All,
This improved AD domain controller seems like an excellent solution to a problem we face periodically in our company. In our DMZs, 90% of the DCs are blocked; only a few are accessible. Previously, it seems like sssd did a CLAP ping to about 5 DCs. If none of those 5 were accessible, game over.
We could hard-code the accessible DCs in the sssd.conf file, but that's ugly. And the AD team swaps in and out AD DCs periodically.
What we've really do in this situation is remove sssd and use our older (commercial) AD integration tool, which does this new sssd algorithm -- CLDAP ping all DCs in parallel. So this older client works in a DMZ.
Now sssd 2.4.0 will as well. Well done!
Spike
On Mon, Oct 12, 2020 at 5:46 AM Pavel Březina pbrezina@redhat.com wrote:
# SSSD 2.4.0
The SSSD team is proud to announce the release of version 2.4.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/sssd-2_4_0
See the full release notes at: https://sssd.io/docs/users/relnotes/notes_2_4_0
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
- `libnss` support was dropped, SSSD now supports only `openssl`
cryptography
### New features
- Session recording can now exclude specific users or groups when
`scope` is set to `all` (see `exclude_users` and `exclude_groups` options)
- Active Directory provider now sends CLDAP pings over UDP protocol to
Domain Controllers in parallel to determine site and forest to speed up server discovery
### Packaging changes
- python2 bindings are disable by default, use `--with-python2-bindings`
to build it
### Documentation Changes
- Default value of `client_idle_timeout` changed from 60 to 300 seconds
for KCM, this allows more time for user interaction (e.g. during `kinit`)
- Added `exclude_users` and `exclude_groups` option to
`session_recording` section, this allows to exclude user or groups from session recording when `scope` is set to `all`
- Added `ldap_library_debug_level` option to enable debug messages from
`libldap`
- Added `dyndns_auth_ptr` to set authentication mechanism for PTR DNS
records update
- Added `ad_allow_remote_domain_local_groups` to be compatible with
other solutions _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...