[SSSD] Announcing SSSD 1.9.0

Jakub Hrozek jhrozek at redhat.com
Tue Sep 25 11:51:41 UTC 2012


On Mon, Sep 24, 2012 at 11:52:52PM +0200, Jakub Hrozek wrote:
> == Tickets fixes ==
> https://fedorahosted.org/sssd/ticket/1331
>     Off-by-one error in sss_hmac_sha1
> https://fedorahosted.org/sssd/ticket/1364
>     [abrt] sssd-1.8.3-11.fc16: set_server_common_status: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1438
>     SSSD crashes at boot time
> https://fedorahosted.org/sssd/ticket/1452
>     Authentication fails if kpasswd cannot be resolved
> https://fedorahosted.org/sssd/ticket/1454
>     if allocation fails, sss_mmap_cache_init may dereference NULL pointer
> https://fedorahosted.org/sssd/ticket/1458
>     Full sudo refresh is scheduled even if there is no sudo responder
> https://fedorahosted.org/sssd/ticket/1466
>     Proxy: Cannot retrieve an user after a group he is a member of was retrieved
> https://fedorahosted.org/sssd/ticket/1467
>     enumeration is broken in the proxy provider
> https://fedorahosted.org/sssd/ticket/1479
>     Hbac logs show wrong rule name granting access
> https://fedorahosted.org/sssd/ticket/1486
>     [abrt] sssd-1.8.4-14.fc17: sss_ldap_init_send: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1496
>     [abrt] sssd-1.8.4-14.fc17: ldap_pvt_sasl_getmechs: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
> https://fedorahosted.org/sssd/ticket/1505
>     sudo with sss backend should use ipa_hostname
> https://fedorahosted.org/sssd/ticket/1509
>     libsss_sudo is not updated when yum update sssd is called
> https://fedorahosted.org/sssd/ticket/1513
>     Change the processing of the SELinux default map
> https://fedorahosted.org/sssd/ticket/1515
>     pam_sss report System Error on wrong password
> https://fedorahosted.org/sssd/ticket/1516
>     krb5_mod_ccname should cancel the transaction at one place only
> https://fedorahosted.org/sssd/ticket/1519
>     membership of IPA hostgroups is not evaluated when treating them as netgroups
> https://fedorahosted.org/sssd/ticket/734
>     on reconnect we need to detect that a ipa/ds server has been reinitialized
> https://fedorahosted.org/sssd/ticket/1156
>     Do not use "goto" to jump backwards in the proxy code
> https://fedorahosted.org/sssd/ticket/1194
>     when nesting limit is reached, the LDAP provider tries to establish link to members outside the nesting limit
> https://fedorahosted.org/sssd/ticket/1345
>     sssd does not warn into sssd.log for broken configurations
> https://fedorahosted.org/sssd/ticket/1365
>     ipv6 address with square brackets doesn't work for krb5_server
> https://fedorahosted.org/sssd/ticket/1388
>     domain.remove_provider() does not work
> https://fedorahosted.org/sssd/ticket/1390
>     Add support for nested automount maps
> https://fedorahosted.org/sssd/ticket/1393
>     shadow attributes should accept -1
> https://fedorahosted.org/sssd/ticket/1396
>     Kerberos validation algorithm is insufficient for cross-realm trusts
> https://fedorahosted.org/sssd/ticket/1415
>     Group lookups no longer work when fastcache cannot be initialized
> https://fedorahosted.org/sssd/ticket/1416
>     sssd_be crashes on using inappropriate keytab file
> https://fedorahosted.org/sssd/ticket/1430
>     Password change prompt doesn't appear when "User must change password on next logon" is set for a AD user.
> https://fedorahosted.org/sssd/ticket/1436
>     LOCAL domain lookups don't work
> https://fedorahosted.org/sssd/ticket/1446
>     sssd does not try another server when unable to resolve hostname
> https://fedorahosted.org/sssd/ticket/1447
>     Fail over does not work correctly when IPA server is establishing a GSSAPI-encrypted LDAP connection
> https://fedorahosted.org/sssd/ticket/1453
>     proxy provider: value stored to status is never read in get_pw_name
> https://fedorahosted.org/sssd/ticket/1455
>     SELinux code must fall back to default only if there are no rules on the server
> https://fedorahosted.org/sssd/ticket/1456
>     Attempt to close the same file stream twice
> https://fedorahosted.org/sssd/ticket/1457
>     Insecure temporary file in IPA subdomain provider
> https://fedorahosted.org/sssd/ticket/1459
>     SRV servers are always marked as back up
> https://fedorahosted.org/sssd/ticket/1460
>     SSSD thread issue can cause the application to not get any identity information
> https://fedorahosted.org/sssd/ticket/1470
>     FreeIPA HBAC rules ignored when FreeIPA and SSSD are configured to set SELinux user context
> https://fedorahosted.org/sssd/ticket/1472
>     Duplicate detection in fail over does not work
> https://fedorahosted.org/sssd/ticket/1478
>     ldap_autofs_* options missing from /usr/share/sssd/sssd.api.d/sssd-ldap.conf
> https://fedorahosted.org/sssd/ticket/1480
>     1.9.0b6 does not build with SELinux disabled
> https://fedorahosted.org/sssd/ticket/1488
>     Segfault in IPA subdomain provider
> https://fedorahosted.org/sssd/ticket/1490
>     SSSD does not close TCP connections when SSL fails
> https://fedorahosted.org/sssd/ticket/1491
>     Consolidate functions that make a realm upper-case
> https://fedorahosted.org/sssd/ticket/1492
>     There is no /etc/selinux/targeted/logins on RHEL5
> https://fedorahosted.org/sssd/ticket/1500
>     SSSD's default ccache location needs to be updated (again), and the man pages should reflect it
> https://fedorahosted.org/sssd/ticket/904
>     Create tool to seed a user for first-boot
> https://fedorahosted.org/sssd/ticket/1087
>     RFE: Allow Forcing User Shell
> https://fedorahosted.org/sssd/ticket/1128
>     Introduce the concept of a Primary Server in SSSD
> https://fedorahosted.org/sssd/ticket/1185
>     [Feature] AD Extensions
> https://fedorahosted.org/sssd/ticket/1318
>     RFE: make the NSS memory cache timeout configurable
> https://fedorahosted.org/sssd/ticket/1368
>     Missing hostid and subdomains sections in sssd-ipa.conf
> https://fedorahosted.org/sssd/ticket/1380
>     domain_realm mappings manipulation by sssd
> https://fedorahosted.org/sssd/ticket/1418
>     document how sudo works with sssd
> https://fedorahosted.org/sssd/ticket/1420
>     sudo: provide automatic configuration of machine hostnames
> https://fedorahosted.org/sssd/ticket/1427
>     Don't refersh HBAC rules when looking up SELinux rules
> https://fedorahosted.org/sssd/ticket/1429
>     IPA session code returns error when SELinux mapping rule links to an HBAC rule
> https://fedorahosted.org/sssd/ticket/1432
>     Mention AD Provider in manpage of sssd.conf
> https://fedorahosted.org/sssd/ticket/1433
>     Suggested additions to manpage of sssd-ad
> https://fedorahosted.org/sssd/ticket/1435
>     SELinux specifity does not work with HBAC rules
> https://fedorahosted.org/sssd/ticket/1439
>     sss_pam needs to write out SELinux login file during the account phase
> https://fedorahosted.org/sssd/ticket/1445
>     The SELinux login file needs to be created by the responder, not PAM module
> https://fedorahosted.org/sssd/ticket/1448
>     sss_seed tool review issues
> https://fedorahosted.org/sssd/ticket/1360
>     format of file for pam_selinux is incorrect
> https://fedorahosted.org/sssd/ticket/1379
>     Possible use of uninitialized values
> https://fedorahosted.org/sssd/ticket/1395
>     SELinux rule matching ignores specificity requirement
> https://fedorahosted.org/sssd/ticket/1417
>     Several unowned directories
> https://fedorahosted.org/sssd/ticket/1419
>     sssd incorrectly sets shadowLastChange in seconds not days
> https://fedorahosted.org/sssd/ticket/1421
>     selinux rules are never deleted from sysdb
> https://fedorahosted.org/sssd/ticket/1422
>     When ldap_sasl_minssf is assigned large values, appropriate error message should be logged sssd_DOMAIN log
> https://fedorahosted.org/sssd/ticket/1431
>     Set "krb5_canonicalize = False" for password change to work
> https://fedorahosted.org/sssd/ticket/1239
>     [RFE] sudo: send username and uid while requesting default options
> https://fedorahosted.org/sssd/ticket/1299
>     Per domain formats for qualified user names
> https://fedorahosted.org/sssd/ticket/1352
>     [RFE] Add the subdomain functionality to IPA auth provider
> https://fedorahosted.org/sssd/ticket/1377
>     [RFE] Add AD provider
> https://fedorahosted.org/sssd/ticket/1382
>     pac responder interface needs checks
> https://fedorahosted.org/sssd/ticket/1385
>     heimdal: compile time diference
> https://fedorahosted.org/sssd/ticket/1398
>     Dependency issue while "yum update libsss_sudo"
> https://fedorahosted.org/sssd/ticket/1403
>     Combine keytab options for AD provider
> https://fedorahosted.org/sssd/ticket/1404
>     AD provider should default to case-insensitive operation
> https://fedorahosted.org/sssd/ticket/1407
>     Revert sssd patch for limiting enctypes to keytab
> https://fedorahosted.org/sssd/ticket/1409
>     Resource leak in sssdpac_import_authdata
> https://fedorahosted.org/sssd/ticket/1410
>     Dead code in ipa_subdomains_handler_done()
> https://fedorahosted.org/sssd/ticket/1412
>     Starting SSSD with a domain using the LOCAL provider segfaults the responders
> https://fedorahosted.org/sssd/ticket/1163
>     [Feature] SSSD AD Integration Feature (Cross Realm Kerberos Trusts)
> https://fedorahosted.org/sssd/ticket/1354
>     Add support for terminating idle connections in sssd_nss
> https://fedorahosted.org/sssd/ticket/1383
>     sssd_nss segfaults performing netgroup lookups without a specified domain
> https://fedorahosted.org/sssd/ticket/974
>     [RFE] Support DIR: credential caches for multiple TGT support
> https://fedorahosted.org/sssd/ticket/984
>     RFE: sssd should support Netscape LDAP password expiration controls
> https://fedorahosted.org/sssd/ticket/1213
>     Warn to syslog when dereference requests fail
> https://fedorahosted.org/sssd/ticket/1240
>     sudo: contact data provider only once
> https://fedorahosted.org/sssd/ticket/1255
>     RFE: change the way we deal with fake users
> https://fedorahosted.org/sssd/ticket/1256
>     Document the expectations about ghost users showing in the lookups
> https://fedorahosted.org/sssd/ticket/1330
>     Potential NULL dereference in sss_krb5_read_etypes_for_keytab
> https://fedorahosted.org/sssd/ticket/1336
>     Please only use named parameters in translatable strings
> https://fedorahosted.org/sssd/ticket/1337
>     Minor typos in SSSD messages and man pages
> https://fedorahosted.org/sssd/ticket/1346
>     in-memory cache causes nss to segfault if it cannot be initialized properly
> https://fedorahosted.org/sssd/ticket/1367
>     Optimize AD memberOf lookups with LDAP_MATCHING_RULE_IN_CHAIN
> https://fedorahosted.org/sssd/ticket/357
>     SSSD should provide fast in memory cache to provide similar functionality as NSCD currently provides
> https://fedorahosted.org/sssd/ticket/783
>     Support range retrievals
> https://fedorahosted.org/sssd/ticket/887
>     Implement mechanism to fetch and store domain info
> https://fedorahosted.org/sssd/ticket/917
>     Document sss_tools better
> https://fedorahosted.org/sssd/ticket/949
>     Filter out inappropriate IP addresses from IPA dynamic DNS update
> https://fedorahosted.org/sssd/ticket/996
>     RFE: Allow Constructing uid from Active Directory objectSid
> https://fedorahosted.org/sssd/ticket/1031
>     [RFE] Implement "AD friendly" schema mapping
> https://fedorahosted.org/sssd/ticket/1064
>     Sub-Domains: define new get_domains method
> https://fedorahosted.org/sssd/ticket/1065
>     Sub-Domains: implement new get_domains method in IPA provider
> https://fedorahosted.org/sssd/ticket/1067
>     Sub-Domains: add new get_domains method to responders
> https://fedorahosted.org/sssd/ticket/1114
>     get_uid_from_pid() perfoms an improper read
> https://fedorahosted.org/sssd/ticket/1119
>     Monitor SIGKILL time should be configurable
> https://fedorahosted.org/sssd/ticket/1140
>     RFE Request for including pam_pwd_expiration_warning = 0 in sssd.conf
> https://fedorahosted.org/sssd/ticket/1170
>     sss_cache should support invalidating services and autofs maps
> https://fedorahosted.org/sssd/ticket/1172
>     Bad check for id_provider=local and access_provider=permit
> https://fedorahosted.org/sssd/ticket/1174
>     sssd.conf has wrong defaults for the "command" parameter
> https://fedorahosted.org/sssd/ticket/1176
>     SSH: Add dp_get_host_send to common responder code
> https://fedorahosted.org/sssd/ticket/1181
>     Typos in sssd manual
> https://fedorahosted.org/sssd/ticket/1203
>     Hash the hostname/port information in the known_hosts file.
> https://fedorahosted.org/sssd/ticket/1209
>     Convert all read and write loops to use atomic I/O function
> https://fedorahosted.org/sssd/ticket/1233
>     Memory leak in sss_sudo_send_recv_generic
> https://fedorahosted.org/sssd/ticket/1250
>     Add default home directory mapping
> https://fedorahosted.org/sssd/ticket/1271
>     Stop using HTML_FOOTER_DESCRIPTION in doxygen docs
> https://fedorahosted.org/sssd/ticket/1281
>     Add unit test for compatibility of ldap options between schemas
> https://fedorahosted.org/sssd/ticket/1289
>     Create a way to define a default shell for cases when there no shell
> https://fedorahosted.org/sssd/ticket/1297
>     Use keytab to select etypes for krb5_get_init_creds_keytab()
> https://fedorahosted.org/sssd/ticket/1298
>     Invalid cache file created when canoning principals during krb5_get_init_creds_keytab()
> https://fedorahosted.org/sssd/ticket/1301
>     sss_cache does nothing when executed without any options.
> https://fedorahosted.org/sssd/ticket/1305
>     sss_cache should return a warning/error while validating unknown user/group
> https://fedorahosted.org/sssd/ticket/1306
>     sss_cache should return an error, when executed against inactive domains
> https://fedorahosted.org/sssd/ticket/1313
>     exec_child, execv and friends don't return success
> https://fedorahosted.org/sssd/ticket/1316
>     kpasswd server status set to working when Kerberos auth succeeds

The list of fixed tickets was incomplete, I forgot to include the 1.9.0
final milestone and the 1.9.0 String Freeze milestone.

The following tickets were fixed in those two milestones:

https://fedorahosted.org/sssd/ticket/866
    Support TLS_KEY for unlocking password-protected NSS databases
https://fedorahosted.org/sssd/ticket/920
    Bad debug message when adding services without explicit dns_discovery_domain
https://fedorahosted.org/sssd/ticket/966
    include Samba prefork code in SSSD build system
https://fedorahosted.org/sssd/ticket/1118
    Support exclusion of attributes when building attribute list from map
https://fedorahosted.org/sssd/ticket/1120
    Cleanup of the provider code - SYSDB_* constants
https://fedorahosted.org/sssd/ticket/1153
    Offline(network disconnect) authentication using proxy provider crashes sssd.
https://fedorahosted.org/sssd/ticket/1180
    Manpage for ldap_sasl_mech should be made more clear
https://fedorahosted.org/sssd/ticket/1225
    RFE: Add more debug information into the krb5_child and ldap_child processes
https://fedorahosted.org/sssd/ticket/1266
    Potential NULL-dereference in sss_nss_mc_get_record
https://fedorahosted.org/sssd/ticket/1267
    Use of unininitialized value in fill_grent
https://fedorahosted.org/sssd/ticket/1310
    System error when trying to sudo
https://fedorahosted.org/sssd/ticket/1311
    sss_cache does not remove entries from the fastcache
https://fedorahosted.org/sssd/ticket/1317
    Detect LDAPDerefRes in configure script
https://fedorahosted.org/sssd/ticket/1341
    add AD-specific autofs mapping for the AD schema
https://fedorahosted.org/sssd/ticket/1347
    protocol fallback when resolving SRV queries does not work properly
https://fedorahosted.org/sssd/ticket/1355
    ldap_schema = ad performance issue
https://fedorahosted.org/sssd/ticket/1384
    SSSD should move away unaccessible ccache files
https://fedorahosted.org/sssd/ticket/1387
    sssd_ldap fails to properly authenticate to the disrectory for sudo queries
https://fedorahosted.org/sssd/ticket/1394
    sssd_krb5_locator_plugin man pages found in sssd rpm.
https://fedorahosted.org/sssd/ticket/1399
    sasl_bind_send returns with -2 [Local error] when trying to connect to LDAP server using GSSAPI
https://fedorahosted.org/sssd/ticket/1402
    sssd_nss segfault detected during ipa-server-install.
https://fedorahosted.org/sssd/ticket/1411
    Uninitialized value in krb5_child-test if ccname is specified
https://fedorahosted.org/sssd/ticket/1423
    Examine all uses of ldap_set_option() for endianness issues
https://fedorahosted.org/sssd/ticket/1426
    ignoring return value of ‘fread’ in sss_debuglevel
https://fedorahosted.org/sssd/ticket/1428
    SELinux login file is not recreated during offline login
https://fedorahosted.org/sssd/ticket/1434
    Typo in logging when ldap search base is not set
https://fedorahosted.org/sssd/ticket/1440
    SSSD fails to store users if any of the requested attribute is empty.
https://fedorahosted.org/sssd/ticket/1487
    yum remove sssd does not remove files in var/lib/sss/mc/
https://fedorahosted.org/sssd/ticket/1506
    autofs entries with the same key collide
https://fedorahosted.org/sssd/ticket/1517
    subdomain discovery is too noisy
https://fedorahosted.org/sssd/ticket/1521
    Missing Primary Server doesn't default to service lookup
https://fedorahosted.org/sssd/ticket/1524
    Add provider specific default regular expressions for parsing user names
https://fedorahosted.org/sssd/ticket/1526
    SSSD does not auto renew kerberos credentials when auth_provider is 'ipa'
https://fedorahosted.org/sssd/ticket/1530
    ldap_idmap_autorid_compat not working with tokenGroups
https://fedorahosted.org/sssd/ticket/1461
    Replace "id_max, id_min" to "max_id, min_id" in manpage section of ID MAPPING
https://fedorahosted.org/sssd/ticket/1462
    Change default for ldap_idmap_range_min to 200000
https://fedorahosted.org/sssd/ticket/1463
    SRV support and duplicate detection in the back up list
https://fedorahosted.org/sssd/ticket/1464
    Manpage for ldap_sasl_authid needs to show correct default
https://fedorahosted.org/sssd/ticket/1473
    description of ldap_*_search_base options is missing details



More information about the sssd-devel mailing list