Announcing SSSD 1.5.2
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The SSSD team is proud to announce the latest bugfix release of the
System Security Services Daemon. As always, the latest tarball can be
found at https://fedorahosted.org/sssd/
== Highlights ==
* Fixes for support of FreeIPA v2
* Fixes for failover if DNS entries change
* Improved sss_obfuscate tool with better interactive mode
* Fix several crash bugs
* Don't attempt to use START_TLS over SSL. Some LDAP servers can't
handle this
* Delete users from the local cache if initgroups calls return 'no such
user' (previously only worked for getpwnam/getpwuid)
* Use new Transifex.net translations
* Better support for automatic TGT renewal (now survives restart)
* Support for new libldb 1.0.x
* Netgroup fixes
== Detailed Changelog ==
Gowrishankar Rajaiyan (2):
* removing password option functionality
* updating sss_obfuscate man page accordingly
Jakub Hrozek (6):
* Use realm for basedn instead of IPA domain
* Reset server status after timeout
* Prevent segfault in failover code
* Always expire host name resolution
* Run callbacks if server IP changes
* Mention Samba libraries URLs in BUILD.txt
Simo Sorce (1):
* Check that the socket is really ours before attempting to close it.
Stephen Gallagher (16):
* Update version to 1.5.2dev
* Sanitize search filters for nested group lookups
* Make the domain argument mandatory in sss_obfuscate
* Gracefully handle permission errors in sss_obfuscate
* Make SSSDConfig API configuration readable
* Only print "no matching service rule" when appropriate
* Verify LDAP file descriptor validity
* Do not attempt to use START_TLS on SSL connections
* Point the IPA provider at the compat tree for netgroups
* Remove cached user entry if initgroups returns ENOENT
* Perform initgroups lookups for all domains
* IPA provider: remove deleted groups during initgroups()
* Allow krb5_realm to override ipa_domain
* Add krb5_realm to the basic IPA options
* Fix uninitialized value error in ipa_get_id_options()
* Updating translations for 1.5.2 release
Sumit Bose (9):
* Fix for generating lists of translated man pages
* Remove renewal item if it is not re-added
* Check ccache file for renewable TGTs at startup
* Do not try to delete sysbd memberOf attribute
* Fixes for dynamic DNS update
* Add missing name to struct getent_ctx for missing netgroup
* Refactor set_netgroup_entry()
* Change state of hash entry if netgroup cannot be parsed
* Release handle if not connected
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk15I+kACgkQeiVVYja6o6M7DQCfReznjAP0k1QHIUjq3Vw69APK
O3gAnAwmBsfv/YjOSu/hd7fXFv4zXxd9
=EcjX
-----END PGP SIGNATURE-----
13 years
[PATCH] Mention Samba libraries URLs in BUILD.txt
by Jakub Hrozek
A developer from ArchLinux was recently confused on IRC by our
suggestion to build Samba-based libraries from samba master. The
libraries have their own tarballs now, so the patch explicitly mentions
them - I think it still makes sense as they are not yet included in all
distributions.
Also corrects the yum install $builddeps example.
13 years
[PATCH] Run callbacks if server IP changes
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
QA found another issue with the hostname expiration. We resolved the new
IP address but did not call the backend callbacks, so the Kerberos
provider still tried to connect to the old server as the kdcinfo files
were not refreshed with the newly resolved IP address.
The attached patch also fires the backend callbacks if the server
hostname status changed since last time (and adds a API to the failover
code to be able to get the status change timestamp).
SSSD 1.5 with this patch applied passed Kaushik's tests, so hopefully
there will be no more patches for this issue..
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk13mV4ACgkQHsardTLnvCWGHACff+3we1eAr1doS3wU6K7RIri0
GyMAoNHQ5DZDZPS9ms0q4kJTfTBL4+c2
=QwOc
-----END PGP SIGNATURE-----
13 years
[PATCH] Release handle if not connected
by Sumit Bose
Hi,
this aims to be a short term fix for trac ticket #821. In general we
should find out why the handle is not release when the backend goes
offline.
bye,
Sumit
13 years
[PATCH] Change state of hash entry if netgroup cannot be parsed
by Sumit Bose
Hi,
this patch should fix trac ticket #819. If we fail to parse the netgroup
entry returned from the LDAP server the netgroup hash entry is never set
to be ready and any following request will wait until the client timeout
is over.
While testing this I found that our current caching of non-existing (or
broken) netgroups will lead to the following behaviour:
$ getent netgroup unknown_netgroup
$ getent netgroup unknown_netgroup
unknown_netgroup
The first request returns nothing because the netgroup does not exists.
But the second request returns an empty netgroup because we have stored
it in the in-memory cache as an empty netgroup.
I'm not sure if this is only irritating or a real bug. I have opendd
ticket #820 to track this.
bye,
Sumit
13 years
[PATCHES] Update SSSD's transifex support
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
These patches will make it easier to manage translations in the SSSD.
The first patch adds the transifex_client configuration, the second
patch pulls in pending translations from transifex.net, and the third
patch updates our source translations in the repository.
These patches contain no source code changes at all.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk12WUUACgkQeiVVYja6o6MdFACgosPUU16kJ3o/7T5lyymZ5QAJ
5CIAoKzSHubpvXXPmGE9VlX+fOL8GYp0
=asqf
-----END PGP SIGNATURE-----
13 years
[PATCH] Always expire host name resolution
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
My previous expiry patch wasn't working as expected (or rather I
misunderstood the requirement). It only refreshed the hostname when we
were refreshing the port status. Which means that if the port was never
marked as bad, we would stick to the old server.
The attached patch changes the behaviour so that we always reset the
status after a hardcoded period of 2 hours.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk12QNgACgkQHsardTLnvCUNpQCfaBnb5Nf4OzFRp7oHORRIoYiw
z/IAnAnpmRzFFltdpqQhG4S8oGEPAg+m
=PfsQ
-----END PGP SIGNATURE-----
13 years
[PATCH] Couple of cleanup patches
by Jan Zelený
I'm sending two patches cleaning up some parts of code which seem to be
redundant.
--
Thank you
Jan Zeleny
Red Hat Software Engineer
Brno, Czech Republic
13 years
[PATCH] Prevent segfault in failover code
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch should fix a segfault in failover code introduced by my
recent hostname expiration patch.
I didn't realize that when using SRV records, server->common == NULL is
legal as we don't have the server name resolved yet.
The first hunk in the patch is completely unrelated to the crash. But I
think it is correct, server->common == NULL should never mean that the
server is resolved. Should I split the hunk (at least for stable
branches sake) even if it is one-liner?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk10rCgACgkQHsardTLnvCV7AwCcD3S6hlJIMnF3xxxtkaON/2Gr
IkQAn0ZFtnsyH+YOBBuM7SmwmfAV+o0P
=V/Kz
-----END PGP SIGNATURE-----
13 years
Add missing name to struct getent_ctx for missing netgroup
by Sumit Bose
Hi,
this patch should fix a seg fault which occurs during the deletion of
netgroups from the negative cache. The second patch changes to interface
of an internal function to avoid similar issues in future.
Should fix trac ticket #817.
bye,
Sumit
13 years