[SSSD] Announcing the release of SSSD 1.5.0
Dmitri Pal
dpal at redhat.com
Wed Dec 22 20:00:39 UTC 2010
Jenny Galipeau wrote:
> :-) Great Job All!!
>
Ack, pushed to masters :-)
> Stephen Gallagher wrote:
> The SSSD team is proud to announce the latest enhancement release of the
> System Security Services Daemon.
>
> The source tarball is available at https://fedorahosted.org/sssd
>
>
> == Highlights ==
> * Fixed issues with LDAP search filters that needed to be escaped
> * Add Kerberos FAST support on platforms that support it
> * Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
> * Added a Kerberos access provider to honor .k5login
> * Addressed several thread-safety issues in the sss_client code
> * Improved support for delayed online Kerberos auth
> * Significantly reduced time between connecting to the network/VPN and
> acquiring a TGT
> * Added feature for automatic Kerberos ticket renewal
> * Provides the kerberos ticket for long-lived processes or cron jobs
> even when the user logs out
> * Added several new features to the LDAP access provider
> * Support for 'shadow' access control
> * Support for authorizedService access control
> * Ability to mix-and-match LDAP access control features
> * Added an option for a separate password-change LDAP server for those
> platforms where LDAP referrals are not supported
> * Added support for manpage translations
>
> == Detailed Changelog ==
> Jakub Hrozek (5):
> * Always use uint32_t for UID/GID numbers
> * Internal DNS resolver should check /etc/hosts
> * Allow protocol fallback for SRV queries
> * Make manual pages translatable
> * Add Czech translation
>
> Jan Zeleny (1):
> * Option krb5_server is now used to store a list of KDCs instead of
> krb5_kdcip.
>
> Marko Myllynen (1):
> * Fix a typo in sssd-krb5 man page
>
> Moritz Baumann (1):
> * Fix misused SDAP_SEARCH_BASE
>
> Piotr Drąg (1):
> * Updating pl translation
>
> Simo Sorce (6):
> * sss_client: make code thread-safe
> * Pass sdap_id_ctx in sdap_id_op functions.
> * ldap: remove variable that was never assigned nor used
> * ldap: add checks to determine if USN features are available.
> * ldap: Use USN entries if available.
> * Fix wrong test in pam_sss
>
> Stephen Gallagher (58):
> * Write log opening failures to the syslog
> * Improve versioning for automated builds
> * Bumping version to 1.5.0 dev
> * Fix incorrect free of req in krb5_auth.c
> * Don't clean up groups for which a user has it as primary GID
> * Handle errors during log reopening better
> * Properly check the return value from semanage_commit
> * Add utility function to sanitize LDAP/LDB filters
> * Add sysdb utility function for sanitizing DN
> * Sanitize search filters for the sysdb
> * Sanitize sysdb search filters in the IPA provider
> * Sanitize sysdb filters in the LDAP provider
> * Sanitize sysdb DN helpers
> * Sanitize search filters in memberOf plugin
> * Sanitize sysdb dn for memberof lookup
> * Add unit tests for users and groups with odd characters
> * Sanitize search filters in LDAP provider
> * Properly document ldap_purge_cache_timeout
> * Sanitize ldap attributes in the config file
> * Fix cast warning for pam_sss.c
> * Fix const cast warning for sysdb_update_members
> * Fix const cast warning in build_attrs_from_map
> * Fix const cast issue with sysdb_attrs_users_from_str_list
> * Fix const cast warning in confdb_create_ldif
> * Fix const cast warnings in tests
> * Fix incorrect type comparison
> * Log startup errors to syslog
> * Ensure that SSSD shuts down completely before restarting
> * Fix authentication queue code for proxy auth
> * Wait for all children to exit
> * Add signal documentation to sssd(8)
> * Print correct error messages for dp_err_to_string()
> * Make default SIGTERM and SIGINT handlers use tevent
> * Resend SIGTERM if child doesn't terminate
> * Set up signal handlers before initializing sysdb
> * Make sure that sss_obfuscate installs as executable
> * Move sss_* tools into their own subpackage
> * Remove IPA_ACCESS_TIME define
> * Add group support to the simple access provider
> * Fix timeouts for DNS resolver
> * Reschedule the fd timeout for secondary lookups
> * Eliminate possible NULL-dereference in pam_check_user_search
> * Add missing break statement to sss_hash_create
> * Prevent uninitialized value error in monitor_quit
> * Fix invalid sizeof in pidfile
> * Fix segfault for PAM_TEXT_INFO conversations
> * Fix unchecked return value in sss_krb5_verify_keytab_ex
> * Fix unsafe return condition in ipa_access_handler
> * Fix uninitialized value error in set_local_and_remote_host_info
> * Fix unchecked return value in test_sysdb_attrs_to_list
> * Fix unchecked return value in set_nonblocking
> * Start first enumeration immediately
> * Add sysdb_has_enumerated and sysdb_set_enumerated helper functions
> * Pass all PAM data to the LDAP access provider
> * Add authorizedService support
> * Ensure ID is checked in all domains for PAM
> * Update the ID cache for any PAM request
> * Committing new translation updates for release
>
> Sumit Bose (79):
> * Add ldap_deref option
> * Add some missing ldap_memfree()
> * Download only enabled IPA HBAC rules
> * Add netgroups infrastructure to proxy provider
> * Implement netgroups for proxy provider
> * Remove all nss requests after a reconnect
> * Always use talloc_zero() to allocate cmdctx
> * Fix double free issue
> * Allow authentication for referrals
> * Mention ding-libs in BUILD.txt
> * Fix two return value checks
> * Store krb5 auth context for other targets
> * Add infrastructure for Kerberos access provider
> * Add krb5_get_simple_upn()
> * Make krb5_setup() public
> * Add krb5_kuserok() access check to krb5_child
> * Make handle_child_* request public
> * Call krb5_child to check access permissions
> * Add defaultNamingContext to RootDSE attributes
> * Use (default)namingContext to set empty search bases
> * Make ldap_search_base a non-mandatory option
> * Review comments for namingContexts patches
> * Avoid long long in messages to PAM client use int64_t
> * Introduce pam_verbosity config option
> * Add missing error code
> * Fix offline detection for LDAP auth/chpass
> * Fix man page
> * Use a more efficient host search filter
> * Add SIGUSR2 to reset offline status
> * fix typo in get_server_status()
> * Fix a typo on setup_netlink()
> * Daemonize by default
> * Run checks before resetting offline state
> * Fix offline detection in sdap_cli_connect request
> * Add check_online method to LDAP ID provider
> * Add a special filter type to handle enumerations
> * Send authtok_type to krb5_child
> * Add a renew task to krb5_child
> * Check authtok type for krb5 auth and chpass
> * Add krb5_renewable_lifetime option
> * Add krb5_lifetime option
> * Add support for server-side pam response messages
> * krb5_child returns TGT lifetime
> * Add support for automatic Kerberos ticket renewal
> * Allow krb5 lifetime values without a unit
> * Make string_to_shadowpw_days() public
> * Add new account expired rule to LDAP access provider
> * Add ldap_chpass_uri config option
> * Refactor krb5_child to make helpers more flexible
> * Add support for FAST in krb5 provider
> * Mark unavailable Kerberos server as PORT_NOT_WORKING
> * Replace krb5_kdcip by krb5_server in LDAP provider
> * Fix build issue with older Kerberos library
> * Remove check_access_time() from IPA access provider
> * Bye, bye, ipa_timerules
> * Fix unchecked return value in sdap_get_msg_dn()
> * Fix unchecked return value in sdap_parse_entry()
> * Remove unused newauthtok variable in LOCAL_pam_handler
> * Fix improper NULL check in fo_add_srv_server()
> * Fix incorrect return value on failure in resolve_get_domain_send()
> * Fix incorrect return value on failure in check_and_export_options()
> * Fix uninitialized value error in sdap_account_expired_shadow()
> * Fix uninitialized value error in setup_test in fail_over-tests.c
> * Fix improper bit manipulation in pam_sss
> * Fix possible memory leak in sss_nss_recv_rep()
> * Fix uninitialized value error in main() in stress-tests.c
> * Fix possible memory leak in do_pam_conversation
> * Fix another possible memory leak in sss_nss_recv_rep()
> * Fix memory leak of library handle in proxy
> * Fix uninitialized value error in lookup_netgr_step()
> * Fix possible NULL-dereference in lookup_netgr_step()
> * Avoid multiple initializations in LDAP provider
> * Introduce sss_hash_create_ex()
> * Fixes for automatic ticket renewal
> * Serialize requests of the same user in the krb5 provider
> * Update config API files
> * Add all values of a multi-valued user attribute
> * Remove unused member of a struct
> * Fix potential NULL-dereference in krb5_auth_done()
>
> Yuri Chornoivan (1):
> * Updating uk translation
>
_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
More information about the sssd-devel
mailing list