[SSSD] Announcing SSSD 1.9.0
Jakub Hrozek
jhrozek at redhat.com
Tue Sep 25 11:51:41 UTC 2012
On Mon, Sep 24, 2012 at 11:52:52PM +0200, Jakub Hrozek wrote:
> == Tickets fixes ==
> https://fedorahosted.org/sssd/ticket/1331
> Off-by-one error in sss_hmac_sha1
> https://fedorahosted.org/sssd/ticket/1364
> [abrt] sssd-1.8.3-11.fc16: set_server_common_status: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1438
> SSSD crashes at boot time
> https://fedorahosted.org/sssd/ticket/1452
> Authentication fails if kpasswd cannot be resolved
> https://fedorahosted.org/sssd/ticket/1454
> if allocation fails, sss_mmap_cache_init may dereference NULL pointer
> https://fedorahosted.org/sssd/ticket/1458
> Full sudo refresh is scheduled even if there is no sudo responder
> https://fedorahosted.org/sssd/ticket/1466
> Proxy: Cannot retrieve an user after a group he is a member of was retrieved
> https://fedorahosted.org/sssd/ticket/1467
> enumeration is broken in the proxy provider
> https://fedorahosted.org/sssd/ticket/1479
> Hbac logs show wrong rule name granting access
> https://fedorahosted.org/sssd/ticket/1486
> [abrt] sssd-1.8.4-14.fc17: sss_ldap_init_send: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1496
> [abrt] sssd-1.8.4-14.fc17: ldap_pvt_sasl_getmechs: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1505
> sudo with sss backend should use ipa_hostname
> https://fedorahosted.org/sssd/ticket/1509
> libsss_sudo is not updated when yum update sssd is called
> https://fedorahosted.org/sssd/ticket/1513
> Change the processing of the SELinux default map
> https://fedorahosted.org/sssd/ticket/1515
> pam_sss report System Error on wrong password
> https://fedorahosted.org/sssd/ticket/1516
> krb5_mod_ccname should cancel the transaction at one place only
> https://fedorahosted.org/sssd/ticket/1519
> membership of IPA hostgroups is not evaluated when treating them as netgroups
> https://fedorahosted.org/sssd/ticket/734
> on reconnect we need to detect that a ipa/ds server has been reinitialized
> https://fedorahosted.org/sssd/ticket/1156
> Do not use "goto" to jump backwards in the proxy code
> https://fedorahosted.org/sssd/ticket/1194
> when nesting limit is reached, the LDAP provider tries to establish link to members outside the nesting limit
> https://fedorahosted.org/sssd/ticket/1345
> sssd does not warn into sssd.log for broken configurations
> https://fedorahosted.org/sssd/ticket/1365
> ipv6 address with square brackets doesn't work for krb5_server
> https://fedorahosted.org/sssd/ticket/1388
> domain.remove_provider() does not work
> https://fedorahosted.org/sssd/ticket/1390
> Add support for nested automount maps
> https://fedorahosted.org/sssd/ticket/1393
> shadow attributes should accept -1
> https://fedorahosted.org/sssd/ticket/1396
> Kerberos validation algorithm is insufficient for cross-realm trusts
> https://fedorahosted.org/sssd/ticket/1415
> Group lookups no longer work when fastcache cannot be initialized
> https://fedorahosted.org/sssd/ticket/1416
> sssd_be crashes on using inappropriate keytab file
> https://fedorahosted.org/sssd/ticket/1430
> Password change prompt doesn't appear when "User must change password on next logon" is set for a AD user.
> https://fedorahosted.org/sssd/ticket/1436
> LOCAL domain lookups don't work
> https://fedorahosted.org/sssd/ticket/1446
> sssd does not try another server when unable to resolve hostname
> https://fedorahosted.org/sssd/ticket/1447
> Fail over does not work correctly when IPA server is establishing a GSSAPI-encrypted LDAP connection
> https://fedorahosted.org/sssd/ticket/1453
> proxy provider: value stored to status is never read in get_pw_name
> https://fedorahosted.org/sssd/ticket/1455
> SELinux code must fall back to default only if there are no rules on the server
> https://fedorahosted.org/sssd/ticket/1456
> Attempt to close the same file stream twice
> https://fedorahosted.org/sssd/ticket/1457
> Insecure temporary file in IPA subdomain provider
> https://fedorahosted.org/sssd/ticket/1459
> SRV servers are always marked as back up
> https://fedorahosted.org/sssd/ticket/1460
> SSSD thread issue can cause the application to not get any identity information
> https://fedorahosted.org/sssd/ticket/1470
> FreeIPA HBAC rules ignored when FreeIPA and SSSD are configured to set SELinux user context
> https://fedorahosted.org/sssd/ticket/1472
> Duplicate detection in fail over does not work
> https://fedorahosted.org/sssd/ticket/1478
> ldap_autofs_* options missing from /usr/share/sssd/sssd.api.d/sssd-ldap.conf
> https://fedorahosted.org/sssd/ticket/1480
> 1.9.0b6 does not build with SELinux disabled
> https://fedorahosted.org/sssd/ticket/1488
> Segfault in IPA subdomain provider
> https://fedorahosted.org/sssd/ticket/1490
> SSSD does not close TCP connections when SSL fails
> https://fedorahosted.org/sssd/ticket/1491
> Consolidate functions that make a realm upper-case
> https://fedorahosted.org/sssd/ticket/1492
> There is no /etc/selinux/targeted/logins on RHEL5
> https://fedorahosted.org/sssd/ticket/1500
> SSSD's default ccache location needs to be updated (again), and the man pages should reflect it
> https://fedorahosted.org/sssd/ticket/904
> Create tool to seed a user for first-boot
> https://fedorahosted.org/sssd/ticket/1087
> RFE: Allow Forcing User Shell
> https://fedorahosted.org/sssd/ticket/1128
> Introduce the concept of a Primary Server in SSSD
> https://fedorahosted.org/sssd/ticket/1185
> [Feature] AD Extensions
> https://fedorahosted.org/sssd/ticket/1318
> RFE: make the NSS memory cache timeout configurable
> https://fedorahosted.org/sssd/ticket/1368
> Missing hostid and subdomains sections in sssd-ipa.conf
> https://fedorahosted.org/sssd/ticket/1380
> domain_realm mappings manipulation by sssd
> https://fedorahosted.org/sssd/ticket/1418
> document how sudo works with sssd
> https://fedorahosted.org/sssd/ticket/1420
> sudo: provide automatic configuration of machine hostnames
> https://fedorahosted.org/sssd/ticket/1427
> Don't refersh HBAC rules when looking up SELinux rules
> https://fedorahosted.org/sssd/ticket/1429
> IPA session code returns error when SELinux mapping rule links to an HBAC rule
> https://fedorahosted.org/sssd/ticket/1432
> Mention AD Provider in manpage of sssd.conf
> https://fedorahosted.org/sssd/ticket/1433
> Suggested additions to manpage of sssd-ad
> https://fedorahosted.org/sssd/ticket/1435
> SELinux specifity does not work with HBAC rules
> https://fedorahosted.org/sssd/ticket/1439
> sss_pam needs to write out SELinux login file during the account phase
> https://fedorahosted.org/sssd/ticket/1445
> The SELinux login file needs to be created by the responder, not PAM module
> https://fedorahosted.org/sssd/ticket/1448
> sss_seed tool review issues
> https://fedorahosted.org/sssd/ticket/1360
> format of file for pam_selinux is incorrect
> https://fedorahosted.org/sssd/ticket/1379
> Possible use of uninitialized values
> https://fedorahosted.org/sssd/ticket/1395
> SELinux rule matching ignores specificity requirement
> https://fedorahosted.org/sssd/ticket/1417
> Several unowned directories
> https://fedorahosted.org/sssd/ticket/1419
> sssd incorrectly sets shadowLastChange in seconds not days
> https://fedorahosted.org/sssd/ticket/1421
> selinux rules are never deleted from sysdb
> https://fedorahosted.org/sssd/ticket/1422
> When ldap_sasl_minssf is assigned large values, appropriate error message should be logged sssd_DOMAIN log
> https://fedorahosted.org/sssd/ticket/1431
> Set "krb5_canonicalize = False" for password change to work
> https://fedorahosted.org/sssd/ticket/1239
> [RFE] sudo: send username and uid while requesting default options
> https://fedorahosted.org/sssd/ticket/1299
> Per domain formats for qualified user names
> https://fedorahosted.org/sssd/ticket/1352
> [RFE] Add the subdomain functionality to IPA auth provider
> https://fedorahosted.org/sssd/ticket/1377
> [RFE] Add AD provider
> https://fedorahosted.org/sssd/ticket/1382
> pac responder interface needs checks
> https://fedorahosted.org/sssd/ticket/1385
> heimdal: compile time diference
> https://fedorahosted.org/sssd/ticket/1398
> Dependency issue while "yum update libsss_sudo"
> https://fedorahosted.org/sssd/ticket/1403
> Combine keytab options for AD provider
> https://fedorahosted.org/sssd/ticket/1404
> AD provider should default to case-insensitive operation
> https://fedorahosted.org/sssd/ticket/1407
> Revert sssd patch for limiting enctypes to keytab
> https://fedorahosted.org/sssd/ticket/1409
> Resource leak in sssdpac_import_authdata
> https://fedorahosted.org/sssd/ticket/1410
> Dead code in ipa_subdomains_handler_done()
> https://fedorahosted.org/sssd/ticket/1412
> Starting SSSD with a domain using the LOCAL provider segfaults the responders
> https://fedorahosted.org/sssd/ticket/1163
> [Feature] SSSD AD Integration Feature (Cross Realm Kerberos Trusts)
> https://fedorahosted.org/sssd/ticket/1354
> Add support for terminating idle connections in sssd_nss
> https://fedorahosted.org/sssd/ticket/1383
> sssd_nss segfaults performing netgroup lookups without a specified domain
> https://fedorahosted.org/sssd/ticket/974
> [RFE] Support DIR: credential caches for multiple TGT support
> https://fedorahosted.org/sssd/ticket/984
> RFE: sssd should support Netscape LDAP password expiration controls
> https://fedorahosted.org/sssd/ticket/1213
> Warn to syslog when dereference requests fail
> https://fedorahosted.org/sssd/ticket/1240
> sudo: contact data provider only once
> https://fedorahosted.org/sssd/ticket/1255
> RFE: change the way we deal with fake users
> https://fedorahosted.org/sssd/ticket/1256
> Document the expectations about ghost users showing in the lookups
> https://fedorahosted.org/sssd/ticket/1330
> Potential NULL dereference in sss_krb5_read_etypes_for_keytab
> https://fedorahosted.org/sssd/ticket/1336
> Please only use named parameters in translatable strings
> https://fedorahosted.org/sssd/ticket/1337
> Minor typos in SSSD messages and man pages
> https://fedorahosted.org/sssd/ticket/1346
> in-memory cache causes nss to segfault if it cannot be initialized properly
> https://fedorahosted.org/sssd/ticket/1367
> Optimize AD memberOf lookups with LDAP_MATCHING_RULE_IN_CHAIN
> https://fedorahosted.org/sssd/ticket/357
> SSSD should provide fast in memory cache to provide similar functionality as NSCD currently provides
> https://fedorahosted.org/sssd/ticket/783
> Support range retrievals
> https://fedorahosted.org/sssd/ticket/887
> Implement mechanism to fetch and store domain info
> https://fedorahosted.org/sssd/ticket/917
> Document sss_tools better
> https://fedorahosted.org/sssd/ticket/949
> Filter out inappropriate IP addresses from IPA dynamic DNS update
> https://fedorahosted.org/sssd/ticket/996
> RFE: Allow Constructing uid from Active Directory objectSid
> https://fedorahosted.org/sssd/ticket/1031
> [RFE] Implement "AD friendly" schema mapping
> https://fedorahosted.org/sssd/ticket/1064
> Sub-Domains: define new get_domains method
> https://fedorahosted.org/sssd/ticket/1065
> Sub-Domains: implement new get_domains method in IPA provider
> https://fedorahosted.org/sssd/ticket/1067
> Sub-Domains: add new get_domains method to responders
> https://fedorahosted.org/sssd/ticket/1114
> get_uid_from_pid() perfoms an improper read
> https://fedorahosted.org/sssd/ticket/1119
> Monitor SIGKILL time should be configurable
> https://fedorahosted.org/sssd/ticket/1140
> RFE Request for including pam_pwd_expiration_warning = 0 in sssd.conf
> https://fedorahosted.org/sssd/ticket/1170
> sss_cache should support invalidating services and autofs maps
> https://fedorahosted.org/sssd/ticket/1172
> Bad check for id_provider=local and access_provider=permit
> https://fedorahosted.org/sssd/ticket/1174
> sssd.conf has wrong defaults for the "command" parameter
> https://fedorahosted.org/sssd/ticket/1176
> SSH: Add dp_get_host_send to common responder code
> https://fedorahosted.org/sssd/ticket/1181
> Typos in sssd manual
> https://fedorahosted.org/sssd/ticket/1203
> Hash the hostname/port information in the known_hosts file.
> https://fedorahosted.org/sssd/ticket/1209
> Convert all read and write loops to use atomic I/O function
> https://fedorahosted.org/sssd/ticket/1233
> Memory leak in sss_sudo_send_recv_generic
> https://fedorahosted.org/sssd/ticket/1250
> Add default home directory mapping
> https://fedorahosted.org/sssd/ticket/1271
> Stop using HTML_FOOTER_DESCRIPTION in doxygen docs
> https://fedorahosted.org/sssd/ticket/1281
> Add unit test for compatibility of ldap options between schemas
> https://fedorahosted.org/sssd/ticket/1289
> Create a way to define a default shell for cases when there no shell
> https://fedorahosted.org/sssd/ticket/1297
> Use keytab to select etypes for krb5_get_init_creds_keytab()
> https://fedorahosted.org/sssd/ticket/1298
> Invalid cache file created when canoning principals during krb5_get_init_creds_keytab()
> https://fedorahosted.org/sssd/ticket/1301
> sss_cache does nothing when executed without any options.
> https://fedorahosted.org/sssd/ticket/1305
> sss_cache should return a warning/error while validating unknown user/group
> https://fedorahosted.org/sssd/ticket/1306
> sss_cache should return an error, when executed against inactive domains
> https://fedorahosted.org/sssd/ticket/1313
> exec_child, execv and friends don't return success
> https://fedorahosted.org/sssd/ticket/1316
> kpasswd server status set to working when Kerberos auth succeeds
The list of fixed tickets was incomplete, I forgot to include the 1.9.0
final milestone and the 1.9.0 String Freeze milestone.
The following tickets were fixed in those two milestones:
https://fedorahosted.org/sssd/ticket/866
Support TLS_KEY for unlocking password-protected NSS databases
https://fedorahosted.org/sssd/ticket/920
Bad debug message when adding services without explicit dns_discovery_domain
https://fedorahosted.org/sssd/ticket/966
include Samba prefork code in SSSD build system
https://fedorahosted.org/sssd/ticket/1118
Support exclusion of attributes when building attribute list from map
https://fedorahosted.org/sssd/ticket/1120
Cleanup of the provider code - SYSDB_* constants
https://fedorahosted.org/sssd/ticket/1153
Offline(network disconnect) authentication using proxy provider crashes sssd.
https://fedorahosted.org/sssd/ticket/1180
Manpage for ldap_sasl_mech should be made more clear
https://fedorahosted.org/sssd/ticket/1225
RFE: Add more debug information into the krb5_child and ldap_child processes
https://fedorahosted.org/sssd/ticket/1266
Potential NULL-dereference in sss_nss_mc_get_record
https://fedorahosted.org/sssd/ticket/1267
Use of unininitialized value in fill_grent
https://fedorahosted.org/sssd/ticket/1310
System error when trying to sudo
https://fedorahosted.org/sssd/ticket/1311
sss_cache does not remove entries from the fastcache
https://fedorahosted.org/sssd/ticket/1317
Detect LDAPDerefRes in configure script
https://fedorahosted.org/sssd/ticket/1341
add AD-specific autofs mapping for the AD schema
https://fedorahosted.org/sssd/ticket/1347
protocol fallback when resolving SRV queries does not work properly
https://fedorahosted.org/sssd/ticket/1355
ldap_schema = ad performance issue
https://fedorahosted.org/sssd/ticket/1384
SSSD should move away unaccessible ccache files
https://fedorahosted.org/sssd/ticket/1387
sssd_ldap fails to properly authenticate to the disrectory for sudo queries
https://fedorahosted.org/sssd/ticket/1394
sssd_krb5_locator_plugin man pages found in sssd rpm.
https://fedorahosted.org/sssd/ticket/1399
sasl_bind_send returns with -2 [Local error] when trying to connect to LDAP server using GSSAPI
https://fedorahosted.org/sssd/ticket/1402
sssd_nss segfault detected during ipa-server-install.
https://fedorahosted.org/sssd/ticket/1411
Uninitialized value in krb5_child-test if ccname is specified
https://fedorahosted.org/sssd/ticket/1423
Examine all uses of ldap_set_option() for endianness issues
https://fedorahosted.org/sssd/ticket/1426
ignoring return value of ‘fread’ in sss_debuglevel
https://fedorahosted.org/sssd/ticket/1428
SELinux login file is not recreated during offline login
https://fedorahosted.org/sssd/ticket/1434
Typo in logging when ldap search base is not set
https://fedorahosted.org/sssd/ticket/1440
SSSD fails to store users if any of the requested attribute is empty.
https://fedorahosted.org/sssd/ticket/1487
yum remove sssd does not remove files in var/lib/sss/mc/
https://fedorahosted.org/sssd/ticket/1506
autofs entries with the same key collide
https://fedorahosted.org/sssd/ticket/1517
subdomain discovery is too noisy
https://fedorahosted.org/sssd/ticket/1521
Missing Primary Server doesn't default to service lookup
https://fedorahosted.org/sssd/ticket/1524
Add provider specific default regular expressions for parsing user names
https://fedorahosted.org/sssd/ticket/1526
SSSD does not auto renew kerberos credentials when auth_provider is 'ipa'
https://fedorahosted.org/sssd/ticket/1530
ldap_idmap_autorid_compat not working with tokenGroups
https://fedorahosted.org/sssd/ticket/1461
Replace "id_max, id_min" to "max_id, min_id" in manpage section of ID MAPPING
https://fedorahosted.org/sssd/ticket/1462
Change default for ldap_idmap_range_min to 200000
https://fedorahosted.org/sssd/ticket/1463
SRV support and duplicate detection in the back up list
https://fedorahosted.org/sssd/ticket/1464
Manpage for ldap_sasl_authid needs to show correct default
https://fedorahosted.org/sssd/ticket/1473
description of ldap_*_search_base options is missing details
More information about the sssd-devel
mailing list