The SSSD is proud to announce the third of five preview releases of
version 1.9 of the System Security Services Daemon.
Beta 4 will be released on July 10th and include a new AD provider
(wrapping the intricacies of setting up AD, configuring LDAP attributes
and Kerberos realm into a simpler set of configuration options)
Beta 5 will be released on July 31st and will contain a new tool for
"seeding" accounts with a temporary password for sending machines to
remotees as well as introducing a concept of primary vs. secondary
After Beta 5, no new features will be added to SSSD 1.9.0 and we will
focus on stability and our backlog of bugfixes until the final release
around September 1st. We will most likely issue a series of release
candidate builds prior to that, but these have not yet been scheduled.
As always, you can download the latest sources at
== Highlights ==
* Add a new PAC responder for dealing with cross-realm Kerberos trusts
* Terminate idle connections to the NSS and PAM responders
* Switch from libunistring to glib2 for unicode support
== Tickets Fixed ==
[Feature] SSSD AD Integration Feature (Cross Realm Kerberos Trusts)
Add support for terminating idle connections in sssd_nss
sssd_nss segfaults performing netgroup lookups without a specified
== Detailed Changelog ==
Jan Zeleny (5):
* Fix possible segfault in sdap_save_group()
* PAC responder: add some utility functions
* PAC responder: test suite
* Fix re_expression matching with subdomains
* SELinux user maps: pick just one map
Shantanu Goel (4):
* Set return errno to the value prior to calling close().
* Log message if close() fails in destructor.
* Do not send SIGPIPE on disconnection
* Add support for terminating idle connections
Simo Sorce (2):
* Do not leak file descriptors in client libs.
* Add close on exec support for old platforms
Stef Walter (1):
* Move some debug lines to new debug log levels
Stephen Gallagher (6):
* Bumping version to 1.9.0 beta 3
* Fix typo breaking DIR cache detection
* Make the client idle timeout configurable
* UTILS: Fix segfault due to sss_parse_name_for_domains
* BUILD: Change default unicode library to glib2
* Update translations for 1.9.0 beta 3 release
Sumit Bose (11):
* PAC responder: add basic infrastructure
* PAC responder: add the core functionality
* PAC responder: support in spec file
* PAC client: add basic support in common client code
* PAC client: add krb5 authdata plugin
* Add support for ID ranges
* Add range support to PAC responder
* Try to build PAC responder only if all dependencies are available
* Build pac responder tests only if pac responder is build
* Add man page section for the PAC responder
* Set default for subdomain_homedir
There is no longer any real advantage to building against libunistring
by default. This patch switches SSSD's build to use glib2 instead, which
will exist already on all platforms that SSSD is known to compile on.
This will eliminate an extra dependency on libunistring and save space
on capacity-limited systems.
This patch fixes an issue which resulted in a need to initialize
responder with data from local domain, otherwise it would not correctly
detect requests for subdomains. Similar situation can occur if new
subdomain is added at runtime.
The solution is to ask for a list of subdomains in case there is a
candidate domain identified in the process of matching re_expressions
with given name.
as Stephen found out the provided spec file cannot be used to build sssd
with the PAC responder on RHEL5, because samba4 is not available here.
This patch takes care that samba4 is not required on RHEL5 and the PAC
responder only builds if all dependencies are met, even with
--enable-all-experimental-features or similar set.