart card
Mon Dec 11 13:00:00 2017 Fabiano Fidêncio - 1.16.0-12
- Resolves: rhbz#1512027 - NSS by-id requests are not checked against
max_id/min_id ranges before triggering the
backend
Fri Dec 8 13:00:00 2017 Fabiano Fidêncio - 1.16.0-11
- Related: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
- Resolves: rhbz#1523010 - IPA user able to authenticate with revoked
cert on smart card
- Resolves: rhbz#1520984 - getent output is not showing home directory
for IPA AD trusted user
- Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Wed Dec 6 13:00:00 2017 Fabiano Fidêncio - 1.16.0-10
- Resolves: rhbz#1421194 - SSSD doesn\'t use AD global catalog for
gidnumber lookup, resulting in unacceptable
delay for large forests
Fri Dec 1 13:00:00 2017 Fabiano Fidêncio - 1.16.0-9
- Resolves: rhbz#1482231 - sssd_nss consumes more memory until
restarted or machine swaps
- Resolves: rhbz#1512508 - SSSD fails to fetch group information after
switching IPA client to a non-default view
Thu Nov 30 13:00:00 2017 Fabiano Fidêncio - 1.16.0-8
- Resolves: rhbz#1490120 - SSSD complaining about corrupted mmap cache
and logging error in /var/log/messages and
/var/log/sssd/sssd_nss.log
Mon Nov 27 13:00:00 2017 Fabiano Fidêncio - 1.16.0-7
- Resolves: rhbz#1272214 - [RFE] Create a local per system report about
who can access that IDM client (attestation)
- Resolves: rhbz#1482555 - sysdb index improvements - missing ghost
attribute indexing, unneeded objectclass index
etc..
- Resolves: rhbz#888739 - Enumerating large number of users makes sssd_be
hog the cpu for a long time.
- Resolves: rhbz#1373547 - SSSD performance issue with malloc and brk
calls
- Resolves: rhbz#1472255 - Improve SSSD performance in the 7.5 release
Tue Nov 14 13:00:00 2017 Fabiano Fidêncio - 1.16.0-6
- Related: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Related: rhbz#1432010 - SSSD ships a drop-in configuration snippet in
/etc/systemd/system
- Related: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
Mon Nov 13 13:00:00 2017 Fabiano Fidêncio - 1.16.0-5
- Resolves: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
- Related: rhbz#1499659 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database [rhel-7.5]
- Resolves: rhbz#1408294 - SSSD authentication fails when two IPA
accounts share an email address without a
clear way to debug the problem
- Resolves: rhbz#1502686 - crash - /usr/libexec/sssd/sssd_nss in
nss_setnetgrent_timeout
Sun Nov 12 13:00:00 2017 Fabiano Fidêncio - 1.16.0-4
- Related: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Related: rhbz#1459609 - When sssd is configured with id_provider proxy
and auth_provider ldap, login fails if the LDAP
server is not allowing anonymous binds.
Mon Nov 6 13:00:00 2017 Fabiano Fidêncio - 1.16.0-3
- Resolves: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Fri Nov 3 13:00:00 2017 Fabiano Fidêncio - 1.16.0-2
- Resolves: rhbz#1484376 - [RFE] Add a configuration option to SSSD to
disable the memory cache
- Resolves: rhbz#1327705 - Automatic creation of user private groups on
RHEL clients joined to AD via sssd [RHEL 7]
- Resolves: rhbz#1505277 - Race condition between refreshing the cr_domain
list and a request that is using the list can
cause a segfault is sssd_nss
- Resolves: rhbz#1462343 - document information on why SSSD does not use
host-based security filtering when processing
AD GPOs
- Resolves: rhbz#1498734 - sssd_be stuck in an infinite loop after
completing full refresh of sudo rules
- Resolves: rhbz#1400614 - [RFE] sssd should remember DNS sites from
first search
- Resolves: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Resolves: rhbz#1459609 - When sssd is configured with id_provider proxy
and auth_provider ldap, login fails if the LDAP
server is not allowing anonymous binds.
Fri Oct 20 14:00:00 2017 Fabiano Fidêncio - 1.16.0-1
- Resolves: rhbz#1469791 - Rebase SSSD to version 1.16+
- Resolves: rhbz#1132264 - Allow sssd to retrieve sudo rules of local
users whose sudo rules stored in ldap server
- Resolves: rhbz#1301740 - sssd can be marked offline if a trusted domain
is not reachable
- Resolves: rhbz#1399262 - Use TCP for kerberos with AD by default
- Resolves: rhbz#1416150 - RFE: Log to syslog when sssd cannot contact
servers, goes offline
- Resolves: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
- Resolves: rhbz#1454559 - python-sssdconfig doesn\'t parse hexadecimal debug
_level, resulting in set_option():
/usr/lib/python2.7/site-packages/SSSDConfig/__init__.py
killed by TypeError
- Resolves: rhbz#1456968 - MAN: document that attribute \'provider\' is not
allowed in section \'secrets\'
- Resolves: rhbz#1460689 - KCM/secrets: Storing many secrets in a rapid
succession segfaults the secrets responder
- Resolves: rhbz#1464049 - Idle nss file descriptors should be closed
- Resolves: rhbz#1468610 - sssd_be is utilizing more CPU during sudo rules
refresh
- Resolves: rhbz#1474711 - Querying the AD domain for external domain\'s ID can
mark the AD domain offline
- Resolves: rhbz#1479398 - samba shares with sssd authentication broken on 7.4
- Resolves: rhbz#1479983 - id root triggers an LDAP lookup
- Resolves: rhbz#1489895 - Issues with certificate mapping rules
- Resolves: rhbz#1490501 - sssd incorrectly checks \'try_inotify\' thinking it is
the wrong section
- Resolves: rhbz#1490913 - MAN: Document that full_name_format must be set if
the output of trusted domains user resolution should
be shortnames only
- Resolves: rhbz#1499659 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database [rhel-7.5]
- Resolves: rhbz#1461899 - Loading enterprise principals doesn\'t work with a
primed cache
- Resolves: rhbz#1482674 - SUDO doesn\'t work for IPA users on IPA clients after
applying ID Views for them in IPA server
- Resolves: rhbz#1486053 - Accessing IdM kerberos ticket fails while id mapping
is applied
- Resolves: rhbz#1486786 - sssd going in offline mode due to sudo search filter.
- Resolves: rhbz#1500087 - SSSD creates bad override search filter due to AD
Trust object with parenthesis
- Resolves: rhbz#1502713 - SSSD can crash due to ABI changes in libldb >= 1.2.0
(1.1.30)
- Resolves: rhbz#1461462 - sssd_client: add mutex protected call to the PAC
responder
- Resolves: rhbz#1489666 - Combination sssd-ad and postfix recieve incorrect
mail with asterisks or spaces
- Resolves: rhbz#1525052 - sssd_krb5_localauth_plugin fails to fallback to otheri
localname rules
Tue Oct 17 14:00:00 2017 Jakub Hrozek - 1.15.2-51
- Require the 7.5 libldb version which broke ABI
- Related: rhbz#1469791 - Rebase SSSD to version 1.16+
Wed Jun 21 14:00:00 2017 Jakub Hrozek - 1.15.2-50
- Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
connected to AD child domain
Wed Jun 21 14:00:00 2017 Jakub Hrozek - 1.15.2-49
- Resolves: rhbz#1450107 - SSSD doesn\'t handle conflicts between users
from trusted domains with the same name when
shortname user resolution is enabled
Fri Jun 16 14:00:00 2017 Jakub Hrozek - 1.15.2-48
- Resolves: rhbz#1459846 - krb5: properly handle \'password expired\'
information retured by the KDC during
PKINIT/Smartcard authentication
Thu Jun 15 14:00:00 2017 Jakub Hrozek - 1.15.2-47
- Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
most of the entries once the cleanup task kicks in
Thu Jun 15 14:00:00 2017 Jakub Hrozek - 1.15.2-46
- Resolves: rhbz#1455254 - Make domain available as user attribute
Thu Jun 8 14:00:00 2017 Jakub Hrozek - 1.15.2-45
- Resolves: rhbz#1449731 - IPA client cannot change AD Trusted User password
Thu Jun 8 14:00:00 2017 Jakub Hrozek - 1.15.2-44
- Resolves: rhbz#1457927 - getent failed to fetch netgroup information
after changing default_domain_suffix to
ADdomin in /etc/sssd/sssd.conf
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-43
- Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
properly in v 1.15
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-42
- Resolves: rhbz#1449728 - LDAP to IPA migration doesn\'t work in master
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-41
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-40
- Resolves: rhbz#1449729 - org.freedesktop.sssd.infopipe.GetUserGroups
does not resolve groups into names with AD
Thu Jun 1 14:00:00 2017 Jakub Hrozek - 1.15.2-39
- Resolves: rhbz#1450094 - Properly support IPA\'s promptusername config
option
Thu Jun 1 14:00:00 2017 Jakub Hrozek - 1.15.2-38
- Resolves: rhbz#1457644 - Segfault in access_provider = krb5 is set in
sssd.conf due to an off-by-one error when
constructing the child send buffer
- Resolves: rhbz#1456531 - Option name typos are not detected with validator
function of sssctl config-check command in domain
sections
Fri May 26 14:00:00 2017 Jakub Hrozek - 1.15.2-37
- Resolves: rhbz#1428906 - sssd intermittently failing to resolve groups
for an AD user in IPA-AD trust environment.
Fri May 26 14:00:00 2017 Jakub Hrozek - 1.15.2-36
- Resolves: rhbz#1389796 - Smartcard authentication with UPN as logon name
might fail
- Fix Coverity issues in patches for rhbz#1445445
Wed May 24 14:00:00 2017 Jakub Hrozek - 1.15.2-35
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Wed May 24 14:00:00 2017 Jakub Hrozek - 1.15.2-34
- Resolves: rhbz#1446302 - crash in sssd-kcm due to a race-condition
between two concurrent requests
Tue May 23 14:00:00 2017 Jakub Hrozek - 1.15.2-33
- Resolves: rhbz#1389796 - Smartcard authentication with UPN as logon name might fail
Tue May 23 14:00:00 2017 Jakub Hrozek - 1.15.2-32
- Resolves: rhbz#1306707 - Need better debug message when krb5_child
returns an unhandled error, leading to a
System Error PAM code
Mon May 22 14:00:00 2017 Jakub Hrozek - 1.15.2-31
- Resolves: rhbz#1446535 - Group resolution does not work in subdomain
without ad_server option
Wed May 17 14:00:00 2017 Sumit Bose - 1.15.2-30
- Resolves: rhbz#1449726 - sss_nss_getlistbycert() does not return results from
multiple domains
- Resolves: rhbz#1447098 - sssd unable to search dbus for ipa user by
certificate
- Additional patch for rhbz#1440132
Thu May 11 14:00:00 2017 Jakub Hrozek - 1.15.2-29
- Reapply patch by Lukas Slebodnik to fix upgrade issues with libwbclient
- Resolves: rhbz#1439457 - SSSD does not start after upgrade from 7.3 to 7.4
- Resolves: rhbz#1449107 - error: %pre(sssd-common-1.15.2-26.el7.x86_64)
scriptlet failed, exit status 3
Thu May 11 14:00:00 2017 Jakub Hrozek - 1.15.2-28
- Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
properly in v 1.15
- Also apply an additional patch for rhbz#1441545
Thu May 4 14:00:00 2017 Jakub Hrozek - 1.15.2-25
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Wed May 3 14:00:00 2017 Jakub Hrozek - 1.15.2-24
- Resolves: rhbz#1434992 - Wrong pam return code for user from subdomain
with ad_access_filter
Wed May 3 14:00:00 2017 Lukas Slebodnik - 1.15.2-23
- Resolves: rhbz#1430494 - expect sss_ssh_authorizedkeys and
sss_ssh_knownhostsproxy manuals to be packaged
into sssd-common package
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-22
- Resolves: rhbz#1427749 - SSSD in server mode iterates over all domains
for group-by-GID requests, causing unnecessary
searches
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-21
- Resolves: rhbz#1446139 - Infopipe method ListByCertificate does not
return the users with overrides
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-20
- Resolves: rhbz#1441545 - With multiple subdomain sections id command
output for user is not displayed for both domains
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-19
- Resolves: rhbz#1428866 - Using ad_enabled_domains configuration option
in sssd.conf causes nameservice lookups to fail.
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-18
- Remove an unused variable from the sssd-secrets responder
- Related: rhbz#1398701 - [sssd-secrets] https proxy talks plain http
- Improve two DEBUG messages in the client trust code to aid troubleshooting
- Fix standalone application domains
- Related: rhbz#1425891 - Support delivering non-POSIX users and groups
through the IFP and PAM interfaces
Wed Apr 26 14:00:00 2017 Jakub Hrozek - 1.15.2-17
- Allow completely server-side unqualified name resolution if the domain order is set,
do not require any client-side changes
- Related: rhbz#1330196 - [RFE] Short name input format with SSSD for users from
all domains when domain autodiscovery is used or when
IPA client resolves trusted AD domain users
Mon Apr 24 14:00:00 2017 Jakub Hrozek - 1.15.2-16
- Resolves: rhbz#1402532 - D-Bus interface of sssd is giving inappropriate
group information for trusted AD users
Thu Apr 13 14:00:00 2017 Jakub Hrozek - 1.15.2-15
- Resolves: rhbz#1431858 - Wrong principal found with ad provider and long
host name
Wed Apr 12 14:00:00 2017 Jakub Hrozek - 1.15.2-14
- Resolves: rhbz#1415167 - pam_acct_mgmt with pam_sss.so fails in
unprivileged container unless
selinux_provider = none is used
Wed Apr 12 14:00:00 2017 Jakub Hrozek - 1.15.2-13
- Resolves: rhbz#1438388 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_pam killed by 6
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-12
- Resolves: rhbz#1432112 - sssctl config-check does not give any error
when default configuration file is not present
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-11
- Resolves: rhbz#1438374 - [abrt] [faf] sssd: vfprintf():
/usr/libexec/sssd/sssd_be killed by 11
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-10
- Resolves: rhbz#1427195 - sssd_nss consumes more memory until restarted
or machine swaps
Mon Apr 10 14:00:00 2017 Jakub Hrozek - 1.15.2-9
- Resolves: rhbz#1414023 - Create troubleshooting tool to determine if a
failure is in SSSD or not when using layered
products like RH-SSO/CFME etc
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-8
- Resolves: rhbz#1398701 - [sssd-secrets] https proxy talks plain http
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-7
- Fix off-by-one error in the KCM responder
- Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-6
- Resolves: rhbz#1425891 - Support delivering non-POSIX users and groups
through the IFP and PAM interfaces
Wed Mar 29 14:00:00 2017 Jakub Hrozek - 1.15.2-5
- Resolves: rhbz#1434991 - Issue processing ssh keys from certificates in
ssh respoder
Wed Mar 29 14:00:00 2017 Jakub Hrozek - 1.15.2-4
- Resolves: rhbz#1330196 - [RFE] Short name input format with SSSD for
users from all domains when domain autodiscovery
is used or when IPA client resolves trusted AD
domain users
- Also backport some buildtime fixes for the KCM responder
- Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Mon Mar 27 14:00:00 2017 Jakub Hrozek - 1.15.2-3
- Resolves: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Thu Mar 23 13:00:00 2017 Jakub Hrozek - 1.15.2-2
- Resolves: rhbz#1340711 - [RFE] Use one smartcard and certificate for
authentication to distinct logon accounts
Wed Mar 15 13:00:00 2017 Jakub Hrozek - 1.15.2-1
- Update to upstream 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Resolves: rhbz#1418728 - IPA - sudo does not handle associated conflict
entries
- Resolves: rhbz#1386748 - sssd doesn\'t update PTR records if A/PTR zones
are configured as non-secure and secure
- Resolves: rhbz#1214491 - [RFE] Make it possible to configure AD subdomain
in the SSSD server mode
Thu Mar 9 13:00:00 2017 Fabiano Fidêncio - 1.15.1-2
- Drop \"NOUPSTREAM: Bundle http-parser\" patch
Related: rhbz#1393819 - New package: http-parser
Sat Mar 4 13:00:00 2017 Jakub Hrozek - 1.15.1-1
- Update to upstream 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- Resolves: rhbz#1327085 - Don\'t prompt for password if there is already
one on the stack
- Resolves: rhbz#1378722 - [RFE] Make GETSIDBYNAME and GETORIGBYNAME
request aware of UPNs and aliases
- Resolves: rhbz#1405075 - [RFE] Add PKINIT support to SSSD Kerberos provider
- Resolves: rhbz#1416526 - Need correction in sssd-krb5 man page
- Resolves: rhbz#1418752 - pam_sss crashes in do_pam_conversation if no
conversation function is provided by the
client app
- Resolves: rhbz#1419356 - Fails to accept any sudo rules if there are
two user entries in an ldap role with the same
sudo user
- Resolves: rhbz#1421622 - SSSD - Users/Groups are cached as mixed-case
resulting in users unable to sign in
Wed Feb 1 13:00:00 2017 Jakub Hrozek - 1.15.0-2
- Fix several packaging issues, notably the p11_child is no longer setuid
and the libwbclient used a wrong version number in the symlink
Mon Jan 30 13:00:00 2017 Jakub Hrozek - 1.15.0-1
- Update to upstream 1.15.0
- Resolves: rhbz#1393824 - Rebase SSSD to version 1.15
- Resolves: rhbz#1407960 - wbcLookupSid() fails in pdomain is NULL
- Resolves: rhbz#1406437 - sssctl netgroup-show Cannot allocate memory
- Resolves: rhbz#1400422 - Use-after free in resolver in case the fd is
writeable and readable at the same time
- Resolves: rhbz#1393085 - bz - ldap group names don\'t resolve after
upgrading sssd to 1.14.0 if ldap_nesting_level is set to 0
- Resolves: rhbz#1392444 - sssd_be keeps crashing
- Resolves: rhbz#1392441 - sssd fails to start after upgrading to RHEL 7.3
- Resolves: rhbz#1382602 - autofs map resolution doesn\'t work offline
- Resolves: rhbz#1380436 - sudo: ignore case on case insensitive domains
- Resolves: rhbz#1378251 - Typo In SSSD-AD Man Page
- Resolves: rhbz#1373427 - Clock skew makes SSSD return System Error
- Resolves: rhbz#1306707 - Need better handling of \"Server not found in
Kerberos database\"
- Resolves: rhbz#1297462 - Don\'t include \'enable_only=sssd\' in the localauth
plugin config
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-46
- Resolves: rhbz#1382598 - IPA: Uninitialized variable during subdomain check
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-45
- Resolves: rhbz#1378911 - No supplementary groups are resolved for users
in nested OUs when domain stanza differs from AD
domain
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-44
- Resolves: rhbz#1372075 - AD provider: SSSD does not retrieve a domain-local
group with the AD provider when following AGGUDLP
group structure across domains
Tue Sep 20 14:00:00 2016 Jakub Hrozek - 1.14.0-43
- Resolves: rhbz#1376831 - sssd-common is missing dependency on sssd-sudo
Fri Sep 16 14:00:00 2016 Jakub Hrozek - 1.14.0-42
- Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
smartcard authentication is not enabled
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-41
- Resolves: rhbz#1373420 - sss_override fails to export
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-40
- Resolves: rhbz#1375299 - sss_groupshow fails with error \"No such
group in local domain. Printing groups only
allowed in local domain\"
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-39
- Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
sizelimit exceeded
Mon Sep 12 14:00:00 2016 Jakub Hrozek - 1.14.0-38
- Resolves: rhbz#1372753 - Access denied for user when access_provider =
krb5 is set in sssd.conf
Mon Sep 12 14:00:00 2016 Jakub Hrozek - 1.14.0-37
- Resolves: rhbz#1373444 - unable to create group in sssd cache
- Resolves: rhbz#1373577 - unable to add local user in sssd to a group in sssd
Wed Sep 7 14:00:00 2016 Jakub Hrozek - 1.14.0-36
- Resolves: rhbz#1369118 - Don\'t enable the default shadowtils domain in RHEL
Mon Sep 5 14:00:00 2016 Jakub Hrozek - 1.14.0-35
- Fix permissions for the private pipe directory
- Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-34
- Resolves: rhbz#1371977 - resolving IPA nested user groups is broken in 1.14
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-33
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-32
- Resolves: rhbz#1371152 - SSSD qualifies principal twice in IPA-AD trust
if the principal attribute doesn\'t exist on the
AD side
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-31
- Apply forgotten patch
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
- Resolves: rhbz#1366470 - sssd: throw away the timestamp cache if
re-initializing the persistent cache
- Fix deleting non-existent secret
- Related: rhbz#1311056 - Add a Secrets as a Service component
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-30
- Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-29
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-28
- Resolves: rhbz#1364033 - sssd exits if clock is adjusted backwards
after boot
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-27
- Resolves: rhbz#1362023 - SSSD fails to start when ldap_user_extra_attrs
contains mail
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-26
- Resolves: rhbz#1368324 - libsss_autofs.so is packaged in two packages
sssd-common and libsss_autofs
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-25
- Fix RPM scriptlet plumbing for the sssd-secrets responder
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-24
- Add socket-activation plumbing for the sssd-secrets responder
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-23
- Own the secrets directory
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-22
- Resolves: rhbz#1268874 - Add an option to disable checking for trusted
domains in the subdomains provider
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-21
- Resolves: rhbz#1271280 - sssd stores and returns incorrect information
about empty netgroup (ldap-server: 389-ds)
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-20
- Resolves: rhbz#1290500 - [feat] command to manually list
fo_add_server_to_list information
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-19
- Add several small fixes related to the config API
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Thu Aug 11 14:00:00 2016 Jakub Hrozek - 1.14.0-18
- Resolves: rhbz#1349900 - gpo search errors out and gpo_cache file is
never created
Wed Aug 10 14:00:00 2016 Jakub Hrozek - 1.14.0-17
- Fix regressions in the simple access provider
- Resolves: rhbz#1360806 - sssd does not start if sub-domain user is used
with simple access provider
- Apply a number of specfile patches to better match the upstream spefile
- Related: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
Wed Aug 10 14:00:00 2016 Jakub Hrozek - 1.14.0-16
- Cherry-pick patches from upstream that fix several regressions
- Avoid checking local users in all cases
- Resolves: rhbz#1353951 - sssd_pam leaks file descriptors
Mon Aug 8 14:00:00 2016 Jakub Hrozek - 1.14.0-15
- Resolves: rhbz#1364118 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_nss killed by 11
- Resolves: rhbz#1361563 - Wrong pam error code returned for password
change in offline mode
Fri Jul 29 14:00:00 2016 Jakub Hrozek - 1.14.0-14
- Resolves: rhbz#1309745 - Support multiple principals for IPA users
Fri Jul 29 14:00:00 2016 Jakub Hrozek - 1.14.0-13
- Resolves: rhbz#1304992 - Handle overriden name of members in the
memberUid attribute
Wed Jul 27 14:00:00 2016 Jakub Hrozek - 1.14.0-12
- handle unresolvable sites more gracefully
- Resolves: rhbz#1346011 - sssd is looking at a server in the GC of a
subdomain, not the root domain.
- fix compilation warnings in unit tests
Wed Jul 27 14:00:00 2016 Jakub Hrozek - 1.14.0-11
- fix capaths output
- Resolves: rhbz#1344940 - GSSAPI error causes failures for child domain
user logins across IPA - AD trust
- also fix Coverity issues in the secrets responder and suppress noisy
debug messages when setting the timestamp cache
Tue Jul 19 14:00:00 2016 Jakub Hrozek - 1.14.0-10
- Resolves: rhbz#1356577 - sssctl: Time stamps without time zone information
Tue Jul 19 14:00:00 2016 Jakub Hrozek - 1.14.0-9
- Resolves: rhbz#1354414 - New or modified ID-View User overrides are not
visible unless rm -f /var/lib/sss/db/
*cache
*
Mon Jul 18 14:00:00 2016 Jakub Hrozek - 1.14.0-8
- Resolves: rhbz#1211631 - [RFE] Support of UPN for IdM trusted domains
Thu Jul 14 14:00:00 2016 Jakub Hrozek - 1.14.0-7
- Resolves: rhbz#1350520 - [abrt] sssd-common: ipa_dyndns_update_send():
sssd_be killed by SIGSEGV
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-6
- Resolves: rhbz#1349882 - sssd does not work under non-root user
- Also cherry-pick a few patches from upstream to fix config schema
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-5
- Sync a few minor patches from upstream
- Fix sssctl manpage
- Fix nss-tests unit test on big-endian machines
- Fix several issues in the config schema
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-4
- Bundle http-parser
- Resolves: rhbz#1311056 - Add a Secrets as a Service component
Tue Jul 12 14:00:00 2016 Jakub Hrozek - 1.14.0-3
- Sync a few minor patches from upstream
- Fix a failover issue
- Resolves: rhbz#1334749 - sssd fails to mark a connection as bad on
searches that time out
Mon Jul 11 14:00:00 2016 Jakub Hrozek - 1.14.0-2
- Explicitly BuildRequire newer ding-libs
- Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Fri Jul 8 14:00:00 2016 Jakub Hrozek - 1.14.0-1
- New upstream release 1.14.0
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- Resolves: rhbz#835492 - [RFE] SSSD admin tool request - force reload
- Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
- Resolves: rhbz#1278691 - Please fix rfc2307 autofs schema defaults
- Resolves: rhbz#1287209 - default_domain_suffix Appended to User Name
- Resolves: rhbz#1300663 - Improve sudo protocol to support configurations
with default_domain_suffix
- Resolves: rhbz#1312275 - Support authentication indicators from IPA
Thu Jun 30 14:00:00 2016 Jakub Hrozek - 1.14.0beta1-2
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- Resolves: rhbz#790113 - [RFE] \"include\" directive in sssd.conf
- Resolves: rhbz#874985 - [RFE] AD provider support for automount lookups
- Resolves: rhbz#879333 - [RFE] SSSD admin tool request - status overview
- Resolves: rhbz#1140022 - [RFE]Allow sssd to add a new option that would
specify which server to update DNS with
- Resolves: rhbz#1290380 - RFE: Improve SSSD performance in large
environments
- Resolves: rhbz#883886 - sssd: incorrect checks on length values during
packet decoding
- Resolves: rhbz#988207 - sssd does not detail which line in configuration
is invalid
- Resolves: rhbz#1007969 - sssd_cache does not remove have an option to
remove the sssd database
- Resolves: rhbz#1103249 - PAC responder needs much time to process large
group lists
- Resolves: rhbz#1118257 - Users in ipa groups, added to netgroups are
not resovable
- Resolves: rhbz#1269018 - Too much logging from sssd_be
- Resolves: rhbz#1293695 - sssd mixup nested group from AD trusted domains
- Resolves: rhbz#1308935 - After removing certificate from user in IPA
and even after sss_cache, FindByCertificate
still finds the user
- Resolves: rhbz#1315766 - SSSD PAM module does not support multiple
password prompts (e.g. Password + Token) with sudo
- Resolves: rhbz#1316164 - SSSD fails to process GPO from Active Directory
- Resolves: rhbz#1322458 - sssd_be[11010]: segfault at 0 ip 00007ff889ff61bb
sp 00007ffc7d66a3b0 error 4 in
libsss_ipa.so[7ff889fcf000+5d000]
Mon Jun 20 14:00:00 2016 Jakub Hrozek - 1.14.0alpha-1
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- The rebase includes fixes for the following bugzillas:
- Resolves: rhbz#789477 - [RFE] SUDO: Support the IPA schema
- Resolves: rhbz#1059972 - RFE: SSSD: Automatically assign new slices for
any AD domain
- Resolves: rhbz#1233200 - man sssd.conf should clarify details about
subdomain_inherit option.
- Resolves: rhbz#1238144 - Need better libhbac debuging added to sssd
- Resolves: rhbz#1265366 - sss_override segfaults when accidentally adding
--help flag to some commands
- Resolves: rhbz#1269512 - sss_override: memory violation
- Resolves: rhbz#1278566 - crash in sssd when non-Englsh locale is used
and pam_strerror prints non-ASCII characters
- Resolves: rhbz#1283686 - groups get deleted from the cache
- Resolves: rhbz#1290378 - Smart Cards: Certificate in the ID View
- Resolves: rhbz#1292238 - extreme memory usage in libnfsidmap sss.so
plug-in when resolving groups with many members
- Resolves: rhbz#1292456 - sssd_be AD segfaults on missing A record
- Resolves: rhbz#1294670 - Local users with local sudo rules causes
LDAP queries
- Resolves: rhbz#1296618 - Properly remove OriginalMemberOf attribute in
SSSD cache if user has no secondary groups anymore
- Resolves: rhbz#1299553 - Cannot retrieve users after upgrade from 1.12
to 1.13
- Resolves: rhbz#1302821 - Cannot start sssd after switching to non-root
- Resolves: rhbz#1310877 - [RFE] Support Automatic Renewing of Kerberos
Host Keytabs
- Resolves: rhbz#1313014 - sssd is not closing sockets properly
- Resolves: rhbz#1318996 - SSSD does not fail over to next GC
- Resolves: rhbz#1327270 - local overrides: issues with sub-domain users
and mixed case names
- Resolves: rhbz#1342547 - sssd-libwbclient: wbcSidsToUnixIds should not
fail on lookup errors
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-50
- Build the PAC plugin with krb5-1.14
- Related: rhbz#1336688 - sssd tries to resolve global catalog servers
from AD forest sub-domains in AD-IPA trust setup
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-49
- Resolves: rhbz#1336688 - sssd tries to resolve global catalog servers
from AD forest sub-domains in AD-IPA trust setup
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-48
- Resolves: rhbz#1290853 - [sssd] Trusted (AD) user\'s info stays in sssd
cache for much more than expected.
Mon May 23 14:00:00 2016 Jakub Hrozek - 1.13.0-47
- Resolves: rhbz#1336706 - sssd_nss memory usage keeps growing when trying
to retrieve non-existing netgroups
Tue May 17 14:00:00 2016 Jakub Hrozek - 1.13.0-46
- Resolves: rhbz#1296902 - In IPA-AD trust environment access is granted
to AD user even if the user is disabled on AD.
Tue May 17 14:00:00 2016 Jakub Hrozek - 1.13.0-45
- Resolves: rhbz#1334159 - IPA provider crashes if a netgroup from a
trusted domain is requested
Mon Apr 18 14:00:00 2016 Jakub Hrozek - 1.13.0-44
- Resolves: rhbz#1308913 - sssd be memory leak in sssd\'s memberof plugin
- More patches from upstream related to the memory leak
Fri Apr 1 14:00:00 2016 Jakub Hrozek - 1.13.0-43
- Resolves: rhbz#1308913 - sssd be memory leak in sssd\'s memberof plugin
Wed Feb 24 13:00:00 2016 Jakub Hrozek - 1.13.0-42
- Resolves: rhbz#1300740 - [RFE] IPA: resolve external group memberships
of IPA groups during getgrnam and getgrgid
Tue Nov 24 13:00:00 2015 Jakub Hrozek - 1.13.0-41
- Resolves: rhbz#1284814 - sssd: [sysdb_add_user] (0x0400): Error: 17
Wed Oct 14 14:00:00 2015 Jakub Hrozek - 1.13.0-40
- Resolves: rhbz#1270827 - local overrides: don\'t contact server with
overridden name/id
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-39
- Resolves: rhbz#1267837 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-38
- Resolves: rhbz#1267176 - Memory leak / possible DoS with krb auth.
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-37
- Resolves: rhbz#1267836 - PAM responder crashed if user was not set
Wed Sep 30 14:00:00 2015 Jakub Hrozek - 1.13.0-36
- Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
uninitialised value
Wed Sep 23 14:00:00 2015 Jakub Hrozek - 1.13.0-35
- Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
subdomain code
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-34
- Fix a Coverity warning in dyndns code
- Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
of processing other commands
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-33
- Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
of processing other commands
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-32
- Resolves: rhbz#1263735 - Could not resolve AD user from root domain
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-31
- Remove -d from sss_override manpage
- Related: rhbz#1259512 - sss_override : The local override user is not found
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-30
- Patches required for better handling of failover with one-way trusts
- Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain
code
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-29
- Resolves: rhbz#1263587 - sss_override --name doesn\'t work with RFC2307
and ghost users
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-28
- Resolves: rhbz#1259512 - sss_override : The local override user is not found
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-27
- Resolves: rhbz#1260027 - sssd_be memory leak with sssd-ad in GPO code
Tue Sep 1 14:00:00 2015 Jakub Hrozek - 1.13.0-26
- Resolves: rhbz#1256398 - sssd cannot resolve user names containing
backslash with ldap provider
Tue Aug 25 14:00:00 2015 Martin Kosek - 1.13.0-25
- Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug
but is not listed in the man page or in
the arguments help
Thu Aug 20 14:00:00 2015 Jakub Hrozek - 1.13.0-24
- Resolves: rhbz#1254518 - Fix crash in nss responder
Thu Aug 20 14:00:00 2015 Jakub Hrozek - 1.13.0-23
- Support import/export for local overrides
- Support FQDNs for local overrides
- Resolves: rhbz#1254184 - sss_override does not work correctly when
\'use_fully_qualified_names = True\'
Tue Aug 18 14:00:00 2015 Jakub Hrozek - 1.13.0-22
- Resolves: rhbz#1244950 - Add index for \'objectSIDString\' and maybe to
other cache attributes
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-21
- Resolves: rhbz#1250415 - sssd: p11_child hardening
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-20
- Related: rhbz#1250135 - Detect re-established trusts in the IPA
subdomain code
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-19
- Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC
identity certificates
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-18
- Resolves: rhbz#1232950 - [IPA/IdM] sudoOrder not honored as expected
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-17
- Fix wildcard_limit=0
- Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-16
- Fix race condition in invalidating the memory cache
- Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-15
- Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo
enabled
Thu Aug 6 14:00:00 2015 Jakub Hrozek - 1.13.0-14
- Bump release number
- Related: rhbz#1246489 - sss_obfuscate fails with \"ImportError: No module
named pysss\"
Thu Aug 6 14:00:00 2015 Lukas Slebodnik - 1.13.0-13
- Fix missing dependency of sssd-tools
- Resolves: rhbz#1246489 - sss_obfuscate fails with \"ImportError: No module
named pysss\"
Wed Aug 5 14:00:00 2015 Jakub Hrozek - 1.13.0-12
- More memory cache related fixes
- Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-11
- Remove binary blob from SC patches as patch(1) can\'t handle those
- Related: rhbz#854396 - [RFE] Support for smart cards
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-10
- Resolves: rhbz#1244949 - getgrgid for user\'s UID on a trust client
prevents getpw
*
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-9
- Fix memory cache integration tests
- Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
- Resolves: rhbz#854396 - [RFE] Support for smart cards
Tue Jul 28 14:00:00 2015 Jakub Hrozek - 1.13.0-8
- Remove OTP from PAM stack correctly
- Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when
user logs in with password and token code from IPA
- Handle sssd-owned keytabs when sssd runs as root
- Related: rhbz#1205144 - RFE: Support one-way trusts for IPA
Mon Jul 27 14:00:00 2015 Jakub Hrozek - 1.13.0-7
- Resolves: rhbz#1183747 - [FEAT] UID and GID mapping on individual clients
Fri Jul 24 14:00:00 2015 Jakub Hrozek - 1.13.0-6
- Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
- Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant
v6 in ipa domain
Fri Jul 17 14:00:00 2015 Jakub Hrozek - 1.13.0-5
- Resolves: rhbz#1242942 - well-known SID check is broken for NetBIOS prefixes
Fri Jul 17 14:00:00 2015 Jakub Hrozek - 1.13.0-4
- Resolves: rhbz#1234722 - sssd ad provider fails to start in rhel7.2
Thu Jul 16 14:00:00 2015 Jakub Hrozek - 1.13.0-3
- Add support for InfoPipe wildcard requests
- Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
Mon Jul 6 14:00:00 2015 Jakub Hrozek - 1.13.0-2
- Also package the initgr memcache
- Related: rhbz#1205554 - Rebase SSSD to 1.13.x
Mon Jul 6 14:00:00 2015 Jakub Hrozek - 1.13.0-1
- Rebase to 1.13.0 upstream
- Related: rhbz#1205554 - Rebase SSSD to 1.13.x
- Resolves: rhbz#910187 - [RFE] authenticate against cache in SSSD
- Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
Wed Jul 1 14:00:00 2015 Jakub Hrozek - 1.13.0.3alpha
- Don\'t default to SSSD user
- Related: rhbz#1205554 - Rebase SSSD to 1.13.x
Tue Jun 23 14:00:00 2015 Jakub Hrozek - 1.13.0.2alpha
- Related: rhbz#1205554 - Rebase SSSD to 1.13.x
- GPO default should be permissve
Mon Jun 22 14:00:00 2015 Jakub Hrozek - 1.13.0.1alpha
- Resolves: rhbz#1205554 - Rebase SSSD to 1.13.x
- Relax the libldb requirement
- Resolves: rhbz#1221992 - sssd_be segfault at 0 ip sp error 6 in
libtevent.so.0.9.21
- Resolves: rhbz#1221839 - SSSD group enumeration inconsistent due to
binary SIDs
- Resolves: rhbz#1219285 - Unable to resolve group memberships for AD
users when using sssd-1.12.2-58.el7_1.6.x86_64
client in combination with
ipa-server-3.0.0-42.el6.x86_64 with AD Trust
- Resolves: rhbz#1217559 - [RFE] Support GPOs from different domain controllers
- Resolves: rhbz#1217350 - ignore_group_members doesn\'t work for subdomains
- Resolves: rhbz#1217127 - Override for IPA users with login does not list
user all groups
- Resolves: rhbz#1216285 - autofs provider fails when default_domain_suffix
and use_fully_qualified_names set
- Resolves: rhbz#1214719 - Group resolution is inconsistent with group
overrides
- Resolves: rhbz#1214718 - Overridde with --login fails trusted adusers
group membership resolution
- Resolves: rhbz#1214716 - idoverridegroup for ipa group with --group-name
does not work
- Resolves: rhbz#1214337 - Overrides with --login work in second attempt
- Resolves: rhbz#1212489 - Disable the cleanup task by default
- Resolves: rhbz#1211830 - external users do not resolve with
\"default_domain_suffix\" set in IPA server sssd.conf
- Resolves: rhbz#1210854 - Only set the selinux context if the context
differs from the local one
- Resolves: rhbz#1209483 - When using id_provider=proxy with
auth_provider=ldap, it does not work as expected
- Resolves: rhbz#1209374 - Man sssd-ad(5) lists Group Policy Management
Editor naming for some policies but not for all
- Resolves: rhbz#1208507 - sysdb sudo search doesn\'t escape special characters
- Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
- Resolves: rhbz#1206566 - SSSD does not update Dynamic DNS records if
the IPA domain differs from machine hostname\'s
domain
- Resolves: rhbz#1206189 - [bug] sssd always appends default_domain_suffix
when checking for host keys
- Resolves: rhbz#1204203 - sssd crashes intermittently
- Resolves: rhbz#1203945 - [FJ7.0 Bug]: getgrent returns error because
sss is written in nsswitch.conf as default
- Resolves: rhbz#1203642 - GPO access control looks for computer object
in user\'s domain only
- Resolves: rhbz#1202245 - SSSD\'s HBAC processing is not permissive enough
with broken replication entries
- Resolves: rhbz#1201271 - sssd_nss segfaults if initgroups request is by
UPN and doesn\'t find anything
- Resolves: rhbz#1200873 - [RFE] Allow smart multi step prompting when
user logs in with password and token code from IPA
- Resolves: rhbz#1199541 - Read and use the TTL value when resolving a
SRV query
- Resolves: rhbz#1199533 - [RFE] Implement background refresh for users,
groups or other cache objects
- Resolves: rhbz#1199445 - Does sssd-ad use the most suitable attribute
for group name?
- Resolves: rhbz#1198477 - ccname_file_dummy is not unlinked on error
- Resolves: rhbz#1187103 - [RFE] User\'s home directories are not taken
from AD when there is an IPA trust with AD
- Resolves: rhbz#1185536 - In ipa-ad trust, with \'default_domain_suffix\' set
to AD domain, IPA user are not able to log unless
use_fully_qualified_names is set
- Resolves: rhbz#1175760 - [RFE] Have OpenLDAP lock out ssh keys when
account naturally expires
- Resolves: rhbz#1163806 - [RFE]ad provider dns_discovery_domain option:
kerberos discovery is not using this option
- Resolves: rhbz#1205160 - Complain loudly if backend doesn\'t start due
to missing or invalid keytab
Wed Apr 22 14:00:00 2015 Jakub Hrozek - 1.12.2-61
- Resolves: rhbz#1226119 - Properly handle AD\'s binary objectGUID
Wed Apr 22 14:00:00 2015 Jakub Hrozek - 1.12.2-60
- Filter out domain-local groups during AD initgroups operation
- Related: rhbz#1201840 - SSSD downloads too much information when fetching
information about groups
Wed Apr 22 14:00:00 2015 Jakub Hrozek - 1.12.2-59
- Resolves: rhbz#1201840 - SSSD downloads too much information when fetching
information about groups
Thu Mar 19 13:00:00 2015 Jakub Hrozek - 1.12.2-58.6
- Initialize variable in the views code in one success and one failure path
- Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
trusted domain) client at
src/providers/ipa/ipa_s2n_exop.c:1605
Tue Mar 17 13:00:00 2015 Jakub Hrozek - 1.12.2-58.5
- Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
trusted domain) client at
src/providers/ipa/ipa_s2n_exop.c:1605
Tue Mar 17 13:00:00 2015 Jakub Hrozek - 1.12.2-58.4
- Handle case where there is no default and no rules
- Resolves: rhbz#1192314 - With empty ipaselinuxusermapdefault security
context on client is staff_u
Thu Mar 5 13:00:00 2015 Jakub Hrozek - 1.12.2-58.3
- Set a pointer in ldap_child to NULL to avoid warnings
- Related: rhbz#1198759 - ccname_file_dummy is not unlinked on error
Thu Mar 5 13:00:00 2015 Jakub Hrozek - 1.12.2-58.2
- Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
context on client is staff_u
Thu Mar 5 13:00:00 2015 Jakub Hrozek - 1.12.2-58.1
- Resolves: rhbz#1198759 - ccname_file_dummy is not unlinked on error
Tue Feb 3 13:00:00 2015 Jakub Hrozek - 1.12.2-57
- Run the restart in sssd-common posttrans
- Explicitly require libwbclient
- Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade
Fri Jan 30 13:00:00 2015 Jakub Hrozek - 1.12.2-56
- Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade
Fri Jan 30 13:00:00 2015 Jakub Hrozek - 1.12.2-55
- Fix endianess bug in fill_id()
- Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares
Fri Jan 30 13:00:00 2015 Jakub Hrozek - 1.12.2-54
- Resolves: rhbz#1168904 - gid is overridden by uid in default trust view
Fri Jan 30 13:00:00 2015 Jakub Hrozek - 1.12.2-53
- Resolves: rhbz#1187192 - IPA initgroups don\'t work correctly in
non-default view
Tue Jan 27 13:00:00 2015 Jakub Hrozek - 1.12.2-52
- Resolves: rhbz#1184982 - Need to set different umask in selinux_child
Tue Jan 27 13:00:00 2015 Jakub Hrozek - 1.12.2-51
- Bump the release number
- Related: rhbz#1184140 - Users saved throug extop don\'t have the
originalMemberOf attribute
Tue Jan 27 13:00:00 2015 Jakub Hrozek - 1.12.2-50
- Add a patch dependency
- Related: rhbz#1184140 - Users saved throug extop don\'t have the
originalMemberOf attribute
Tue Jan 27 13:00:00 2015 Jakub Hrozek - 1.12.2-49
- Process ghost members only once
- Fix processing of universal groups with members from different domains
- Related: rhbz#1168904 - gid is overridden by uid in default trust view
Tue Jan 27 13:00:00 2015 Jakub Hrozek - 1.12.2-48
- Related: rhbz#1184140 - Users saved throug extop don\'t have the
originalMemberOf attribute
Fri Jan 23 13:00:00 2015 Jakub Hrozek - 1.12.2-47
- Resolves: rhbz#1185188 - Uncached SIDs cannot be resolved
Fri Jan 23 13:00:00 2015 Jakub Hrozek - 1.12.2-46
- Handle GID override in MPG domains
- Handle views with mixed-case domains
- Related: rhbz#1168904 - gid is overridden by uid in default trust view
Wed Jan 21 13:00:00 2015 Jakub Hrozek - 1.12.2-45
- Open socket to the PAC responder in krb5_child before dropping root
- Related: rhbz#1184140 - Users saved throug extop don\'t have the
originalMemberOf attribute
Tue Jan 20 13:00:00 2015 Jakub Hrozek - 1.12.2-44
- Resolves: rhbz#1184140 - Users saved throug extop don\'t have the
originalMemberOf attribute
Mon Jan 19 13:00:00 2015 Jakub Hrozek - 1.12.2-43
- Resolves: rhbz#1182183 - pam_sss(sshd:auth): authentication failure with
user from AD
Wed Jan 14 13:00:00 2015 Jakub Hrozek - 1.12.2-42
- Resolves: rhbz#889206 - On clock skew sssd returns system error
Wed Jan 14 13:00:00 2015 Jakub Hrozek - 1.12.2-41
- Related: rhbz#1168904 - gid is overridden by uid in default trust view
Tue Jan 13 13:00:00 2015 Jakub Hrozek - 1.12.2-40
- Resolves: rhbz#1177140 - gpo_child fails if \"log level\" is enabled in smb.conf
- Related: rhbz#1168904 - gid is overridden by uid in default trust view
Fri Dec 19 13:00:00 2014 Sumit Bose - 1.12.2-39
- Resolves: rhbz#1175408 - SSSD should not fail authentication when only allow
rules are used
- Resolves: rhbz#1175705 - sssd-libwbclient conflicts with Samba\'s and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
Wed Dec 17 13:00:00 2014 Sumit Bose - 1.12.2-38
- Resolves: rhbz#1171215 - Crash in function get_object_from_cache
- Resolves: rhbz#1171383 - getent fails for posix group with AD users after
login
- Resolves: rhbz#1171382 - getent of AD universal group fails after group users
login
- Resolves: rhbz#1170300 - Access is not rejected for disabled domain
- Resolves: rhbz#1162486 - Error processing external groups with
getgrnam/getgrgid in the server mode
- Resolves: rhbz#1168904 - gid is overridden by uid in default trust view
Wed Dec 17 13:00:00 2014 Sumit Bose - 1.12.2-37
- Resolves: rhbz#1169459 - sssd-ad: The man page description to enable GPO HBAC
Policies are unclear
- Related: rhbz#1113783 - sssd should run under unprivileged user
Mon Dec 15 13:00:00 2014 Jakub Hrozek - 1.12.2-35
- Rebuild to add several forgotten Patch entries
- Resolves: rhbz#1173482 - MAN: Document that only user names are checked
for pam_trusted_users
- Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
when domains=
Sun Dec 14 13:00:00 2014 Jakub Hrozek - 1.12.2-35
- Remove Coverity warnings in krb5_child code
- Related: rhbz#1113783 - sssd should run under unprivileged user
Sat Dec 13 13:00:00 2014 Jakub Hrozek - 1.12.2-34
- Resolves: rhbz#1173482 - MAN: Document that only user names are checked
for pam_trusted_users
- Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
when domains=
Sat Dec 13 13:00:00 2014 Jakub Hrozek - 1.12.2-33
- Don\'t error out on chpass with OTPs
- Related: rhbz#1109756 - Rebase SSSD to 1.12
Mon Dec 8 13:00:00 2014 Jakub Hrozek - 1.12.2-32
- Resolves: rhbz#1124320 - [FJ7.0 Bug]: getgrent returns error because sss
is written in nsswitch.conf as default.
Mon Dec 8 13:00:00 2014 Jakub Hrozek - 1.12.2-31
- Resolves: rhbz#1169739 - selinuxusermap rule does not apply to trusted
AD users
- Enable running unit tests without cmocka
- Related: rhbz#1113783 - sssd should run under unprivileged user
Wed Dec 3 13:00:00 2014 Jakub Hrozek - 1.12.2-30
- krb5_child and ldap_child do not call Kerberos calls as root
- Related: rhbz#1113783 - sssd should run under unprivileged user
Wed Dec 3 13:00:00 2014 Jakub Hrozek - 1.12.2-29
- Resolves: rhbz#1168735 - The Kerberos provider is not properly views-aware
Wed Nov 26 13:00:00 2014 Jakub Hrozek - 1.12.2-28
- Fix typo in libwbclient-devel alternatives invocation
- Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares
Wed Nov 26 13:00:00 2014 Jakub Hrozek - 1.12.2-27
- Resolves: rhbz#1166727 - pam_sss domains option: Untrusted users from
the same domain are allowed to auth.
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-26
- Handle migrating clients between views
- Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
solution to the trust solution
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-25
- Use alternatives for libwbclient
- Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-24
- Resolves: rhbz#1165794 - sssd does not work with custom value of option
re_expression
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-23
- Add an option that describes where to put generated krb5 files to
- Related: rhbz#1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-22
- Handle IPA group names returned from the extop plugin
- Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
solution to the trust solution
Tue Nov 25 13:00:00 2014 Jakub Hrozek - 1.12.2-21
- Resolves: rhbz#1165792 - automount segfaults in sss_nss_check_header
Thu Nov 20 13:00:00 2014 Jakub Hrozek - 1.12.2-20
- Resolves: rhbz#1163742 - \"debug_timestamps = false\" and \"debug_microseconds
= true\" do not work after enabling journald
with sssd.
Thu Nov 20 13:00:00 2014 Jakub Hrozek - 1.12.2-19
- Resolves: rhbz#1153593 - Manpage description of case_sensitive=preserving
is incomplete
Thu Nov 20 13:00:00 2014 Jakub Hrozek - 1.12.2-18
