Hi,
I would like to release 1.16.4 tomorrow. Below are the release notes
that include what is now in the sssd-1-16 branch and somewhat
optimistically also what is now acked on github. Comments are welcome:
SSSD 1.16.4
===========
Highlights
----------
New Features
^^^^^^^^^^^^
* The list of PAM services which are allowed to authenticate using a
Smart Card is now configurable using a new option
``pam_p11_allowed_services``.
* A new configuration option ``ad_gpo_implicit_deny`` was added. This option
(when set to True) can be used to deny access to users even if there is
not applicable GPO. Normally users are allowed access in this situation.
(#3701)
* The LDAP authentication provider now allows to use a different method of
changing LDAP passwords using a modify operation in addition to the
default extended operation. This is meant to support old LDAP servers
that do not implement the extended operation. The password change using
the modification operation can be selected with ``ldap_pwmodify_mode =
"ldap_modify"`` (#1314)
Security issues fixed
^^^^^^^^^^^^^^^^^^^^^
* CVE-2019-3811: SSSD used to return "/" in case a user entry had no home
directory. This was deemed a security issue because this flaw could
impact services that restrict the user's filesystem access to within
their home directory. An empty home directory field would indicate
"no filesystem access", where sssd reporting it as "/" would grant
full
access (though still confined by unix permissions, SELinux etc).
Notable bug fixes
^^^^^^^^^^^^^^^^^
* The IPA provider, in a setup with a trusted Active Directory domain,
did not remove cached entries that were no longer present on
the AD side (#3984)
* The Active Directory provider now fetches the user information from the
LDAP port and switches to using the Global Catalog port, if available
for the group membership. This fixes an issue where some attributes
which are not available in the Global Catalog, typically the home
directory, would be removed from the user entry. (#2474)
* The IPA SELinux provider now sets the user login context even if it is the
same as the system default. This is important in case the user has
a non-standard home directory, because then only adding the user to
the SELinux database ensures the home directory will be labeled properly.
However, this fix causes a performance hit during the first login
as the context must be written into the semanage database.
* The sudo responder did not reflect the case_sensitive domain option
(#3820)
* A memory leak when requesting netgroups repeatedly was fixed (#3870)
* An issue that caused SSSD to sometimes switch to offline mode in case
not all domains in the forest ran the Global Catalog service was
fixed (#3902)
* The SSH responder no longer fails completely if the ``p11_child`` times out
when deriving SSH keys from a certificate (#3937)
* The negative cache was not reloaded after new sub domains were discovered which
could have lead to a high SSSD load (#3683)
* The negative cache did not work properly for in case a lookup fell back to trying
a UPN instead of a name (#3978)
* If any of the SSSD responders was too busy, that responder wouldn't have
refreshed the trusted domain list (#3967)
* A potential crash due to a race condition between the fail over code refreshing
a SRV lookup and back end using its results (#3976)
* Sudo's runAsUser and runAsGroup attributes did not match properly when used in
setups with domain_resolution_order
Tickets Fixed
-------------
* `3967 <
https://pagure.io/SSSD/sssd/issue/3967>`_ - NSS responder does no refresh
domain list when busy
* `2926 <
https://pagure.io/SSSD/sssd/issue/2926>`_ - Make list of local PAM
services allowed for Smartcard authentication configurable
* `3819 <
https://pagure.io/SSSD/sssd/issue/3819>`_ - sssd only sets the SELinux
login context if it differs from the default
* `3820 <
https://pagure.io/SSSD/sssd/issue/3820>`_ - sudo: search with lower cased
name for case insensitive domains
* `3870 <
https://pagure.io/SSSD/sssd/issue/3870>`_ - nss: memory leak in netgroups
* `3451 <
https://pagure.io/SSSD/sssd/issue/3451>`_ - When sssd is configured with
id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing
anonymous binds.
* `3875 <
https://pagure.io/SSSD/sssd/issue/3875>`_ - CURLE_SSL_CACERT is deprecated
in recent curl versions
* `3902 <
https://pagure.io/SSSD/sssd/issue/3902>`_ - SSSD must be cleared/restarted
periodically in order to retrieve AD users through IPA Trust
* `3901 <
https://pagure.io/SSSD/sssd/issue/3901>`_ - sssd returns '/' for
emtpy home directories
* `3919 <
https://pagure.io/SSSD/sssd/issue/3919>`_ - sss_cache prints spurious
error messages when invoked from shadow-utils on package install
* `3845 <
https://pagure.io/SSSD/sssd/issue/3845>`_ - The config file validator says
that certmap options are not allowed
* `3937 <
https://pagure.io/SSSD/sssd/issue/3937>`_ - If p11_child spawned from
sssd_ssh times out, sssd_ssh fails completely
* `3961 <
https://pagure.io/SSSD/sssd/issue/3961>`_ - sssd config-check reports an
error for a valid configuration option
* `3701 <
https://pagure.io/SSSD/sssd/issue/3701>`_ - [RFE] Allow changing default
behavior of SSSD from an allow-any default to a deny-any default when it can't find
any GPOs to apply to a user login.
* `2474 <
https://pagure.io/SSSD/sssd/issue/2474>`_ - AD: do not override existing
home-dir or shell if they are not available in the global catalog
* `3958 <
https://pagure.io/SSSD/sssd/issue/3958>`_ - sssd_krb5_locator_plugin
introduces delay in cifs.upcall krb5 calls
* `3890 <
https://pagure.io/SSSD/sssd/issue/3890>`_ - SSSD changes the memory cache
file ownership away from the SSSD user when running as root
* `3942 <
https://pagure.io/SSSD/sssd/issue/3942>`_ - RemovedInPytest4Warning:
Fixture "passwd_ops_setup" called directly
* `3276 <
https://pagure.io/SSSD/sssd/issue/3276>`_ - Revert workaround in CI for
bug in python-{request,urllib3}
* `3978 <
https://pagure.io/SSSD/sssd/issue/3978>`_ - UPN negative cache does not
use values from 'filter_users' config option
* `3983 <
https://pagure.io/SSSD/sssd/issue/3983>`_ - filter_users option is not
applied to sub-domains if SSSD starts offline
* `3947 <
https://pagure.io/SSSD/sssd/issue/3947>`_ - SSSD netgroups do not honor
entry_cache_nowait_percentage
* `3984 <
https://pagure.io/SSSD/sssd/issue/3984>`_ - IPA: Deleted user from trusted
domain is not removed properly from the cache on IPA clients
* `3976 <
https://pagure.io/SSSD/sssd/issue/3976>`_ - crash in
dp_failover_active_server
* `3957 <
https://pagure.io/SSSD/sssd/issue/3957>`_ - sudo: runAsUser/Group does not
work with domain_resolution_order
* `1314 <
https://pagure.io/SSSD/sssd/issue/1314>`_ - RFE Request for allowing
password changes using SSSD in DS which dont follow OID's from RFC 3062