-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The SSSD team is proud to announce the latest enhancement release of the
System Security Services Daemon.
The source tarball is available at
https://fedorahosted.org/sssd
== Highlights ==
* Fixed issues with LDAP search filters that needed to be escaped
* Add Kerberos FAST support on platforms that support it
* Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
* Added a Kerberos access provider to honor .k5login
* Addressed several thread-safety issues in the sss_client code
* Improved support for delayed online Kerberos auth
* Significantly reduced time between connecting to the network/VPN and
acquiring a TGT
* Added feature for automatic Kerberos ticket renewal
* Provides the kerberos ticket for long-lived processes or cron jobs
even when the user logs out
* Added several new features to the LDAP access provider
* Support for 'shadow' access control
* Support for authorizedService access control
* Ability to mix-and-match LDAP access control features
* Added an option for a separate password-change LDAP server for those
platforms where LDAP referrals are not supported
* Added support for manpage translations
== Detailed Changelog ==
Jakub Hrozek (5):
* Always use uint32_t for UID/GID numbers
* Internal DNS resolver should check /etc/hosts
* Allow protocol fallback for SRV queries
* Make manual pages translatable
* Add Czech translation
Jan Zeleny (1):
* Option krb5_server is now used to store a list of KDCs instead of
krb5_kdcip.
Marko Myllynen (1):
* Fix a typo in sssd-krb5 man page
Moritz Baumann (1):
* Fix misused SDAP_SEARCH_BASE
Piotr Drąg (1):
* Updating pl translation
Simo Sorce (6):
* sss_client: make code thread-safe
* Pass sdap_id_ctx in sdap_id_op functions.
* ldap: remove variable that was never assigned nor used
* ldap: add checks to determine if USN features are available.
* ldap: Use USN entries if available.
* Fix wrong test in pam_sss
Stephen Gallagher (58):
* Write log opening failures to the syslog
* Improve versioning for automated builds
* Bumping version to 1.5.0 dev
* Fix incorrect free of req in krb5_auth.c
* Don't clean up groups for which a user has it as primary GID
* Handle errors during log reopening better
* Properly check the return value from semanage_commit
* Add utility function to sanitize LDAP/LDB filters
* Add sysdb utility function for sanitizing DN
* Sanitize search filters for the sysdb
* Sanitize sysdb search filters in the IPA provider
* Sanitize sysdb filters in the LDAP provider
* Sanitize sysdb DN helpers
* Sanitize search filters in memberOf plugin
* Sanitize sysdb dn for memberof lookup
* Add unit tests for users and groups with odd characters
* Sanitize search filters in LDAP provider
* Properly document ldap_purge_cache_timeout
* Sanitize ldap attributes in the config file
* Fix cast warning for pam_sss.c
* Fix const cast warning for sysdb_update_members
* Fix const cast warning in build_attrs_from_map
* Fix const cast issue with sysdb_attrs_users_from_str_list
* Fix const cast warning in confdb_create_ldif
* Fix const cast warnings in tests
* Fix incorrect type comparison
* Log startup errors to syslog
* Ensure that SSSD shuts down completely before restarting
* Fix authentication queue code for proxy auth
* Wait for all children to exit
* Add signal documentation to sssd(8)
* Print correct error messages for dp_err_to_string()
* Make default SIGTERM and SIGINT handlers use tevent
* Resend SIGTERM if child doesn't terminate
* Set up signal handlers before initializing sysdb
* Make sure that sss_obfuscate installs as executable
* Move sss_* tools into their own subpackage
* Remove IPA_ACCESS_TIME define
* Add group support to the simple access provider
* Fix timeouts for DNS resolver
* Reschedule the fd timeout for secondary lookups
* Eliminate possible NULL-dereference in pam_check_user_search
* Add missing break statement to sss_hash_create
* Prevent uninitialized value error in monitor_quit
* Fix invalid sizeof in pidfile
* Fix segfault for PAM_TEXT_INFO conversations
* Fix unchecked return value in sss_krb5_verify_keytab_ex
* Fix unsafe return condition in ipa_access_handler
* Fix uninitialized value error in set_local_and_remote_host_info
* Fix unchecked return value in test_sysdb_attrs_to_list
* Fix unchecked return value in set_nonblocking
* Start first enumeration immediately
* Add sysdb_has_enumerated and sysdb_set_enumerated helper functions
* Pass all PAM data to the LDAP access provider
* Add authorizedService support
* Ensure ID is checked in all domains for PAM
* Update the ID cache for any PAM request
* Committing new translation updates for release
Sumit Bose (79):
* Add ldap_deref option
* Add some missing ldap_memfree()
* Download only enabled IPA HBAC rules
* Add netgroups infrastructure to proxy provider
* Implement netgroups for proxy provider
* Remove all nss requests after a reconnect
* Always use talloc_zero() to allocate cmdctx
* Fix double free issue
* Allow authentication for referrals
* Mention ding-libs in BUILD.txt
* Fix two return value checks
* Store krb5 auth context for other targets
* Add infrastructure for Kerberos access provider
* Add krb5_get_simple_upn()
* Make krb5_setup() public
* Add krb5_kuserok() access check to krb5_child
* Make handle_child_* request public
* Call krb5_child to check access permissions
* Add defaultNamingContext to RootDSE attributes
* Use (default)namingContext to set empty search bases
* Make ldap_search_base a non-mandatory option
* Review comments for namingContexts patches
* Avoid long long in messages to PAM client use int64_t
* Introduce pam_verbosity config option
* Add missing error code
* Fix offline detection for LDAP auth/chpass
* Fix man page
* Use a more efficient host search filter
* Add SIGUSR2 to reset offline status
* fix typo in get_server_status()
* Fix a typo on setup_netlink()
* Daemonize by default
* Run checks before resetting offline state
* Fix offline detection in sdap_cli_connect request
* Add check_online method to LDAP ID provider
* Add a special filter type to handle enumerations
* Send authtok_type to krb5_child
* Add a renew task to krb5_child
* Check authtok type for krb5 auth and chpass
* Add krb5_renewable_lifetime option
* Add krb5_lifetime option
* Add support for server-side pam response messages
* krb5_child returns TGT lifetime
* Add support for automatic Kerberos ticket renewal
* Allow krb5 lifetime values without a unit
* Make string_to_shadowpw_days() public
* Add new account expired rule to LDAP access provider
* Add ldap_chpass_uri config option
* Refactor krb5_child to make helpers more flexible
* Add support for FAST in krb5 provider
* Mark unavailable Kerberos server as PORT_NOT_WORKING
* Replace krb5_kdcip by krb5_server in LDAP provider
* Fix build issue with older Kerberos library
* Remove check_access_time() from IPA access provider
* Bye, bye, ipa_timerules
* Fix unchecked return value in sdap_get_msg_dn()
* Fix unchecked return value in sdap_parse_entry()
* Remove unused newauthtok variable in LOCAL_pam_handler
* Fix improper NULL check in fo_add_srv_server()
* Fix incorrect return value on failure in resolve_get_domain_send()
* Fix incorrect return value on failure in check_and_export_options()
* Fix uninitialized value error in sdap_account_expired_shadow()
* Fix uninitialized value error in setup_test in fail_over-tests.c
* Fix improper bit manipulation in pam_sss
* Fix possible memory leak in sss_nss_recv_rep()
* Fix uninitialized value error in main() in stress-tests.c
* Fix possible memory leak in do_pam_conversation
* Fix another possible memory leak in sss_nss_recv_rep()
* Fix memory leak of library handle in proxy
* Fix uninitialized value error in lookup_netgr_step()
* Fix possible NULL-dereference in lookup_netgr_step()
* Avoid multiple initializations in LDAP provider
* Introduce sss_hash_create_ex()
* Fixes for automatic ticket renewal
* Serialize requests of the same user in the krb5 provider
* Update config API files
* Add all values of a multi-valued user attribute
* Remove unused member of a struct
* Fix potential NULL-dereference in krb5_auth_done()
Yuri Chornoivan (1):
* Updating uk translation
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0SSPgACgkQeiVVYja6o6NB5gCdFbTQxLCNdOOOM87A2Ieh7iA5
yZQAoKL/YL8VZb2jFe2QzADqi0ci8SOB
=3C8c
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
--
Jenny Galipeau <jgalipea(a)redhat.com>
Principal Software QA Engineer
Red Hat, Inc. Security Engineering
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.