I would like to release 1.14 alpha today, so I prepared the release
I will also move the tickets that didn't make the Alpha release out of
the Trac milestone.
Please comment or edit the notes directly. For convenience, I copied the
first version of the notes below:
== Highlights ==
* Several internal interfaces were refactored, providing cleaner
code and better memory hierarchy. This change will allow the code to
be easier to maintain and extend and get rid of sssd_be crashes on
service restarts while active requests are running.
* The IPA provider allows looking up users from trusted Active Directory
domains by certificates that are included in the IPA ID-views. Please
note that this functionality requires a recent IPA server.
* The AD provider is now able to look up users from Active Directory
domains by certificate. This change enables logins for Active Directory
users with the help of a smart card.
* The sss_override tool is now able to add certificates as local
overrides in the SSSD cache. Please note that the certificate overrides
are stored in the local cache, so removing the cache also removes all
* Invalid certificates are skipped instead of aborting the whole
operation when logging in with a smart card using SSH.
* A new option local_negative_timeout was added. This option allows
the admin to specify the time during which lookups for users that
are not handled by SSSD but are present on the system (typically in
/etc/passwd and /etc/group) and prevents repeated lookups of local
users on the remote server during initgroups operation.
* This version allows several OCSP-related options such as the OCSP
responder to be configured during smart card authentication
* SSSD is now able to determine the name of the user who logs in from
the inserted smart card without having to type in the username. Please
note that this functionality must be enabled with the allow_missing_name
* The sss_cache command line tool is now able to invalidate SUDO rules
with its new -r/-R switches. Please note that the sudo rules are not
refreshed with the sss_cache tool immediately. Refer to the sssd-sudo
man page for the existing refresh timeouts.
* The AD provider as well as the IPA provider part that handles AD
users is able to use the PAC blob attached to the Kerberos ticket to
resolve group memberships for a user if available. If the PAC blob is
not available, other methods such as tokenGroups are used instead.
* The libipa_hbac library was decorated with debug statements, allowing
the administrator to see individual parts of the HBAC rules as well
as the request passed to the evaluator
* Several systemtap probes were added across the SSSD codebase as well
as example systemtap scripts that use these probes. The scripts allow
the administrator to observe the performance of some operations such
as saving a group or the 'id' command with systemtap.
== Packaging Changes ==
* The libsss_sudo.so and libsss_autofs.so libraries were moved to
individual subpackage. This change allows the sudo and autofs libraries
to be installed in containers when the SSSD deamon is running on the
host or in another container.
* The PolicyKit rules used by the p11 child during smartcard
authentication were moved into their own subpackage to prevent conflict
in ownership with the polkit package
* The upstream RPMs no longer run as an unprivileged user, because
there are several known issues related to running SSSD completely
unprivileged. It it still possible to switch to a non-privileged user
in the sssd.conf file.
* If no configuration file exists on SSSD startup, the SSSD is now able
to read a default sssd.conf on first start. Downstreams are encouraged
to ship a default sssd.conf to allow SSSD to be enabled by default.
== Documentation Changes ==
* It is possible to configure SSSD debugging with the debug option
which is an alias to the existing debug_level option.
* A new local_negative_timeout option was added to configure the time
during which lookups for users that exist on the system but are not
handled by SSSD are negatively cached.
* The PAC responder allows the time during which data read from the
PAC bloc is considered valid with a new pac_lifetime option.
* Several PAM services were added to the default list of Group
Policy mappings. These include adding the unity login manager to
the ad_gpo_map_interactive list and the polkit-1 service to the
* The p11 responder allows configuring the default OCSP responder with
its new option ocsp_default_responder and the certificate expected to
sign the OCSP response with the new ocsp_default_responder_signing_cert
* The pam_sss.so PAM module has a new option allow_missing_name that
allows looking up the user (typically with the help of a certificate
on a smartcard) during login.
* The sss_override tool gained a new option -x/--certificate that can
be used to specify a local (as in the local cache) certificate for a
* The sss_cache tool gained new options -r/-R that allow the
administrator to invalidate the sudo rules in the cache.