sssd-devel October 2013

sssd-devel@lists.fedorahosted.org

19 participants
84 discussions

Announcing SSSD 1.11.2
by Jakub Hrozek 31 Oct '13

31 Oct '13

=== SSSD 1.11.2 === The SSSD team is proud to announce the release of version 1.11.2 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19, 20 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * A new option ad_access_filter was added. This option allows the administrator to easily configure LDAP search filter that the users logging in must match in order to be granted access * Group resolution now supports resolving group members from different trusted AD domains in a single forest * A bug that prevented a configuration file with trailing spaces to be loaded was fixed * SSSD no longer crashes if the LDAP connection is terminated while LDAP requests are still in progress * Several important bugs related to the Global Catalog support were fixed: * SSSD now correctly falls back to LDAP lookups in case Global Catalog is not reachable * If the AD servers were specified using the ad_server option and not autodiscovered, server fail over did not work correctly with 1.11.1 == Feature removal == * The Kerberos provider is no longer able to create public directories when evaluating the krb5_ccachedir option. This is a backwards-incompatible change. Creating public directories is something the system administrator should perform in order for the directories to have the correct permissions and allow the authentication daemon to create user directories as private only. == Documentation Changes == * The decimal debug levels are now recommended instead of the advanced hexadecimal levels which are more suitable for developers == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1968 Memory grows if subdomain goes away in the AD provider https://fedorahosted.org/sssd/ticket/2030 getent response requires sssd restart after trust add https://fedorahosted.org/sssd/ticket/2064 ad: unable to resolve membership when user is from different domain than group https://fedorahosted.org/sssd/ticket/2071 Ccache directory creation leads to unexpected results https://fedorahosted.org/sssd/ticket/2082 [RFE] Add a new option ad_access_filter https://fedorahosted.org/sssd/ticket/2092 Group lookup is not returned immediately after service startup https://fedorahosted.org/sssd/ticket/2100 sudo responder does not support specifying just one of sudoNotBefore/sudoNotAfter https://fedorahosted.org/sssd/ticket/2101 Use idrange of forest root if there is none for a member domain and type is ipa-ad-trust-posix https://fedorahosted.org/sssd/ticket/2104 AD provider should fall back the LDAP if Global Catalog is not reachable https://fedorahosted.org/sssd/ticket/2105 Do not show 'Could not add new domain' error messages if ldap_id_mapping=false https://fedorahosted.org/sssd/ticket/2112 Coverity reported potential NULL dereference https://fedorahosted.org/sssd/ticket/2116 SID looksups are not handled if noexist_delete flag is set https://fedorahosted.org/sssd/ticket/2121 ipa ad trusted user lookups failed with sssd_be crash https://fedorahosted.org/sssd/ticket/2123 Creating system accounts on a IdM client takes up to 10 minutes when AD trust is configured in the IdM. https://fedorahosted.org/sssd/ticket/2124 sssd_nss exited abnormally and generated core files. https://fedorahosted.org/sssd/ticket/2126 sssd_be segfault when authenticating against active directory https://fedorahosted.org/sssd/ticket/2131 NSS responder doesn't qualify memberuid and ghost users of groups that contain members from different domains == Detailed Changelog == Jakub Hrozek (23): * Updating the version for the 1.11.2 release * krb5: Fix unit tests * INI: Disable line-wrapping functionality * KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user * PROXY: Fix memory hierarchy when enumerating services * Inherit ID limits of parent domains if set * SYSDB: Add sysdb_delete_by_sid * LDAP: Delete entry by SID if not found * LDAP: Amend sdap_access_check to allow any connection * LDAP: Parse FQDN into name/domain for subdomain users * AD: Add a new option ad_access_filter * AD: Use the ad_access_filter if it's set * AD: Search GC by default during access control, fall back to LDAP * AD: Add extended access filter * TEST: Test getgrnam with emphasis on members * NSS: Print FQDN for groups with mixed domain membership * KRB5: Handle ERR_CHPASS_FAILED * NSS: Fix service enumeration * MAN: Document that krb5 directories can only be created as private * LDAP: Check all search bases during nested group processing * NSS: Fix parenthesis * AD: Fix ad_access_filter parsing with empty filter * Updating translation for the 1.11.2 release Lukas Slebodnik (9): * LDAP: Set default value for dyndns update to false * krb5: Remove warning dereference of a null pointer * krb5: Use right function to free data. * AD: Prefer GC port from SRV record * AD: fall back to LDAP if GC is not available. * tests: Use right format string for type size_t * Makefile: Add missing libraries * Makefile: Remove unused variable TEST_MOCK_OBJ * LDAP: Return correct error code Pavel Březina (23): * sudo: allow specifying only one time restriction * sudo: improve time restrictions debug messages * nss: wait for initial subdomains request to finish * subdomains: first destroy ptask then remove sdom * dp: make subdomains refresh interval configurable * dp: store list of ongoing requests * utils: add ERR_DOMAIN_NOT_FOUND error code * dp: set request domain * dp: add function to terminate request of specific domain * dp: free sdap domain if subdomain is removed * be_ptask: add be_ptask_create_sync() * dp: convert cleanup task to be_ptask * ipa: destroy cleanup task when subdomain is removed * ad: destroy ptasks when subdomain is removed * sdap_save_user: try to determine domain by SID * sdap_save_group: try to determine domain by SID * free sid obtained from sss_idmap_unix_to_sid() * ad: shortcut if possible during get object by ID or SID * sdap: store base dn in sdap_domain * sdap: add sdap_domain_get_by_dn() * ghosts: pick correct domain for every member * sdap_fill_memberships: pick correct domain for every member * nested groups: pick correct domain for cache lookups Simo Sorce (1): * krb5: Remove ability to create public directories Stephen Gallagher (4): * SYSDB: Fix incorrect DEBUG message * MAN: Clarify debug level documentation * MAN: Reflow debug_levels.xml * BUILD: Update bashrc macros Sumit Bose (17): * AD: properly intitialize GC from ad_server option * LDAP: handle SID requests if noexist_delete is set * IPA server mode: properly initialize ext_groups * idmap: add internal function to free a domain struct * idmap: fix a memory leak if a collision is detected * idmap: allow ranges with external mapping to overlap * sdap_idmap: add sdap_idmap_get_configured_external_range() * sdap_idmap: properly handle ranges for external mappings * Add unconditional online callbacks * IPA: add callback to reset subdomain timeouts * sdap_get_generic_ext_send: check if we a re still connected * find_subdomain_by_sid: skip domains with missing domain_id * idmap: add sss_idmap_domain_by_name_has_algorithmic_mapping() * sdap_idmap_domain_has_algorithmic_mapping: add domain name argument * IPA: add trusted domains with missing idrange * ad_subdom_store: check ID mapping of the domain not of the parent * be_spy_create: free be_req and not the long living data

2 1

[PATCH] ad: support cross domain membership
by Pavel Březina 30 Oct '13

30 Oct '13

https://fedorahosted.org/sssd/ticket/2064 These patch set depends on: [PATCH] ad: store group in correct tree on initgroups via tokenGroups You can also pull it with all dependencies from my repository: fedorapeople.org:public_git/sssd.git #ad-groups The fundamental changes in this patch set are: - lookup groups in global catalog - pick up member domain from its originalDN

3 24

[PATCH] AD: Fix ad_access_filter parsing with empty filter
by Jakub Hrozek 30 Oct '13

30 Oct '13

I'm sorry about the breakage, but if the ad_access_filter was unset yet access_provider was set to AD, access was denied. Even though the access order was set correctly to "expire, filter", the filter being NULL caused problems. A patch including unit test is attached.

2 2

[PATCH] be_spy_create: free be_req and not the long living data
by Sumit Bose 30 Oct '13

30 Oct '13

Hi, Steeve found some unusual behaviour during his test which led to the shutdown of the whole SSSD. The attached patch should fix it. bye, Sumit

2 3

[PATCH] free sid obtained from sss_idmap_unix_to_sid()
by Pavel Březina 30 Oct '13

30 Oct '13

4 5

[PATCH] LDAP: Return correct error code
by Lukas Slebodnik 30 Oct '13

30 Oct '13

ehlo, I found one warning, while I was testing some patches. This warning was unrelated to patches, therefore I am sending separate email. simple patch is attached. LS

3 3

[PATCH] Makefile: Add missing libraries
by Lukas Slebodnik 30 Oct '13

30 Oct '13

ehlo, I tried to build latest sssd master on ubuntu and some tests could not be linked. It is caused by disabled link_all_deplibs. LS

2 2

[PATCH] BUILD: Update bashrc macros
by Stephen Gallagher 30 Oct '13

30 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 * Stop using --target (unneeded) * Drop explicit use of --with-default-ccache* since we now pick it up from libkrb5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJv9S0ACgkQeiVVYja6o6MVZACfSwORHp6bDJdlifs5FcgmWrP6 XNkAmgOnIxDNP+yIvdYUFkvXNYM3dsUa =ub5l -----END PGP SIGNATURE-----

3 4

[PATCH] MAN: Document that krb5 directories can only be created as private
by Jakub Hrozek 29 Oct '13

29 Oct '13

When I started writing 1.11.2 release notes, I realized that we did not amend documentation when we removed the ability to create public krb5 directories.

3 5

[PATCH] NSS: Fix service enumeration
by Jakub Hrozek 29 Oct '13

29 Oct '13

The code wrote into the middle of the packet to a space that was already reserved and allocated but then still advanced the pointer to the buffer. https://fedorahosted.org/sssd/ticket/2124

2 4

← Newer
1
2
3
4
5
6
7
8
9
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2013