Announcing SSSD 2.2.1
by Michal Židek
== SSSD 2.2.1 ===
The SSSD team is proud to announce the release of version 2.2.1 of the
System Security Services Daemon. The tarball can be downloaded from:
https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
--------
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
New features
^^^^^^^^^^^^
* New options were added which allow sssd-kcm to handle bigger data.
See manual pages for ``max_ccaches``, ``max_uid_caches`` and
``max_ccache_size``.
* SSSD can now automatically refresh cached user data from subdomains
in IPA/AD trust.
Notable bug fixes
^^^^^^^^^^^^^^^^^
* Fixed issue with SSSD hanging when connecting to non-responsive
server with ldaps://
* SSSD is now restarted by systemd after crashes.
* Fixed refression when dyndns_update was set to True and
dyndns_refresh_interval was not set or set to 0 then DNS
records were not updated at all.
* Fixed issue when ``default_domain_suffix`` was used with
``id_provider = files`` and caused all results from files domain to be
fully qualified.
* Fixed issue with sudo rules not being visible on OpenLDAP servers
* Fixed crash with ``auth_provider = proxy`` that prevented logins
Packaging Changes
-----------------
None
Documentation Changes
---------------------
A new option ``dns_resolver_server_timeout`` was added
A new option ``max_ccaches`` was added
A new option ``max_uid_ccaches`` was added
A new option ``max_ccache_size`` was added
A new option ``ocsp_dgst`` was added
Tickets Fixed
-------------
* `2878 <https://pagure.io/SSSD/sssd/issue/2878>`_ - sssd failover
does not work on connecting to non-responsive ldaps:// server
* `3217 <https://pagure.io/SSSD/sssd/issue/3217>`_ - Conflicting
default timeout values
* `3386 <https://pagure.io/SSSD/sssd/issue/3386>`_ - sssd-kcm cannot
handle big tickets
* `3489 <https://pagure.io/SSSD/sssd/issue/3489>`_ - p11_child should
work wit openssl1.0+
* `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a
new back end that would write to the secrets database directly
* `3833 <https://pagure.io/SSSD/sssd/issue/3833>`_ - port to pcre2
* `3894 <https://pagure.io/SSSD/sssd/issue/3894>`_ - multihost tests:
ldb-tools is needed for multihost tests
* `3905 <https://pagure.io/SSSD/sssd/issue/3905>`_ - SSSD doesn't
clear cache entries for IDs below min_id.
* `4012 <https://pagure.io/SSSD/sssd/issue/4012>`_ - SSSD is not
refreshing cached user data for the ipa sub-domain in a IPA/AD trust
* `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ -
EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1
* `4028 <https://pagure.io/SSSD/sssd/issue/4028>`_ - sssd-kcm calls
sssd-genconf which triggers nscd warning
* `4037 <https://pagure.io/SSSD/sssd/issue/4037>`_ - Logins fail after
upgrade to 2.2.0
* `4040 <https://pagure.io/SSSD/sssd/issue/4040>`_ - Reasonable to
Restart sssd on crashes?
* `4046 <https://pagure.io/SSSD/sssd/issue/4046>`_ - sudo: incorrect
usn value for openldap
* `4047 <https://pagure.io/SSSD/sssd/issue/4047>`_ - dyndns_update =
True is no longer not enough to get the IP address of the machine
updated in IPA upon sssd.service startup
* `4050 <https://pagure.io/SSSD/sssd/issue/4050>`_ -
nss_cmd_endservent resets the wrong index
* `4052 <https://pagure.io/SSSD/sssd/issue/4052>`_ - sssd config
option "default_domain_suffix" should not cause the files domain entries
to be qualified
* `3931 <https://pagure.io/SSSD/sssd/issue/3931>`_ - proxy provider is
not working with enumerate=true when trying to fetch all groups
* `4043 <https://pagure.io/SSSD/sssd/issue/4043>`_ - Typo in
systemd.m4 prevents detection of systemd.pc
* `3978 <https://pagure.io/SSSD/sssd/issue/3978>`_ - UPN negative
cache does not use values from 'filter_users' config option
* `4032 <https://pagure.io/SSSD/sssd/issue/4032>`_ -
p11_child::do_ocsp() function implementation is not FIPS140 compliant
* `4039 <https://pagure.io/SSSD/sssd/issue/4039>`_ -
p11_child::sign_data() function implementation is not FIPS140 compliant
* `4056 <https://pagure.io/SSSD/sssd/issue/4056>`_ - permission denied
on logs when running sssd as non-root user
* `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140
compliant usage of PRNG
* `2854 <https://pagure.io/SSSD/sssd/issue/2854>`_ - FAIL test-find-uid
* `3962 <https://pagure.io/SSSD/sssd/issue/3962>`_ - Problem with
tests/cmocka/test_dyndns.c
* `4022 <https://pagure.io/SSSD/sssd/issue/4022>`_ - utils:
sss_hmac_sha1() function implementation is not FIPS140 compliant
* `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140
compliant usage of PRNG
* `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ -
EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1
Detailed changelog
------------------
Alex Rodin (1):
tests/cmocka/test_dyndns.c: Switching from tevent_loop_once() to
tevent_loop_wait()
Alexey Tikhonov (14):
util/crypto/libcrypto: changed sss_hmac_sha1()
util/crypto/libcrypto: changed sss_hmac_sha1()
util/secrets: memory leaks are fixed
util/crypto/nss/nss_nite: params sanitization
crypto/libcrypto/crypto_nite: HMAC calculation changed
util/find_uid.c: fixed debug message
util/find_uid.c: fixed race condition bug
util/crypto: removed erroneous declaration
util/crypto/sss_crypto.c: cleanup of includes
util/crypto: generate_csprng_buffer() changed
util/crypto: added sss_rand()
crypto/libcrypto/crypto_nite.c: memory leak fixed
FIPS140 compliant usage of PRNG
crypto/nss: some nss_ctx_init() params made const
Jakub Hrozek (34):
Updating the version for the 2.2.1 release
TESTS: Install expect to drive password-change modifications
TESTS: Also add LDAP password when creating users
TESTS: Test changing LDAP password with extended operation and
modification
TEST: Add a multihost test for not returning / for an empty home dir
MONITOR: Don't check for the nscd socket while regenerating
configuration
SYSDB: Add sysdb_search_with_ts_attr
BE: search with sysdb_search_with_ts_attr
BE: Enable refresh for multiple domains
BE: Make be_refresh_ctx_init set up the periodical task, too
BE/LDAP: Call be_refresh_ctx_init() in the provider libraries,
not in back end
BE: Pass in attribute to look up with instead of hardcoding
SYSDB_NAME
BE: Change be_refresh_ctx_init to return errno and set
be_ctx->refresh_ctx
BE/LDAP: Split out a helper function from sdap_refresh for later
reuse
BE: Pass in filter_type when creating the refresh account request
BE: Send refresh requests in batches
BE: Extend be_ptask_create() with control when to schedule next
run after success
BE: Schedule the refresh interval from the finish time of the
last run
AD: Implement background refresh for AD domains
IPA: Implement background refresh for IPA domains
BE/IPA/AD/LDAP: Add inigroups refresh support
BE/IPA/AD/LDAP: Initialize the refresh callback from a list to
reduce logic duplication
IPA/AD/SDAP/BE: Generate refresh callbacks with a macro
MAN: Amend the documentation for the background refresh
DP/SYSDB: Move the code to set initgrExpireTimestamp to a
reusable function
IPA/AD/LDAP: Increase the initgrExpireTimestamp after finishing
refresh request
MAN: Get rid of sssd-secrets reference
MAN: Document that it is enough to systemctl restart
sssd-kcm.service lately
SECRETS: Use different option names from secrets and KCM for
quota options
SECRETS: Don't limit the global number of ccaches
KCM: Pass confdb context to the ccache db initialization
KCM: Configurable quotas for the secdb ccache back end
TESTS: Add tests for the configurable quotas
Don't qualify users from files domain when default_domain_suffix
is set
Jakub Jelen (1):
pam_sss: Add missing colon to the PIN prompt
Lukas Slebodnik (1):
PROXY: Return data in output parameter if everything is OK
Michal Židek (2):
TESTS: ldb-tools and sssd-tools are required for multihost tests
Update the translations for the 2.2.1 release
Niranjan M.R (1):
TESTS: Test kvno correctly displays vesion numbers of principals
Pavel Březina (11):
ci: disable timeout
ci: switch to new tooling and remove 'Read trusted files' stage
ci: rebase pull request on the target branch
ci: print node on which the test is being run
sudo: use proper datetime for default modifyTimestamp value
systemd: add Restart=on-failure to sssd.service
man: fix description of dns_resolver_op_timeout
man: fix description of dns_resolver_timeout
failover: add dns_resolver_server_timeout option
failover: change default timeouts
config: add dns_resolver_op_timeout to option list
Sam Morris (1):
build: fix detection of systemd.pc
Samuel Cabrero (1):
nss: Fix command 'endservent' resetting wrong struct member
Sumit Bose (10):
negcache: add fq-usernames of know domains to all UPN neg-caches
p11_child: prefer better digest function if card supports it
p11_child: fix a memory leak and other memory mangement issues
pam: make sure p11_child.log has the right permissions
ssh: make sure p11_child.log has the right permissions
BE: make sure child log files have the right permissions
utils: remove unused prototype (cert_to_ssh_key)
utils: move parse_cert_verify_opts() into separate file
p11_child: make OCSP digest configurable
pam: fix loop in Smartcard authentication
Tomas Halman (9):
MAN: ldap_user_home_directory default missing
pcre: port to pcre2
CACHE: SSSD doesn't clear cache entries
LDAP: failover does not work on non-responsive ldaps
CONFDB: Files domain if activated without .conf
TESTS: adapt tests to enabled default files domain
BE: Introduce flag for be_ptask_create
BE: Convert be_ptask params to flags
DYNDNS: dyndns_update is not enough
Yuri Chornoivan (1):
Fix minor typos in docs
4 years
[sssd PR#868][opened] ifp: let cache_req parse input name so it can fallback to upn search
by pbrezina
URL: https://github.com/SSSD/sssd/pull/868
Author: pbrezina
Title: #868: ifp: let cache_req parse input name so it can fallback to upn search
Action: opened
PR body:
"""
UPN search expects that the input name is in its fully qualified form.
However, GetUserAttr calls cache_req with unqualified username therefore
it never fallback to UPN search.
Steps to reproduce:
1. Configure SSSD against AD
2. Set UPN to `TestUserUPN(a)ad.vm`
3. Run:
```
dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:TestUserUPN@ad.vm array:string:name
Error sbus.Error.NotFound: No such file or directory
```
Resolves:
https://pagure.io/SSSD/sssd/issue/4065
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/868/head:pr868
git checkout pr868
4 years
[sssd PR#876][opened] KCM: Fill in pre-created ccache instead of creating a new one in kcm_initialize
by jhrozek
URL: https://github.com/SSSD/sssd/pull/876
Author: jhrozek
Title: #876: KCM: Fill in pre-created ccache instead of creating a new one in kcm_initialize
Action: opened
PR body:
"""
This is a continuation of https://pagure.io/SSSD/sssd/issue/3873
Some programs like openssh use the following sequence of calls:
cc = krb5_cc_new_unique
krb5_cc_switch(cc)
krb5_cc_initialize(cc, principal)
Since switch changes the default ccache, we create a 'dummy' ccache with
krb5_cc_switch() and then the initialize call just fills in the details.
The 'fills in the details' part was not properly implemented with the previous
patchset, the previous patchset worked only for password-based authentication
where nothing is cached initially. For delegation, we watch to make sure
that the credentials that are being delegated are filled in to the new ccache
and the new ccache is used as the default.
What initialize did previously was that if there was a default ccache already
(in this case the dummy one created with krb5_cc_switch()), it would treat
it as obsolete, create a new one and switch to it. Then the client (openssh) would
store the credential in a ccache that wouldn't be the default anymore, leaving
the default ccache empty. Afterwards, klist or similar would see that the default
ccache is empty and just pick the first non-empty one as a fallback, which would
often be one of the previous expired ones.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/876/head:pr876
git checkout pr876
4 years
[sssd PR#807][opened] sudo: do not update last usn value on rules refresh
by pbrezina
URL: https://github.com/SSSD/sssd/pull/807
Author: pbrezina
Title: #807: sudo: do not update last usn value on rules refresh
Action: opened
PR body:
"""
Refreshing specific rules may produce a higher usn value that the one
that is already remembered if the rules changed on the server. However,
there may be another rule that is not being refreshed which usn value
is higher then the current value but lower then the value of some of the
refreshed rules. If the highest usn value is updated in this case, the
rule would not be found be smart refresh.
Thus we must not update the usn value during rules refresh.
Resolves:
https://pagure.io/SSSD/sssd/issue/3996
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/807/head:pr807
git checkout pr807
4 years