|
|
 |
|
|
Changelog for libsss_sudo-1.16.5-10.el7_9.6.x86_64.rpm :
Wed Nov 25 13:00:00 2020 Alexey Tikhonov 1.16.5-10.6
- Resolves: rhbz#1899593 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() [rhel-7.9.z]
- Resolves: rhbz#1888409 - sssd component logging is now too generic in syslog/journal [rhel-7.9.z]
- Resolves: rhbz#1852659 - sssd service is starting even though it is disabled state [rhel-7.9.z]
- Resolves: rhbz#1893443 - User lookups over the InfoPipe responder fail intermittently [rhel-7.9.z]
- Resolves: rhbz#1871288 - krb5_child denies ssh users when pki device detected [rhel-7.9.z]
- Resolves: rhbz#1853703 - Unexpected behavior and issue with filter_users/filter_groups option [rhel-7.9.z]
- Resolves: rhbz#1756240 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains [rhel-7.9.z]
- Resolves: rhbz#1851112 - LDAP bind can fail due to unconfigurable DNS server timeouts that inhibit SSSD failover [rhel-7.9.z]
Fri Aug 28 14:00:00 2020 Alexey Tikhonov 1.16.5-10.5
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from \'id\' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
(Previous attempt to fix this issue was incomplete (again))
- just bumping the version to build for proper target
Fri Aug 28 14:00:00 2020 Alexey Tikhonov 1.16.5-10.4
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from \'id\' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
(Previous attempt to fix this issue was incomplete (again))
Wed Aug 19 14:00:00 2020 Alexey Tikhonov 1.16.5-10.3
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from \'id\' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
(Previous attempt to fix this issue was incomplete)
Tue Aug 18 14:00:00 2020 Alexey Tikhonov 1.16.5-10.2
- Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from \'id\' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
- just bumping the version to build for proper target
Tue Aug 18 14:00:00 2020 Alexey Tikhonov 1.16.5-10.1
- Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from \'id\' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
Fri Jun 5 14:00:00 2020 Alexey Tikhonov 1.16.5-10
- Resolves: rhbz#1804005 - sssd doesn\'t follow the link order of AD Group Policy Management
- Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False
Fri May 29 14:00:00 2020 Alexey Tikhonov 1.16.5-9
- Resolves: rhbz#1796873 - [sssd] RHEL 7.9 Tier 0 Localization
Wed May 27 14:00:00 2020 Alexey Tikhonov 1.16.5-8
- Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
- Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
It is done in two steps (two different nsupdate messages).
Thu May 21 14:00:00 2020 Alexey Tikhonov 1.16.5-7
- Resolves: rhbz#1835813 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing
- Resolves: rhbz#1837545 - Users must be informed better when internal WATCHDOG terminates process.
Wed May 20 14:00:00 2020 Alexey Tikhonov 1.16.5-6
- Resolves: rhbz#1819013 - pam_sss reports PAM_CRED_ERR when providing wrong password for an existing IPA user, but this error\'s description is misleading
- Resolves: rhbz#1800571 - Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen
Tue May 19 14:00:00 2020 Alexey Tikhonov 1.16.5-5
- Resolves: rhbz#1834266 - \"off-by-one error\" in watchdog implementation
Mon May 11 14:00:00 2020 Alexey Tikhonov 1.16.5-4
- Resolves: rhbz#1829806 - [Bug] Reduce logging about flat names
- Resolves: rhbz#1800564 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
Thu May 7 14:00:00 2020 Alexey Tikhonov 1.16.5-3
- Resolves: rhbz#1683946 - sssd or sssd-ad not updating their dependencies on \"yum update\" which breaks working setup
Thu Apr 23 14:00:00 2020 Alexey Tikhonov 1.16.5-2
- Resolves: rhbz#1513371 - [abrt] [faf] sssd: raise(): /usr/libexec/sssd/sssd_be[PROXY] killed by 6
- Resolves: rhbz#1568083 - subdomain lookup fails when certmaprule contains DN
- Resolves: rhbz#1781539 - PKINIT with KCM does not work
- Resolves: rhbz#1786341 - SSSD doesn\'t honour the customized ID view created in IPA
- Resolves: rhbz#1709818 - override_gid did not work for subdomain.
- Resolves: rhbz#1719718 - Validator warning issue : Attribute \'dns_resolver_op_timeout\' is not allowed in section \'domain/REMOVED\'. Check for typos
- Resolves: rhbz#1787067 - sssd (sssd_be) is consuming 100 CPU, partially due to failing mem-cache
- Resolves: rhbz#1822461 - background refresh task does not refresh updated netgroup entries
- Added missing \'Requires\' to resolves some of rpmdiff tool warnings
Fri Mar 20 13:00:00 2020 Alexey Tikhonov 1.16.5-1
- Resolves: rhbz#1796352 - Rebase SSSD for RHEL 7.9
Wed Mar 18 13:00:00 2020 Michal Židek - 1.16.4-38
- Resolves: rhbz#1789349 - id command taking 1+ minute for returning user
information
- Also updates spec file to not replace
/pam.d/sssd-shadowutils on update
Wed Jan 15 13:00:00 2020 Michal Židek - 1.16.4-37
- Resolves: rhbz#1784620 - Force LDAPS over 636 with AD Access Provider
- just bumping the version to fix generated dates in man pages
Tue Jan 14 13:00:00 2020 Michal Židek - 1.16.4-36
- Resolves: rhbz#1784620 - Force LDAPS over 636 with AD Access Provider
Mon Dec 2 13:00:00 2019 Michal Židek - 1.16.4-35
- Resolves: rhbz#1769755 - sssd failover leads to delayed and failed logins
Wed Nov 20 13:00:00 2019 Michal Židek - 1.16.4-34
- Resolves: rhbz#1768404 - automount on RHEL7 gives the message
\'lookup(sss): setautomntent: No such file or
directory\'
Thu Nov 7 13:00:00 2019 Michal Židek - 1.16.4-33
- Resolves: rhbz#1734056 - [sssd] RHEL 7.8 Tier 0 Localization
Sun Sep 29 14:00:00 2019 Michal Židek - 1.16.4-32
- Resolves: rhbz#1530741 - Trusted domain user logins succeed after using ipa
trustdomain-disable
Sun Sep 29 14:00:00 2019 Michal Židek - 1.16.4-31
- Resolves: rhbz#1746878 - Let IPA client read IPA objects via LDAP and not
a extdom plugin when resolving trusted users and
groups
Fri Sep 20 14:00:00 2019 Michal Židek - 1.16.4-30
- Resolves: rhbz#1530741 - Trusted domain user logins succeed after using
ipa trustdomain-disable
Fri Sep 20 14:00:00 2019 Michal Židek - 1.16.4-29
- Resolves: rhbz#1713352 - Implicit files domain gets activated when no
sssd.conf present and sssd is started
Thu Sep 19 14:00:00 2019 Michal Židek - 1.16.4-28
- Resolves: rhbz#1206221 - sssd should not always read entire autofs map from
ldap
Thu Sep 19 14:00:00 2019 Michal Židek - 1.16.4-27
- Resolves: rhbz#1657978 - SSSD is not refreshing cached user data for the
ipa sub-domain in a IPA/AD trust
Thu Sep 5 14:00:00 2019 Michal Židek - 1.16.4-26
- Resolves: rhbz#1541172 - ad_enabled_domains does not disable old subdomain
after a restart until a timer removes it
Thu Sep 5 14:00:00 2019 Michal Židek - 1.16.4-25
- Resolves: rhbz#1738674 - Paging not enabled when fetching external groups,
limits the number of external groups to 2000
Thu Sep 5 14:00:00 2019 Michal Židek - 1.16.4-24
- Resolves: rhbz#1650018 - SSSD doesn\'t clear cache entries for IDs
below min_id
Thu Sep 5 14:00:00 2019 Michal Židek - 1.16.4-23
- Resolves: rhbz#1724088 - negative cache does not use values from
\'filter_users\' config option for known domains
Wed Aug 14 14:00:00 2019 Michal Židek - 1.16.4-22
- Resolves: rhbz#1422618 - sssd does not failover to another IPA
server if just the KDC service fails
- Just bumping the version to work around \"build already exists\"
Fri Jun 7 14:00:00 2019 Michal Židek - 1.16.4-21
- Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization
- Rebuild japanese gmo file explicitly
Fri Jun 7 14:00:00 2019 Michal Židek - 1.16.4-20
- Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization
Tue May 28 14:00:00 2019 Jakub Hrozek - 1.16.4-19
- Resolves: rhbz#1707959 - sssd does not properly check GSS-SPNEGO
Tue May 28 14:00:00 2019 Jakub Hrozek - 1.16.4-18
- Resolves: rhbz#1710286 - The server error message is not returned if
password change fails
Tue May 28 14:00:00 2019 Jakub Hrozek - 1.16.4-17
- Resolves: rhbz#1711832 - The files provider does not handle resetOffline
properly
Mon May 20 14:00:00 2019 Michal Židek - 1.16.4-16
- Resolves: rhbz#1707759 - Error accessing files on samba share randomly
Mon May 20 14:00:00 2019 Jakub Hrozek - 1.16.4-15
- Resolves: rhbz#1685581 - Extend cached_auth_timeout to cover subdomains
/trusts
Mon Apr 15 14:00:00 2019 Michal Židek - 1.16.4-14
- Resolves: rhbz#1684979 - The HBAC code requires dereference to be enabled
and fails otherwise
Mon Apr 15 14:00:00 2019 Michal Židek - 1.16.4-12
- Resolves: rhbz#1576524 - RHEL STIG pointing sssd Packaging issue
- This was partially fixed by the rebase, but one
spec file change was missing.
Mon Apr 15 14:00:00 2019 Michal Židek - 1.16.4-12
- Resolves: rhbz#1524566 - FIPS mode breaks using pysss.so (sss_obfuscate)
Thu Apr 4 14:00:00 2019 Michal Židek - 1.16.4-11
- Resolves: rhbz#1350012 - kinit / sssd kerberos fail over
- Resolves: rhbz#720688 - [RFE] return multiple server addresses to the
Kerberos locator plugin
Thu Apr 4 14:00:00 2019 Michal Židek - 1.16.4-10
- Resolves: rhbz#1402056 - [RFE] Make 2FA prompting configurable
Thu Apr 4 14:00:00 2019 Michal Židek - 1.16.4-9
- Resolves: rhbz#1666819 - SSSD can trigger a NSS lookup when parsing the
filter_users/groups lists on startup, this can
block the startup
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-8
- Resolves: rhbz#1645461 - Slow ldb search causes blocking during startup
which might cause the registration to time out
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-7
- Resolves: rhbz#1685581 - Extend cached_auth_timeout to cover
subdomains / trusts
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-6
- Resolves: rhbz#1671138 - User is unable to perform sudo as a user on IPA
Server, even though `sudo -l` shows permissions
to do so
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-5
- Resolves: rhbz#1657806 - [RFE]: Optionally disable generating auto private
groups for subdomains of an AD provider
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-4
- Resolves: rhbz#1641131 - [RFE] Need an option in SSSD so that it will skip
GPOs that have groupPolicyContainers, unreadable
by SSSD.
- Resolves: rhbz#1660874 - CVE-2018-16838 sssd: improper implementation of
GPOs due to too restrictive permissions [rhel-7]
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-3
- Resolves: rhbz#1631656 - KCM: kinit: Matching credential not found while
getting default ccache
Fri Mar 29 13:00:00 2019 Michal Židek - 1.16.4-2
- Resolves: rhbz#1406678 - sssd service is starting before network service
- Resolves: rhbz#1616853 - SSSD always boots in Offline mode
Thu Mar 21 13:00:00 2019 Michal Židek - 1.16.4-1
- Resolves: rhbz#1658994 - Rebase SSSD to 1.16.x
Wed Mar 20 13:00:00 2019 Jakub Hrozek - 1.16.2-17
- Resolves: rhbz#1603311 - Enable generating user private groups only for
users with uid == gid where gid does not
correspond to a real LDAP group
Wed Nov 28 13:00:00 2018 Michal Židek - 1.16.2-16
- Resolves: rhbz#1602172 - SSSD\'s LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
Thu Nov 15 13:00:00 2018 Michal Židek - 1.16.2-15
- Resolves: rhbz#1622109 - SSSD not fetching all sudo rules from AD
Wed Nov 14 13:00:00 2018 Michal Židek - 1.16.2-14
- Resolves: rhbz#1619706 - sssd only sets the SELinux login context if it
differs from the default
Wed Sep 5 14:00:00 2018 Jakub Hrozek - 1.16.2-13
- Resolves: rhbz#1593756 - sssd needs to require a newer version of
libtalloc and libtevent to avoid an issue
in GPO processing
Thu Aug 9 14:00:00 2018 Fabiano Fidêncio - 1.16.2-12
- Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
- Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled
Thu Aug 2 14:00:00 2018 Jakub Hrozek - 1.16.2-11
- Resolves: rhbz#1602781 - Local users failed to login with same password
Wed Aug 1 14:00:00 2018 Jakub Hrozek - 1.16.2-10
- Resolves: rhbz#1586127 - Spurious check in the sssd nss memcache can cause the memory cache to be skipped
Thu Jul 26 14:00:00 2018 Jakub Hrozek - 1.16.2-9
- Resolves: rhbz#1522928 - sssd doesn\'t allow user with expired password
Thu Jul 26 14:00:00 2018 Jakub Hrozek - 1.16.2-8
- Resolves: rhbz#1607313 - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails
Fri Jul 13 14:00:00 2018 Fabiano Fidêncio - 1.16.2-7
- Resolves: rhbz#1600822 - SSSD bails out saving desktop profiles in case an invalid profile is found
Wed Jul 11 14:00:00 2018 Fabiano Fidêncio - 1.16.2-6
- Resolves: rhbz#1582975 - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers
Fri Jun 29 14:00:00 2018 Fabiano Fidêncio - 1.16.2-5
- Resolves: rhbz#1583725 - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries
- Resolves: rhbz#1416528 - sssd in cross realm trust configuration should be able to use AD KDCs from a client site defined in sssd.conf or a snippet
- Resolves: rhbz#1592964 - Groups go missing with PAC enabled in sssd
Mon Jun 25 14:00:00 2018 Fabiano Fidêncio - 1.16.2-4
- Resolves: rhbz#1590603 - EMBARGOED CVE-2018-10852 sssd: information leak from the sssd-sudo responder [rhel-7]
- Resolves: rhbz#1450778 - Full information regarding priority of lookup of principal in keytab not in man page
Fri Jun 22 14:00:00 2018 Fabiano Fidêncio - 1.16.2-3
- Resolves: rhbz#1494690 - kdcinfo files are not created for subdomains of a directly joined AD client
- Resolves: rhbz#1583343 - Login with sshkeys stored in ipa not working after update to RHEL-7.5
- Resolves: rhbz#1527662 - Handle conflicting e-mail addresses more gracefully
- Resolves: rhbz#1509691 - Document how to change the regular expression for SSSD so that group names with an AATT-sign can be parsed
Fri Jun 22 14:00:00 2018 Fabiano Fidêncio - 1.16.2-2
- Related: rhbz#1558498 - Rebase sssd to the latests upstream release of the 1.16 branch
Mon Jun 11 14:00:00 2018 Fabiano Fidêncio - 1.16.2-1
- Resolves: rhbz#1558498 - Rebase sssd to the latests upstream release of the 1.16 branch
- Resolves: rhbz#1523019 - Reset password with two factor authentication fails
- Resolves: rhbz#1534749 - Requesting an AD user\'s private group and then the user itself returns an emty homedir
- Resolves: rhbz#1537272 - SSH public key authentication keeps working after keys are removed from ID view
- Resolves: rhbz#1537279 - Certificate is not removed from cache when it\'s removed from the override
- Resolves: rhbz#1562025 - externalUser sudo attribute must be fully-qualified
- Resolves: rhbz#1577335 - /usr/libexec/sssd/sssd_autofs SIGABRT crash daily
- Resolves: rhbz#1508530 - How should sudo behave without sudoHost attribute?
- Resolves: rhbz#1546754 - The man page of sss_ssh_authorizedkeys can be enhanced to better explain how the keys are retrieved and how X.509 certificates can be used
- Resolves: rhbz#1572790 - getgrgid/getpwuid fails in setups with multiple domains if the first domain uses mid_id/max_id
- Resolves: rhbz#1561562 - sssd not honoring dyndns_server if the DNS update process is terminated with a signal
- Resolves: rhbz#1583251 - home dir disappear in sssd cache on the IPA master for AD users
- Resolves: rhbz#1514061 - ID override GID from Default Trust View is not properly resolved in case domain resolution order is set
- Resolves: rhbz#1571466 - Utilizing domain_resolution_order in sssd.conf breaks SELinux user map
- Resolves: rhbz#1571526 - SSSD with ID provider \'ad\' should give a warning in case the ldap schema is manually changed to something different than \'ad\'.
Thu May 31 14:00:00 2018 Fabiano Fidêncio - 1.16.0-25
- Resolves: rhbz#1547782 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process
Sat May 19 14:00:00 2018 Fabiano Fidêncio - 1.16.0-24
- Related: rhbz#1578291 - Samba can not register sss idmap module because it\'s using an outdated SMB_IDMAP_INTERFACE_VERSION
Fri May 18 14:00:00 2018 Fabiano Fidêncio - 1.16.0-23
- Resolves: rhbz#1578291 - Samba can not register sss idmap module because it\'s using an outdated SMB_IDMAP_INTERFACE_VERSION
Fri May 18 14:00:00 2018 Fabiano Fidêncio - 1.16.0-22
- Resolves: rhbz#1516266 - Give a more detailed debug and system-log message if krb5_init_context() failed
- Resolves: rhbz#1503802 - Smartcard authentication fails if SSSD is offline and \'krb5_store_password_if_offline = True\'
- Resolves: rhbz#1385665 - Incorrect error code returned from krb5_child (updated)
- Resolves: rhbz#1547234 - SSSD\'s GPO code ignores ad_site option
- Resolves: rhbz#1459348 - extend sss-certmap man page regarding priority processing
- Resolves: rhbz#1220767 - Group renaming issue when \"id_provider = ldap\" is set
- Resolves: rhbz#1538555 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000]
Wed Apr 25 14:00:00 2018 Jakub Hrozek - 1.16.0-21
- Resolves: rhbz#1565774 - After updating to RHEL 7.5 failing to clear the sssd cache
Fri Apr 20 14:00:00 2018 Fabiano Fidêncio - 1.16.0-20
- Resolves: rhbz#1566782 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash
Wed Feb 21 13:00:00 2018 Fabiano Fidêncio - 1.16.0-19
- Related: rhbzrhbz#1544943 - sssd goes offline when renewing expired ticket
Wed Feb 21 13:00:00 2018 Fabiano Fidêncio - 1.16.0-18
- Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
- Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket
Mon Feb 19 13:00:00 2018 Fabiano Fidêncio - 1.16.0-17
- Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
server
Tue Feb 6 13:00:00 2018 Fabiano Fidêncio - 1.16.0-16
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
on RHEL clients joined to AD via sssd [RHEL 7]
Wed Jan 24 13:00:00 2018 Fabiano Fidêncio - 1.16.0-15
- Resolves: rhbz#1517971 - AD Domain goes offline immediately during
subdomain initialization - IPA AD Trust
- Related: rhbz#1482555 - sysdb index improvements - missing ghost
attribute indexing, unneeded objectclass index
etc..
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
on RHEL clients joined to AD via sssd [RHEL 7]
- Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
gidNumber = 0
- Related: rhbz#1461899 - Loading enterprise principals doesn\'t work with
a primed cache
- Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Fri Dec 15 13:00:00 2017 Fabiano Fidêncio - 1.16.0-14
- Resolves: rhbz#1525644 - dbus-send unable to find user by CAC cert
Thu Dec 14 13:00:00 2017 Fabiano Fidêncio - 1.16.0-13
- Resolves: rhbz#1523010 - IPA user able to authenticate with revoked cert
on smart card
Mon Dec 11 13:00:00 2017 Fabiano Fidêncio - 1.16.0-12
- Resolves: rhbz#1512027 - NSS by-id requests are not checked against
max_id/min_id ranges before triggering the
backend
Fri Dec 8 13:00:00 2017 Fabiano Fidêncio - 1.16.0-11
- Related: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
- Resolves: rhbz#1523010 - IPA user able to authenticate with revoked
cert on smart card
- Resolves: rhbz#1520984 - getent output is not showing home directory
for IPA AD trusted user
- Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Wed Dec 6 13:00:00 2017 Fabiano Fidêncio - 1.16.0-10
- Resolves: rhbz#1421194 - SSSD doesn\'t use AD global catalog for
gidnumber lookup, resulting in unacceptable
delay for large forests
Fri Dec 1 13:00:00 2017 Fabiano Fidêncio - 1.16.0-9
- Resolves: rhbz#1482231 - sssd_nss consumes more memory until
restarted or machine swaps
- Resolves: rhbz#1512508 - SSSD fails to fetch group information after
switching IPA client to a non-default view
Thu Nov 30 13:00:00 2017 Fabiano Fidêncio - 1.16.0-8
- Resolves: rhbz#1490120 - SSSD complaining about corrupted mmap cache
and logging error in /var/log/messages and
/var/log/sssd/sssd_nss.log
Mon Nov 27 13:00:00 2017 Fabiano Fidêncio - 1.16.0-7
- Resolves: rhbz#1272214 - [RFE] Create a local per system report about
who can access that IDM client (attestation)
- Resolves: rhbz#1482555 - sysdb index improvements - missing ghost
attribute indexing, unneeded objectclass index
etc..
- Resolves: rhbz#888739 - Enumerating large number of users makes sssd_be
hog the cpu for a long time.
- Resolves: rhbz#1373547 - SSSD performance issue with malloc and brk
calls
- Resolves: rhbz#1472255 - Improve SSSD performance in the 7.5 release
Tue Nov 14 13:00:00 2017 Fabiano Fidêncio - 1.16.0-6
- Related: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Related: rhbz#1432010 - SSSD ships a drop-in configuration snippet in
/etc/systemd/system
- Related: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
Mon Nov 13 13:00:00 2017 Fabiano Fidêncio - 1.16.0-5
- Resolves: rhbz#1507614 - Improve Smartcard integration if multiple
certificates or multiple mapped identities are
available
- Related: rhbz#1499659 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database [rhel-7.5]
- Resolves: rhbz#1408294 - SSSD authentication fails when two IPA
accounts share an email address without a
clear way to debug the problem
- Resolves: rhbz#1502686 - crash - /usr/libexec/sssd/sssd_nss in
nss_setnetgrent_timeout
Sun Nov 12 13:00:00 2017 Fabiano Fidêncio - 1.16.0-4
- Related: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Related: rhbz#1459609 - When sssd is configured with id_provider proxy
and auth_provider ldap, login fails if the LDAP
server is not allowing anonymous binds.
Mon Nov 6 13:00:00 2017 Fabiano Fidêncio - 1.16.0-3
- Resolves: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
threads
Fri Nov 3 13:00:00 2017 Fabiano Fidêncio - 1.16.0-2
- Resolves: rhbz#1484376 - [RFE] Add a configuration option to SSSD to
disable the memory cache
- Resolves: rhbz#1327705 - Automatic creation of user private groups on
RHEL clients joined to AD via sssd [RHEL 7]
- Resolves: rhbz#1505277 - Race condition between refreshing the cr_domain
list and a request that is using the list can
cause a segfault is sssd_nss
- Resolves: rhbz#1462343 - document information on why SSSD does not use
host-based security filtering when processing
AD GPOs
- Resolves: rhbz#1498734 - sssd_be stuck in an infinite loop after
completing full refresh of sudo rules
- Resolves: rhbz#1400614 - [RFE] sssd should remember DNS sites from
first search
- Resolves: rhbz#1460724 - SYSLOG_IDENTIFIER is different
- Resolves: rhbz#1459609 - When sssd is configured with id_provider proxy
and auth_provider ldap, login fails if the LDAP
server is not allowing anonymous binds.
Fri Oct 20 14:00:00 2017 Fabiano Fidêncio - 1.16.0-1
- Resolves: rhbz#1469791 - Rebase SSSD to version 1.16+
- Resolves: rhbz#1132264 - Allow sssd to retrieve sudo rules of local
users whose sudo rules stored in ldap server
- Resolves: rhbz#1301740 - sssd can be marked offline if a trusted domain
is not reachable
- Resolves: rhbz#1399262 - Use TCP for kerberos with AD by default
- Resolves: rhbz#1416150 - RFE: Log to syslog when sssd cannot contact
servers, goes offline
- Resolves: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
- Resolves: rhbz#1454559 - python-sssdconfig doesn\'t parse hexadecimal debug
_level, resulting in set_option():
/usr/lib/python2.7/site-packages/SSSDConfig/__init__.py
killed by TypeError
- Resolves: rhbz#1456968 - MAN: document that attribute \'provider\' is not
allowed in section \'secrets\'
- Resolves: rhbz#1460689 - KCM/secrets: Storing many secrets in a rapid
succession segfaults the secrets responder
- Resolves: rhbz#1464049 - Idle nss file descriptors should be closed
- Resolves: rhbz#1468610 - sssd_be is utilizing more CPU during sudo rules
refresh
- Resolves: rhbz#1474711 - Querying the AD domain for external domain\'s ID can
mark the AD domain offline
- Resolves: rhbz#1479398 - samba shares with sssd authentication broken on 7.4
- Resolves: rhbz#1479983 - id root triggers an LDAP lookup
- Resolves: rhbz#1489895 - Issues with certificate mapping rules
- Resolves: rhbz#1490501 - sssd incorrectly checks \'try_inotify\' thinking it is
the wrong section
- Resolves: rhbz#1490913 - MAN: Document that full_name_format must be set if
the output of trusted domains user resolution should
be shortnames only
- Resolves: rhbz#1499659 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database [rhel-7.5]
- Resolves: rhbz#1461899 - Loading enterprise principals doesn\'t work with a
primed cache
- Resolves: rhbz#1482674 - SUDO doesn\'t work for IPA users on IPA clients after
applying ID Views for them in IPA server
- Resolves: rhbz#1486053 - Accessing IdM kerberos ticket fails while id mapping
is applied
- Resolves: rhbz#1486786 - sssd going in offline mode due to sudo search filter.
- Resolves: rhbz#1500087 - SSSD creates bad override search filter due to AD
Trust object with parenthesis
- Resolves: rhbz#1502713 - SSSD can crash due to ABI changes in libldb >= 1.2.0
(1.1.30)
- Resolves: rhbz#1461462 - sssd_client: add mutex protected call to the PAC
responder
- Resolves: rhbz#1489666 - Combination sssd-ad and postfix recieve incorrect
mail with asterisks or spaces
- Resolves: rhbz#1525052 - sssd_krb5_localauth_plugin fails to fallback to otheri
localname rules
Tue Oct 17 14:00:00 2017 Jakub Hrozek - 1.15.2-51
- Require the 7.5 libldb version which broke ABI
- Related: rhbz#1469791 - Rebase SSSD to version 1.16+
Wed Jun 21 14:00:00 2017 Jakub Hrozek - 1.15.2-50
- Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
connected to AD child domain
Wed Jun 21 14:00:00 2017 Jakub Hrozek - 1.15.2-49
- Resolves: rhbz#1450107 - SSSD doesn\'t handle conflicts between users
from trusted domains with the same name when
shortname user resolution is enabled
Fri Jun 16 14:00:00 2017 Jakub Hrozek - 1.15.2-48
- Resolves: rhbz#1459846 - krb5: properly handle \'password expired\'
information retured by the KDC during
PKINIT/Smartcard authentication
Thu Jun 15 14:00:00 2017 Jakub Hrozek - 1.15.2-47
- Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
most of the entries once the cleanup task kicks in
Thu Jun 15 14:00:00 2017 Jakub Hrozek - 1.15.2-46
- Resolves: rhbz#1455254 - Make domain available as user attribute
Thu Jun 8 14:00:00 2017 Jakub Hrozek - 1.15.2-45
- Resolves: rhbz#1449731 - IPA client cannot change AD Trusted User password
Thu Jun 8 14:00:00 2017 Jakub Hrozek - 1.15.2-44
- Resolves: rhbz#1457927 - getent failed to fetch netgroup information
after changing default_domain_suffix to
ADdomin in /etc/sssd/sssd.conf
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-43
- Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
properly in v 1.15
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-42
- Resolves: rhbz#1449728 - LDAP to IPA migration doesn\'t work in master
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-41
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Mon Jun 5 14:00:00 2017 Jakub Hrozek - 1.15.2-40
- Resolves: rhbz#1449729 - org.freedesktop.sssd.infopipe.GetUserGroups
does not resolve groups into names with AD
Thu Jun 1 14:00:00 2017 Jakub Hrozek - 1.15.2-39
- Resolves: rhbz#1450094 - Properly support IPA\'s promptusername config
option
Thu Jun 1 14:00:00 2017 Jakub Hrozek - 1.15.2-38
- Resolves: rhbz#1457644 - Segfault in access_provider = krb5 is set in
sssd.conf due to an off-by-one error when
constructing the child send buffer
- Resolves: rhbz#1456531 - Option name typos are not detected with validator
function of sssctl config-check command in domain
sections
Fri May 26 14:00:00 2017 Jakub Hrozek - 1.15.2-37
- Resolves: rhbz#1428906 - sssd intermittently failing to resolve groups
for an AD user in IPA-AD trust environment.
Fri May 26 14:00:00 2017 Jakub Hrozek - 1.15.2-36
- Resolves: rhbz#1389796 - Smartcard authentication with UPN as logon name
might fail
- Fix Coverity issues in patches for rhbz#1445445
Wed May 24 14:00:00 2017 Jakub Hrozek - 1.15.2-35
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Wed May 24 14:00:00 2017 Jakub Hrozek - 1.15.2-34
- Resolves: rhbz#1446302 - crash in sssd-kcm due to a race-condition
between two concurrent requests
Tue May 23 14:00:00 2017 Jakub Hrozek - 1.15.2-33
- Resolves: rhbz#1389796 - Smartcard authentication with UPN as logon name might fail
Tue May 23 14:00:00 2017 Jakub Hrozek - 1.15.2-32
- Resolves: rhbz#1306707 - Need better debug message when krb5_child
returns an unhandled error, leading to a
System Error PAM code
Mon May 22 14:00:00 2017 Jakub Hrozek - 1.15.2-31
- Resolves: rhbz#1446535 - Group resolution does not work in subdomain
without ad_server option
Wed May 17 14:00:00 2017 Sumit Bose - 1.15.2-30
- Resolves: rhbz#1449726 - sss_nss_getlistbycert() does not return results from
multiple domains
- Resolves: rhbz#1447098 - sssd unable to search dbus for ipa user by
certificate
- Additional patch for rhbz#1440132
Thu May 11 14:00:00 2017 Jakub Hrozek - 1.15.2-29
- Reapply patch by Lukas Slebodnik to fix upgrade issues with libwbclient
- Resolves: rhbz#1439457 - SSSD does not start after upgrade from 7.3 to 7.4
- Resolves: rhbz#1449107 - error: %pre(sssd-common-1.15.2-26.el7.x86_64)
scriptlet failed, exit status 3
Thu May 11 14:00:00 2017 Jakub Hrozek - 1.15.2-28
- Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
properly in v 1.15
- Also apply an additional patch for rhbz#1441545
Thu May 4 14:00:00 2017 Jakub Hrozek - 1.15.2-25
- Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
IdM user and AD user
Wed May 3 14:00:00 2017 Jakub Hrozek - 1.15.2-24
- Resolves: rhbz#1434992 - Wrong pam return code for user from subdomain
with ad_access_filter
Wed May 3 14:00:00 2017 Lukas Slebodnik - 1.15.2-23
- Resolves: rhbz#1430494 - expect sss_ssh_authorizedkeys and
sss_ssh_knownhostsproxy manuals to be packaged
into sssd-common package
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-22
- Resolves: rhbz#1427749 - SSSD in server mode iterates over all domains
for group-by-GID requests, causing unnecessary
searches
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-21
- Resolves: rhbz#1446139 - Infopipe method ListByCertificate does not
return the users with overrides
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-20
- Resolves: rhbz#1441545 - With multiple subdomain sections id command
output for user is not displayed for both domains
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-19
- Resolves: rhbz#1428866 - Using ad_enabled_domains configuration option
in sssd.conf causes nameservice lookups to fail.
Tue May 2 14:00:00 2017 Jakub Hrozek - 1.15.2-18
- Remove an unused variable from the sssd-secrets responder
- Related: rhbz#1398701 - [sssd-secrets] https proxy talks plain http
- Improve two DEBUG messages in the client trust code to aid troubleshooting
- Fix standalone application domains
- Related: rhbz#1425891 - Support delivering non-POSIX users and groups
through the IFP and PAM interfaces
Wed Apr 26 14:00:00 2017 Jakub Hrozek - 1.15.2-17
- Allow completely server-side unqualified name resolution if the domain order is set,
do not require any client-side changes
- Related: rhbz#1330196 - [RFE] Short name input format with SSSD for users from
all domains when domain autodiscovery is used or when
IPA client resolves trusted AD domain users
Mon Apr 24 14:00:00 2017 Jakub Hrozek - 1.15.2-16
- Resolves: rhbz#1402532 - D-Bus interface of sssd is giving inappropriate
group information for trusted AD users
Thu Apr 13 14:00:00 2017 Jakub Hrozek - 1.15.2-15
- Resolves: rhbz#1431858 - Wrong principal found with ad provider and long
host name
Wed Apr 12 14:00:00 2017 Jakub Hrozek - 1.15.2-14
- Resolves: rhbz#1415167 - pam_acct_mgmt with pam_sss.so fails in
unprivileged container unless
selinux_provider = none is used
Wed Apr 12 14:00:00 2017 Jakub Hrozek - 1.15.2-13
- Resolves: rhbz#1438388 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_pam killed by 6
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-12
- Resolves: rhbz#1432112 - sssctl config-check does not give any error
when default configuration file is not present
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-11
- Resolves: rhbz#1438374 - [abrt] [faf] sssd: vfprintf():
/usr/libexec/sssd/sssd_be killed by 11
Tue Apr 11 14:00:00 2017 Jakub Hrozek - 1.15.2-10
- Resolves: rhbz#1427195 - sssd_nss consumes more memory until restarted
or machine swaps
Mon Apr 10 14:00:00 2017 Jakub Hrozek - 1.15.2-9
- Resolves: rhbz#1414023 - Create troubleshooting tool to determine if a
failure is in SSSD or not when using layered
products like RH-SSO/CFME etc
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-8
- Resolves: rhbz#1398701 - [sssd-secrets] https proxy talks plain http
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-7
- Fix off-by-one error in the KCM responder
- Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Thu Mar 30 14:00:00 2017 Jakub Hrozek - 1.15.2-6
- Resolves: rhbz#1425891 - Support delivering non-POSIX users and groups
through the IFP and PAM interfaces
Wed Mar 29 14:00:00 2017 Jakub Hrozek - 1.15.2-5
- Resolves: rhbz#1434991 - Issue processing ssh keys from certificates in
ssh respoder
Wed Mar 29 14:00:00 2017 Jakub Hrozek - 1.15.2-4
- Resolves: rhbz#1330196 - [RFE] Short name input format with SSSD for
users from all domains when domain autodiscovery
is used or when IPA client resolves trusted AD
domain users
- Also backport some buildtime fixes for the KCM responder
- Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Mon Mar 27 14:00:00 2017 Jakub Hrozek - 1.15.2-3
- Resolves: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD
Thu Mar 23 13:00:00 2017 Jakub Hrozek - 1.15.2-2
- Resolves: rhbz#1340711 - [RFE] Use one smartcard and certificate for
authentication to distinct logon accounts
Wed Mar 15 13:00:00 2017 Jakub Hrozek - 1.15.2-1
- Update to upstream 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Resolves: rhbz#1418728 - IPA - sudo does not handle associated conflict
entries
- Resolves: rhbz#1386748 - sssd doesn\'t update PTR records if A/PTR zones
are configured as non-secure and secure
- Resolves: rhbz#1214491 - [RFE] Make it possible to configure AD subdomain
in the SSSD server mode
Thu Mar 9 13:00:00 2017 Fabiano Fidêncio - 1.15.1-2
- Drop \"NOUPSTREAM: Bundle http-parser\" patch
Related: rhbz#1393819 - New package: http-parser
Sat Mar 4 13:00:00 2017 Jakub Hrozek - 1.15.1-1
- Update to upstream 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- Resolves: rhbz#1327085 - Don\'t prompt for password if there is already
one on the stack
- Resolves: rhbz#1378722 - [RFE] Make GETSIDBYNAME and GETORIGBYNAME
request aware of UPNs and aliases
- Resolves: rhbz#1405075 - [RFE] Add PKINIT support to SSSD Kerberos provider
- Resolves: rhbz#1416526 - Need correction in sssd-krb5 man page
- Resolves: rhbz#1418752 - pam_sss crashes in do_pam_conversation if no
conversation function is provided by the
client app
- Resolves: rhbz#1419356 - Fails to accept any sudo rules if there are
two user entries in an ldap role with the same
sudo user
- Resolves: rhbz#1421622 - SSSD - Users/Groups are cached as mixed-case
resulting in users unable to sign in
Wed Feb 1 13:00:00 2017 Jakub Hrozek - 1.15.0-2
- Fix several packaging issues, notably the p11_child is no longer setuid
and the libwbclient used a wrong version number in the symlink
Mon Jan 30 13:00:00 2017 Jakub Hrozek - 1.15.0-1
- Update to upstream 1.15.0
- Resolves: rhbz#1393824 - Rebase SSSD to version 1.15
- Resolves: rhbz#1407960 - wbcLookupSid() fails in pdomain is NULL
- Resolves: rhbz#1406437 - sssctl netgroup-show Cannot allocate memory
- Resolves: rhbz#1400422 - Use-after free in resolver in case the fd is
writeable and readable at the same time
- Resolves: rhbz#1393085 - bz - ldap group names don\'t resolve after
upgrading sssd to 1.14.0 if ldap_nesting_level is set to 0
- Resolves: rhbz#1392444 - sssd_be keeps crashing
- Resolves: rhbz#1392441 - sssd fails to start after upgrading to RHEL 7.3
- Resolves: rhbz#1382602 - autofs map resolution doesn\'t work offline
- Resolves: rhbz#1380436 - sudo: ignore case on case insensitive domains
- Resolves: rhbz#1378251 - Typo In SSSD-AD Man Page
- Resolves: rhbz#1373427 - Clock skew makes SSSD return System Error
- Resolves: rhbz#1306707 - Need better handling of \"Server not found in
Kerberos database\"
- Resolves: rhbz#1297462 - Don\'t include \'enable_only=sssd\' in the localauth
plugin config
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-46
- Resolves: rhbz#1382598 - IPA: Uninitialized variable during subdomain check
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-45
- Resolves: rhbz#1378911 - No supplementary groups are resolved for users
in nested OUs when domain stanza differs from AD
domain
Mon Nov 7 13:00:00 2016 Jakub Hrozek - 1.14.0-44
- Resolves: rhbz#1372075 - AD provider: SSSD does not retrieve a domain-local
group with the AD provider when following AGGUDLP
group structure across domains
Tue Sep 20 14:00:00 2016 Jakub Hrozek - 1.14.0-43
- Resolves: rhbz#1376831 - sssd-common is missing dependency on sssd-sudo
Fri Sep 16 14:00:00 2016 Jakub Hrozek - 1.14.0-42
- Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
smartcard authentication is not enabled
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-41
- Resolves: rhbz#1373420 - sss_override fails to export
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-40
- Resolves: rhbz#1375299 - sss_groupshow fails with error \"No such
group in local domain. Printing groups only
allowed in local domain\"
Wed Sep 14 14:00:00 2016 Jakub Hrozek - 1.14.0-39
- Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
sizelimit exceeded
Mon Sep 12 14:00:00 2016 Jakub Hrozek - 1.14.0-38
- Resolves: rhbz#1372753 - Access denied for user when access_provider =
krb5 is set in sssd.conf
Mon Sep 12 14:00:00 2016 Jakub Hrozek - 1.14.0-37
- Resolves: rhbz#1373444 - unable to create group in sssd cache
- Resolves: rhbz#1373577 - unable to add local user in sssd to a group in sssd
Wed Sep 7 14:00:00 2016 Jakub Hrozek - 1.14.0-36
- Resolves: rhbz#1369118 - Don\'t enable the default shadowtils domain in RHEL
Mon Sep 5 14:00:00 2016 Jakub Hrozek - 1.14.0-35
- Fix permissions for the private pipe directory
- Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-34
- Resolves: rhbz#1371977 - resolving IPA nested user groups is broken in 1.14
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-33
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
Fri Sep 2 14:00:00 2016 Jakub Hrozek - 1.14.0-32
- Resolves: rhbz#1371152 - SSSD qualifies principal twice in IPA-AD trust
if the principal attribute doesn\'t exist on the
AD side
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-31
- Apply forgotten patch
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
- Resolves: rhbz#1366470 - sssd: throw away the timestamp cache if
re-initializing the persistent cache
- Fix deleting non-existent secret
- Related: rhbz#1311056 - Add a Secrets as a Service component
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-30
- Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-29
- Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
Fri Aug 26 14:00:00 2016 Jakub Hrozek - 1.14.0-28
- Resolves: rhbz#1364033 - sssd exits if clock is adjusted backwards
after boot
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-27
- Resolves: rhbz#1362023 - SSSD fails to start when ldap_user_extra_attrs
contains mail
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-26
- Resolves: rhbz#1368324 - libsss_autofs.so is packaged in two packages
sssd-common and libsss_autofs
Fri Aug 19 14:00:00 2016 Jakub Hrozek - 1.14.0-25
- Fix RPM scriptlet plumbing for the sssd-secrets responder
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-24
- Add socket-activation plumbing for the sssd-secrets responder
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-23
- Own the secrets directory
- Related: rhbz#1311056 - Add a Secrets as a Service component
Wed Aug 17 14:00:00 2016 Jakub Hrozek - 1.14.0-22
- Resolves: rhbz#1268874 - Add an option to disable checking for trusted
domains in the subdomains provider
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-21
- Resolves: rhbz#1271280 - sssd stores and returns incorrect information
about empty netgroup (ldap-server: 389-ds)
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-20
- Resolves: rhbz#1290500 - [feat] command to manually list
fo_add_server_to_list information
Tue Aug 16 14:00:00 2016 Jakub Hrozek - 1.14.0-19
- Add several small fixes related to the config API
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Thu Aug 11 14:00:00 2016 Jakub Hrozek - 1.14.0-18
- Resolves: rhbz#1349900 - gpo search errors out and gpo_cache file is
never created
Wed Aug 10 14:00:00 2016 Jakub Hrozek - 1.14.0-17
- Fix regressions in the simple access provider
- Resolves: rhbz#1360806 - sssd does not start if sub-domain user is used
with simple access provider
- Apply a number of specfile patches to better match the upstream spefile
- Related: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
Wed Aug 10 14:00:00 2016 Jakub Hrozek - 1.14.0-16
- Cherry-pick patches from upstream that fix several regressions
- Avoid checking local users in all cases
- Resolves: rhbz#1353951 - sssd_pam leaks file descriptors
Mon Aug 8 14:00:00 2016 Jakub Hrozek - 1.14.0-15
- Resolves: rhbz#1364118 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_nss killed by 11
- Resolves: rhbz#1361563 - Wrong pam error code returned for password
change in offline mode
Fri Jul 29 14:00:00 2016 Jakub Hrozek - 1.14.0-14
- Resolves: rhbz#1309745 - Support multiple principals for IPA users
Fri Jul 29 14:00:00 2016 Jakub Hrozek - 1.14.0-13
- Resolves: rhbz#1304992 - Handle overriden name of members in the
memberUid attribute
Wed Jul 27 14:00:00 2016 Jakub Hrozek - 1.14.0-12
- handle unresolvable sites more gracefully
- Resolves: rhbz#1346011 - sssd is looking at a server in the GC of a
subdomain, not the root domain.
- fix compilation warnings in unit tests
Wed Jul 27 14:00:00 2016 Jakub Hrozek - 1.14.0-11
- fix capaths output
- Resolves: rhbz#1344940 - GSSAPI error causes failures for child domain
user logins across IPA - AD trust
- also fix Coverity issues in the secrets responder and suppress noisy
debug messages when setting the timestamp cache
Tue Jul 19 14:00:00 2016 Jakub Hrozek - 1.14.0-10
- Resolves: rhbz#1356577 - sssctl: Time stamps without time zone information
Tue Jul 19 14:00:00 2016 Jakub Hrozek - 1.14.0-9
- Resolves: rhbz#1354414 - New or modified ID-View User overrides are not
visible unless rm -f /var/lib/sss/db/
*cache
*
Mon Jul 18 14:00:00 2016 Jakub Hrozek - 1.14.0-8
- Resolves: rhbz#1211631 - [RFE] Support of UPN for IdM trusted domains
Thu Jul 14 14:00:00 2016 Jakub Hrozek - 1.14.0-7
- Resolves: rhbz#1350520 - [abrt] sssd-common: ipa_dyndns_update_send():
sssd_be killed by SIGSEGV
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-6
- Resolves: rhbz#1349882 - sssd does not work under non-root user
- Also cherry-pick a few patches from upstream to fix config schema
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-5
- Sync a few minor patches from upstream
- Fix sssctl manpage
- Fix nss-tests unit test on big-endian machines
- Fix several issues in the config schema
- Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Wed Jul 13 14:00:00 2016 Jakub Hrozek - 1.14.0-4
- Bundle http-parser
- Resolves: rhbz#1311056 - Add a Secrets as a Service component
Tue Jul 12 14:00:00 2016 Jakub Hrozek - 1.14.0-3
- Sync a few minor patches from upstream
- Fix a failover issue
- Resolves: rhbz#1334749 - sssd fails to mark a connection as bad on
searches that time out
Mon Jul 11 14:00:00 2016 Jakub Hrozek - 1.14.0-2
- Explicitly BuildRequire newer ding-libs
- Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
Fri Jul 8 14:00:00 2016 Jakub Hrozek - 1.14.0-1
- New upstream release 1.14.0
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- Resolves: rhbz#835492 - [RFE] SSSD admin tool request - force reload
- Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
- Resolves: rhbz#1278691 - Please fix rfc2307 autofs schema defaults
- Resolves: rhbz#1287209 - default_domain_suffix Appended to User Name
- Resolves: rhbz#1300663 - Improve sudo protocol to support configurations
with default_domain_suffix
- Resolves: rhbz#1312275 - Support authentication indicators from IPA
Thu Jun 30 14:00:00 2016 Jakub Hrozek - 1.14.0beta1-2
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- Resolves: rhbz#790113 - [RFE] \"include\" directive in sssd.conf
- Resolves: rhbz#874985 - [RFE] AD provider support for automount lookups
- Resolves: rhbz#879333 - [RFE] SSSD admin tool request - status overview
- Resolves: rhbz#1140022 - [RFE]Allow sssd to add a new option that would
specify which server to update DNS with
- Resolves: rhbz#1290380 - RFE: Improve SSSD performance in large
environments
- Resolves: rhbz#883886 - sssd: incorrect checks on length values during
packet decoding
- Resolves: rhbz#988207 - sssd does not detail which line in configuration
is invalid
- Resolves: rhbz#1007969 - sssd_cache does not remove have an option to
remove the sssd database
- Resolves: rhbz#1103249 - PAC responder needs much time to process large
group lists
- Resolves: rhbz#1118257 - Users in ipa groups, added to netgroups are
not resovable
- Resolves: rhbz#1269018 - Too much logging from sssd_be
- Resolves: rhbz#1293695 - sssd mixup nested group from AD trusted domains
- Resolves: rhbz#1308935 - After removing certificate from user in IPA
and even after sss_cache, FindByCertificate
still finds the user
- Resolves: rhbz#1315766 - SSSD PAM module does not support multiple
password prompts (e.g. Password + Token) with sudo
- Resolves: rhbz#1316164 - SSSD fails to process GPO from Active Directory
- Resolves: rhbz#1322458 - sssd_be[11010]: segfault at 0 ip 00007ff889ff61bb
sp 00007ffc7d66a3b0 error 4 in
libsss_ipa.so[7ff889fcf000+5d000]
Mon Jun 20 14:00:00 2016 Jakub Hrozek - 1.14.0alpha-1
- Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
- The rebase includes fixes for the following bugzillas:
- Resolves: rhbz#789477 - [RFE] SUDO: Support the IPA schema
- Resolves: rhbz#1059972 - RFE: SSSD: Automatically assign new slices for
any AD domain
- Resolves: rhbz#1233200 - man sssd.conf should clarify details about
subdomain_inherit option.
- Resolves: rhbz#1238144 - Need better libhbac debuging added to sssd
- Resolves: rhbz#1265366 - sss_override segfaults when accidentally adding
--help flag to some commands
- Resolves: rhbz#1269512 - sss_override: memory violation
- Resolves: rhbz#1278566 - crash in sssd when non-Englsh locale is used
and pam_strerror prints non-ASCII characters
- Resolves: rhbz#1283686 - groups get deleted from the cache
- Resolves: rhbz#1290378 - Smart Cards: Certificate in the ID View
- Resolves: rhbz#1292238 - extreme memory usage in libnfsidmap sss.so
plug-in when resolving groups with many members
- Resolves: rhbz#1292456 - sssd_be AD segfaults on missing A record
- Resolves: rhbz#1294670 - Local users with local sudo rules causes
LDAP queries
- Resolves: rhbz#1296618 - Properly remove OriginalMemberOf attribute in
SSSD cache if user has no secondary groups anymore
- Resolves: rhbz#1299553 - Cannot retrieve users after upgrade from 1.12
to 1.13
- Resolves: rhbz#1302821 - Cannot start sssd after switching to non-root
- Resolves: rhbz#1310877 - [RFE] Support Automatic Renewing of Kerberos
Host Keytabs
- Resolves: rhbz#1313014 - sssd is not closing sockets properly
- Resolves: rhbz#1318996 - SSSD does not fail over to next GC
- Resolves: rhbz#1327270 - local overrides: issues with sub-domain users
and mixed case names
- Resolves: rhbz#1342547 - sssd-libwbclient: wbcSidsToUnixIds should not
fail on lookup errors
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-50
- Build the PAC plugin with krb5-1.14
- Related: rhbz#1336688 - sssd tries to resolve global catalog servers
from AD forest sub-domains in AD-IPA trust setup
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-49
- Resolves: rhbz#1336688 - sssd tries to resolve global catalog servers
from AD forest sub-domains in AD-IPA trust setup
Tue May 24 14:00:00 2016 Jakub Hrozek - 1.13.0-48
- Resolves: rhbz#1290853 - [sssd] Trusted (AD) user\'s info stays in sssd
cache for much more than expected.
Mon May 23 14:00:00 2016 Jakub Hrozek - 1.13.0-47
- Resolves: rhbz#1336706 - sssd_nss memory usage keeps growing when trying
to retrieve non-existing netgroups
Tue May 17 14:00:00 2016 Jakub Hrozek - 1.13.0-46
- Resolves: rhbz#1296902 - In IPA-AD trust environment access is granted
to AD user even if the user is disabled on AD.
Tue May 17 14:00:00 2016 Jakub Hrozek - 1.13.0-45
- Resolves: rhbz#1334159 - IPA provider crashes if a netgroup from a
trusted domain is requested
Mon Apr 18 14:00:00 2016 Jakub Hrozek - 1.13.0-44
- Resolves: rhbz#1308913 - sssd be memory leak in sssd\'s memberof plugin
- More patches from upstream related to the memory leak
Fri Apr 1 14:00:00 2016 Jakub Hrozek - 1.13.0-43
- Resolves: rhbz#1308913 - sssd be memory leak in sssd\'s memberof plugin
Wed Feb 24 13:00:00 2016 Jakub Hrozek - 1.13.0-42
- Resolves: rhbz#1300740 - [RFE] IPA: resolve external group memberships
of IPA groups during getgrnam and getgrgid
Tue Nov 24 13:00:00 2015 Jakub Hrozek - 1.13.0-41
- Resolves: rhbz#1284814 - sssd: [sysdb_add_user] (0x0400): Error: 17
Wed Oct 14 14:00:00 2015 Jakub Hrozek - 1.13.0-40
- Resolves: rhbz#1270827 - local overrides: don\'t contact server with
overridden name/id
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-39
- Resolves: rhbz#1267837 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-38
- Resolves: rhbz#1267176 - Memory leak / possible DoS with krb auth.
Wed Oct 7 14:00:00 2015 Jakub Hrozek - 1.13.0-37
- Resolves: rhbz#1267836 - PAM responder crashed if user was not set
Wed Sep 30 14:00:00 2015 Jakub Hrozek - 1.13.0-36
- Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
uninitialised value
Wed Sep 23 14:00:00 2015 Jakub Hrozek - 1.13.0-35
- Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
subdomain code
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-34
- Fix a Coverity warning in dyndns code
- Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
of processing other commands
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-33
- Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
of processing other commands
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-32
- Resolves: rhbz#1263735 - Could not resolve AD user from root domain
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-31
- Remove -d from sss_override manpage
- Related: rhbz#1259512 - sss_override : The local override user is not found
Tue Sep 22 14:00:00 2015 Jakub Hrozek - 1.13.0-30
- Patches required for better handling of failover with one-way trusts
- Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain
code
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-29
- Resolves: rhbz#1263587 - sss_override --name doesn\'t work with RFC2307
and ghost users
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-28
- Resolves: rhbz#1259512 - sss_override : The local override user is not found
Fri Sep 18 14:00:00 2015 Jakub Hrozek - 1.13.0-27
- Resolves: rhbz#1260027 - sssd_be memory leak with sssd-ad in GPO code
Tue Sep 1 14:00:00 2015 Jakub Hrozek - 1.13.0-26
- Resolves: rhbz#1256398 - sssd cannot resolve user names containing
backslash with ldap provider
Tue Aug 25 14:00:00 2015 Martin Kosek - 1.13.0-25
- Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug
but is not listed in the man page or in
the arguments help
Thu Aug 20 14:00:00 2015 Jakub Hrozek - 1.13.0-24
- Resolves: rhbz#1254518 - Fix crash in nss responder
Thu Aug 20 14:00:00 2015 Jakub Hrozek - 1.13.0-23
- Support import/export for local overrides
- Support FQDNs for local overrides
- Resolves: rhbz#1254184 - sss_override does not work correctly when
\'use_fully_qualified_names = True\'
Tue Aug 18 14:00:00 2015 Jakub Hrozek - 1.13.0-22
- Resolves: rhbz#1244950 - Add index for \'objectSIDString\' and maybe to
other cache attributes
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-21
- Resolves: rhbz#1250415 - sssd: p11_child hardening
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-20
- Related: rhbz#1250135 - Detect re-established trusts in the IPA
subdomain code
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-19
- Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC
identity certificates
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-18
- Resolves: rhbz#1232950 - [IPA/IdM] sudoOrder not honored as expected
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-17
- Fix wildcard_limit=0
- Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-16
- Fix race condition in invalidating the memory cache
- Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
Mon Aug 17 14:00:00 2015 Jakub Hrozek - 1.13.0-15
- Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo
enabled
Thu Aug 6 14:00:00 2015 Jakub Hrozek - 1.13.0-14
- Bump release number
- Related: rhbz#1246489 - sss_obfuscate fails with \"ImportError: No module
named pysss\"
Thu Aug 6 14:00:00 2015 Lukas Slebodnik - 1.13.0-13
- Fix missing dependency of sssd-tools
- Resolves: rhbz#1246489 - sss_obfuscate fails with \"ImportError: No module
named pysss\"
Wed Aug 5 14:00:00 2015 Jakub Hrozek - 1.13.0-12
- More memory cache related fixes
- Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-11
- Remove binary blob from SC patches as patch(1) can\'t handle those
- Related: rhbz#854396 - [RFE] Support for smart cards
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-10
- Resolves: rhbz#1244949 - getgrgid for user\'s UID on a trust client
prevents getpw
*
Tue Aug 4 14:00:00 2015 Jakub Hrozek - 1.13.0-9
- Fix memory cache integration tests
- Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
- Resolves: rhbz#854396 - [RFE] Support for smart cards
Tue Jul 28 14:00:00 2015 Jakub Hrozek - 1.13.0-8
- Remove OTP from PAM stack correctly
- Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when
user logs in with password and token code from IPA
- Handle sssd-owned keytabs when sssd runs as root
- Related: rhbz#1205144 - RFE: Support one-way trusts for IPA
Mon Jul 27 14:00:00 2015 Jakub Hrozek - 1.13.0-7
- Resolves: rhbz#1183747 - [FEAT] UID and GID mapping on individual clients
Fri Jul 24 14:00:00 2015 Jakub Hrozek - 1.13.0-6
- Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
- Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant
v6 in ipa domain
Fri Jul 17 14:00:00 2015 Jakub Hrozek - 1.13.0-5 | |
