Hi,
I would like to release 1.12.5 tomorrow (Fri Jun 12), so I prepared the release notes page: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
1.12.5 is going to be slightly larger than usual, so I split the highlights section into enhancements and fixes. Please reply to this mail or edit the wiki right away..
For your convenience, the wiki text is also included inline.
Thank you!
== Highlights == * This release adds several new enhancements and fixes many bugs * Notable new enhancements: * The background refresh tasks now supports refreshing users and groups as well. Please see the description of the `refresh_expired_interval` parameter in the `sssd.conf` man page. * A new option subdomain_inherit was added. Options included in subdomain_inherit also apply for trusted domains, if supported. This release supports inheriting `ignore_group_members`, `ldap_purge_cache_timeout`, `ldap_use_tokengroups` and `ldap_user_principal`. * When an expired account attempts to log in, a configurable error message can be displayed with sufficient `pam_verbosity` setting * OpenLDAP ppolicy can be honored even when an alternate login method (such as SSH key) is used. Please see the description of the new `ppolicy` value of the `ldap_access_order` option. * A new option `krb5_map_user` was added. This option allows the admin to map UNIX usernames to Kerberos principals. The option would be mostly useful for setups that wish to continue using UNIX file-based identities together with SSSD Kerberos authentication * The important bug fixes include * Several AD-specific bugs that resulted in the correct set of groups not being displayed after initgroups operation were fixed * Many fixes relate to the IPA ID views feature are included. Setups using the ID views feature should update the SSSD instance on both IPA servers and clients. * The AD provider now handles binary GUIDs correctly. This bug was manifested with an error message saying "ldb_modify failed: Invalid attribute syntax". * The AD provider no longer downloads full group objects during initgroups request if POSIX attributes are used. This fix may speed up the login times significantly. * A bug that prevented the `ignore_group_members` parameter to be used with the AD provider was fixed * The fail over code now reads and honors TTL value for SRV queries as well. Previously, SRV queries used a hardcoded timeout * The SELinux context set up during login with an IPA provider is only called if the context had changed. This fixes a performance regression with the IPA provider. * Race condition between setting the timeout in the back ends and reading it in the front end during initgroup operation was fixed. This bug affected applications that perform the `initgroups(3)` operation in multiple processes simultaneously. * Setups that only want to use the domain SSSD is connected to by setting `subdomains_provider=none` now work correctly as long as the domain SID is set manually in the config file * In case only allow rules are used, the simple access provider is now able to skip unresolvable groups. * The GPO access control code now handles situations where user and computer objects were in different domains. Previously, attempt to log in as user from a different domain than computer always resulted in login failure.
== Documentation Changes == * A new option `subdomain_inherit` was added. See the highlights section for more details. * A new option `krb5_map_user` was added. See the highlights section for more details. * The `ldap_access_order` option accepts new value `ppolicy`. * Account expiration message can be customized using a new option `pam_account_expired_message`