RFC: 1.15.2 release notes
by Jakub Hrozek
Hi,
I prepared release notes for today's release. They are written in
anticipation that PR#186 with the subdomain config will be merged.
The RST I pushed to the sssd/docs repo is below:
SSSD 1.15.2
===========
Highlights
----------
* It is now possible to configure certain parameters of a trusted domain
in a configuration file sub-section. In particular, it is now possible
to configure which Active Directory DCs the SSSD talks to with a
configuration like this::
[domain/ipa.test]
# IPA domain configuration. This domain trusts a Windows domain win.test
[domain/ipa.test/win.test]
ad_server = dc.win.test
* Several issues related to socket-activating the NSS service, especially
if SSSD was configured to use a non-privileged user were fixed. The NSS
service now starts as root to avoid triggering a name-service lookup
while the NSS service is not running yet. Additionally, the NSS service
is started before any other service to make sure username resolution works
and the other service can resolve the SSSD user correctly.
* A new option ``cache_first`` allows the administrator to change the way
multiple domains are searched. When this option is enabled, SSSD will
first try to "pin" the requested name or ID to a domain by searching
the entries that are already cached and contact the domain that contains
the cached entry first. Previously, SSSD would check the cache and the
remote server for each domain. This option brings performance benefit
for setups that use multiple domains (even auto-discovered trusted
domains), especially for ID lookups that would previously iterate over
all domains. Please note that this option must be enabled with care as the
administrator must ensure that the ID space of domains does not overlap.
* The SSSD D-Bus interface gained two new methods:
``FindByNameAndCertificate`` and ``ListByCertificate``. These methods will
be used primarily by IPA to correctly match multple users who use the
same certificate for Smart Card login.
* A bug where SSSD did not properly sanitize a username with a newline
character in it was fixed.
Packaging Changes
-----------------
None in this release
Documentation Changes
---------------------
* A new option ``cache_first`` was added. Please see the Highlights
section for more details
* The ``override_homedir`` option supports a new template expansion ``l``
that expands to the first letter of username
Tickets Fixed
-------------
Please note that due to a bug in the pagure.io tracker, some tickets that
have dependencies set to other tickets cannot be closed at the moment.
* `#3317 <https://pagure.io/SSSD/sssd/issue/3317>`_ - Newline characters (\n) must be sanitized before LDAP requests take place
* `#3316 <https://pagure.io/SSSD/sssd/issue/3316>`_ - sssd-secrets doesn't exit on idle
* `#3314 <https://pagure.io/SSSD/sssd/issue/3314>`_ - sssd ignores entire groups from proxy provider if one member is listed twice
* `#3164 <https://pagure.io/SSSD/sssd/issue/3164>`_ - when group is invalidated using sss_cache dataExpireTimestamp entry in the domain and timestamps cache are inconsistent
* `#2668 <https://pagure.io/SSSD/sssd/issue/2668>`_ - [RFE] Add more flexible templating for override_homedir config option
* `#2599 <https://pagure.io/SSSD/sssd/issue/2599>`_ - Make it possible to configure AD subdomain in the server mode
* `#3223 <https://pagure.io/SSSD/sssd/issue/3323>`_ - The sssd-$RESPONDER.service units should bind to their socket units
* `#3322 <https://pagure.io/SSSD/sssd/issue/3322>`_ - chown in ExecStartPre of sssd-nss.service hangs forever
* `#843 <https://pagure.io/SSSD/sssd/issue/843>`_ - Login time increases strongly if more than one domain is configured
* `#2320 <https://pagure.io/SSSD/sssd/issue/2320>`_ - use the sss_parse_inp request in other responders than dbus
Detailed Changelog
------------------
7 years, 1 month
[sssd PR#186][opened] Subdomain config
by mzidek-rh
URL: https://github.com/SSSD/sssd/pull/186
Author: mzidek-rh
Title: #186: Subdomain config
Action: opened
PR body:
"""
This is the part of subdomain configuration feature needed to allow specify the search bases for the subdomain (one of the two use cases that were specified in the desin doc).
The second part with the server was more complicated then I expected, so I will send it separately (hopefully today or tomorrow), but I can not delay this first part anymore).
In order to test create a ipa-ad trust and redefine for example the ldap_search_base or ldap_user_search_base on the server side SSSD. BOth client and server side SSSDs will be able to use the alternative search base (no config changes needed on the client side SSSD).
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/186/head:pr186
git checkout pr186
7 years, 1 month
[sssd PR#188][opened] Add the first version of the KCM responder
by jhrozek
URL: https://github.com/SSSD/sssd/pull/188
Author: jhrozek
Title: #188: Add the first version of the KCM responder
Action: opened
PR body:
"""
These patches add a new service for managing Kerberos credential patches. It
follows the design document here:
https://fedorahosted.org/sssd/wiki/DesignDocs/KCM
So far all the credential caches are stored in memory. However, all the
internal APIs are ready for talking to sssd-secrets and store the caches
there which is what I'm working on now.
As per testing, it should be enough to set the default ccache name to
"KCM:" and make sure the sssd-kcm socket is enabled and started and the
sssd-kcm service is enabled.
It is important to test access control. Manually, I tested two different
UNIX users, tested setting the KRB5CCNAME variable to someone else's ccache
and so on, but more testing is welcome.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/188/head:pr188
git checkout pr188
7 years, 1 month
[sssd PR#152][opened] Add a tevent wrapper around libcurl's asynchronous interface
by jhrozek
URL: https://github.com/SSSD/sssd/pull/152
Author: jhrozek
Title: #152: Add a tevent wrapper around libcurl's asynchronous interface
Action: opened
PR body:
"""
This patch set adds a generic utility module that uses libcurl's multi
interface to allow the caller to talk HTTP using libcurl. The patch set
was part of the KCM responder branch, but as it might be useful to unblock
pbrezina's development, I'm submitting it separately.
The iobuf module might seem like an overkill for the libcurl tevent wrapper,
but please also check the KCM branch during review -- there it proved
quite valuable, so I think it makes sense to just reuse the same code in
the curl wrapper as well.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/152/head:pr152
git checkout pr152
7 years, 1 month
[sssd PR#154][opened] Confront caches first
by fidencio
URL: https://github.com/SSSD/sssd/pull/154
Author: fidencio
Title: #154: Confront caches first
Action: opened
PR body:
"""
This patch set has been written on top of PR#141, thus PR#141 should be merged before this one and also the following patches* are don't have to be reviewed as part of this PR.
*:
- CACHE_REQ: Add cache_req_data_set_bypass_cache()
- PAM: Use cache_req to perform initgroups lookups
- TESTS: Adapt pam-srv-tests to deal with cache_req related changes
The other 2 patches, the important ones. are basically introducing a new configurable option to define whether the responder should query all the caches before querying the data providers and reasonable debug info for the work.
I'm not 100% sure those changes are the only changes needed (but seems so), so I'd like to ask @jhrozek and @pbrezina for a first review just in order to be sure this series is according to their ideas.
Those 2 important patches could be squashed, in case it's the preference of the reviewers.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/154/head:pr154
git checkout pr154
7 years, 1 month
[sssd PR#166][opened] Please see the commit message for commit description.
by jhrozek
URL: https://github.com/SSSD/sssd/pull/166
Author: jhrozek
Title: #166: Please see the commit message for commit description.
Action: opened
PR body:
"""
To reproduce, log in as a user from a trusted domain. Before the patch,
you should see an error message about the domain not being found such as:
(Wed Feb 22 20:35:33 2017) [sssd[nss]] [nss_update_initgr_memcache] (0x0040): Unknown domain (win.trust.test) requested by provider
and the memory cache wouldn't be in fact be invalidated.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/166/head:pr166
git checkout pr166
7 years, 1 month