FreeIPA-users September 2023

freeipa-users@lists.fedorahosted.org

55 participants
73 discussions

[SSSD] Announcing SSSD 2.9.2
by Pavel Březina 07 Sep '23

07 Sep '23

# SSSD 2.9.2 The SSSD team is announcing the release of version 2.9.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.2 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights SSSD 2.9 branch is now in long-term maintenance (LTM) phase. ### General information * `libkrb5-1.21` can now be used to build PAC plugin. * `sssctl cert-show` and `cert-show cert-eval-rule` can now be run as non-root user. ### Important fixes * SSSD does no longer crash if PIN is introduced but the tactile trigger isn't pressed during passkey authentication. * SSSD can now recover if memory-cache files under `/var/lib/sss/mc` where truncated while SSSD is running. * Chaining of identical D-Bus requests that run in parallel to avoid multiple backend queries works again. ### Configuration changes * New option `local_auth_policy` is added to control which offline authentication methods will be enabled by SSSD. This option is relevant for authentication methods which have online, and offline capability such as passkey, and smartcard authentication. The default value `match` sets the offline methods to their corresponding online value. This enables offline authentication when online kerberos pre-authentication such as PKINIT, or passkey is supported by the backend, note that online methods will still be attempted first. Option value `only` can be used to disable online authentication entirely, or the value `enable:method` to explicitly enable specific authentication methods, e.g. `enable:passkey`.

1 0

2FA only for certain hosts/host groups
by Ronald Wimmer 04 Sep '23

04 Sep '23

Is it possible to enforce the second factor for a user only when trying to login to specific hosts/host groups? List here says yes... https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-indi… I'm gonna give it a try. Cheers, Ronald

2 4

dyndns update question
by alexey safonov 03 Sep '23

03 Sep '23

Hi, I'm not sure if it's related to freeipa or not, but we have home users, who are using forticlient VPN. And everytime they are connected forti generates new ifname with name like vpn0086432eee / vpn0001d1e094 /etc. Would it be possible to change sssd to use dyndns_ifname with wildcard? like vpn* Alex

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023