API tools faq
paste
Guest User

Untitled

a guest
Jun 25th, 2015
437
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 104.87 KB | None | 0 0
raw download clone embed print report
  1. [root@ldapklient rpmbuild]# cat SPECS/sssd.spec
  2. %if ! (0%{?fedora} > 12 || 0%{?rhel} > 5)
  3. %{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
  4. %{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
  5. %endif
  6.  
  7. # we don't want to provide private python extension libs
  8. %define __provides_exclude_from %{python_sitearch}.*.so$
  9.  
  10. # Determine the location of the LDB modules directory
  11. %global ldb_modulesdir %(pkg-config --variable=modulesdir ldb)
  12. %global ldb_version 1.1.13
  13.  
  14. Name: sssd
  15. Version: 1.11.6
  16. Release: 30%{?dist}
  17. Group: Applications/System
  18. Summary: System Security Services Daemon
  19. License: GPLv3+
  20. URL: http://fedorahosted.org/sssd/
  21. Source0: https://fedorahosted.org/released/sssd/%{name}-%{version}.tar.gz
  22. BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
  23.  
  24. ### Patches ###
  25. Patch0001: 0001-SSH-Allow-newline-at-the-end-of-public-key-values-in.patch
  26. Patch0002: 0002-TESTS-sss_ssh-textual-public-key-format.patch
  27. Patch0003: 0003-BUILD-dbusintrospectdir-is-not-used-anymore.patch
  28. Patch0004: 0004-IFP-Fix-DEBUG-messages.patch
  29. Patch0005: 0005-IFP-Return-a-specific-value-on-failure-connecting-to.patch
  30. Patch0006: 0006-IFP-Provide-a-SBUS-method-to-reconnect-to-sysbus.patch
  31. Patch0007: 0007-MONITOR-Signal-InfoPipe-to-reconnect-on-SIGUSR2.patch
  32. Patch0008: 0008-TOOLS-New-helper-tool-sss_signal.patch
  33. Patch0009: 0009-BUILD-Add-the-DBus-service-activation.patch
  34. Patch0010: 0010-sbus_request-fix-potential-NULL-dereference.patch
  35. Patch0011: 0011-LDAP-tokengroups-do-not-work-with-id_provider-ldap.patch
  36. Patch0012: 0012-SDAP-Continue-resolving-SID-even-if-some-fail.patch
  37. Patch0013: 0013-sudo-fetch-sudoRunAs-attribute.patch
  38. Patch0014: 0014-sss_client-thread-safe-initialisation-of-sss_cli_mc_.patch
  39. Patch0015: 0015-sss_client-Fix-memory-leak-in-nss_mc_-group-passwd.patch
  40. Patch0016: 0016-ad-comment-ENOENT-when-id-mapping-is-disabled.patch
  41. Patch0017: 0017-ad-update-membership-after-SIDs-are-resolved.patch
  42. Patch0018: 0018-sudo-use-dbus-array-for-rules-refresh.patch
  43. Patch0019: 0019-LDAP-Remove-unused-option-ldap_netgroup_uuid.patch
  44. Patch0020: 0020-LDAP-Remove-unused-option-ldap_group_uuid.patch
  45. Patch0021: 0021-LDAP-Remove-unused-option-ldap_user_uuid.patch
  46. Patch0022: 0022-test_utils-Use-common-header-file-for-libsss_util-te.patch
  47. Patch0023: 0023-UTIL-Add-functions-for-replacing-whitespaces.patch
  48. Patch0024: 0024-NSS-Replace-spaces-with-specified-string-in-names.patch
  49. Patch0025: 0025-failover-set-port-status-to-not-working-if-previous-.patch
  50. Patch0026: 0026-ptask-Allow-adding-random_offset-to-scheduled-execut.patch
  51. Patch0027: 0027-ptask-Add-backoff-feature-to-the-ptask-api.patch
  52. Patch0028: 0028-Exit-offline-mode-only-if-server-is-available.patch
  53. Patch0029: 0029-sudo-replace-asterisk-with-escape-sequence-in-host-f.patch
  54. Patch0030: 0030-IFP-Fix-lookups-with-fully-qualified-names.patch
  55. Patch0031: 0031-RPM-Restart-service-in-posttrans-not-post.patch
  56. Patch0032: 0032-ad-initgroups-continue-if-resolved-SID-is-still-miss.patch
  57. Patch0033: 0033-NSS-Ignore-default_domain-for-netgroups.patch
  58. Patch0034: 0034-LDAP-SUDO-sudo-provider-doesn-t-fetch-EntryUSN.patch
  59. Patch0035: 0035-Only-replace-space-with-the-specified-substitution.patch
  60. Patch0036: 0036-Make-the-space-override-responder-agnostic.patch
  61. Patch0037: 0037-PAM-Use-the-override_space-option.patch
  62. Patch0038: 0038-IFP-Use-the-override_space-option.patch
  63. Patch0039: 0039-SUDO-Use-the-override_space-option.patch
  64. Patch0040: 0040-MAN-How-much-time-sssd-spends-offline.patch
  65. Patch0041: 0041-sudo-work-with-correct-D-Bus-iterator.patch
  66. Patch0042: 0042-IPA-handle-searches-by-SID-in-apply_subdomain_homedi.patch
  67. Patch0043: 0043-SDAP-split-sdap_access_filter_get_access_done.patch
  68. Patch0044: 0044-SDAP-refactor-sdap_access_filter_send.patch
  69. Patch0045: 0045-SDAP-nitpicks-in-sdap_access_filter_get_access_done.patch
  70. Patch0046: 0046-SDAP-refactor-sdap_access_filter_done.patch
  71. Patch0047: 0047-SDAP-don-t-log-error-on-access-denied.patch
  72. Patch0048: 0048-SDAP-refactor-AC-offline-checks.patch
  73. Patch0049: 0049-SDAP-new-option-DN-to-ppolicy-on-LDAP.patch
  74. Patch0050: 0050-SDAP-account-lockout-to-restrict-access-via-ssh-key.patch
  75. Patch0051: 0051-MAN-options-lockout-and-ldap_pwdlockout_dn.patch
  76. Patch0052: 0052-dyndns_test-Use-right-socket-length-of-for-IPv4-addr.patch
  77. Patch0053: 0053-responder-get-domains-tests-fix-checking-of-leaks.patch
  78. Patch0054: 0054-test_dyndns-Use-different-talloc-context-in-wrapped-.patch
  79. Patch0055: 0055-TESTS-leak_check-functions-shouldn-t-be-called-with-.patch
  80. Patch0056: 0056-dyndns-Fix-talloc-hierarchy-of-struct-sss_iface_addr.patch
  81. Patch0057: 0057-test_dyndns-sss_iface_addr_list_get-can-return-more-.patch
  82. Patch0058: 0058-SDAP-free-subrequest-in-sdap_dyndns_update_addrs_don.patch
  83. Patch0059: 0059-sss_client-Fix-struct-sss_cli_mc_ctx-reinitialize-on.patch
  84. Patch0060: 0060-LDAP-Do-not-shortcut-on-ret-EOK-during-password-expi.patch
  85. Patch0061: 0061-LDAP-Split-out-linking-primary-group-members-into-a-.patch
  86. Patch0062: 0062-LDAP-Don-t-add-a-user-member-twice-when-adding-a-pri.patch
  87. Patch0063: 0063-LDAP-Use-tmp_ctx-in-ldap_child-for-temporary-data.patch
  88. Patch0064: 0064-LDAP-Use-randomized-ccname-for-storing-credentials.patch
  89. Patch0065: 0065-SDAP-Immediately-finish-request-for-empty-array.patch
  90. Patch0066: 0066-SDAP-Use-different-talloc_context-for-array-of-names.patch
  91. Patch0067: 0067-SDAP-Update-groups-for-user-just-once.patch
  92. Patch0068: 0068-IPA-process-non-posix-nested-groups.patch
  93. Patch0069: 0069-AD-process-non-posix-nested-groups-w-o-tokenGroups.patch
  94. Patch0070: 0070-AD-process-non-posix-nested-groups-using-tokenGroups.patch
  95. Patch0071: 0071-Add-alternative-objectClass-to-group-attribute-maps.patch
  96. Patch0073: 0072-Use-the-alternative-objectclass-in-group-maps.patch
  97.  
  98. ### Dependencies ###
  99. Requires: sssd-common = %{version}-%{release}
  100. Requires: sssd-ldap = %{version}-%{release}
  101. #Requires: sssd-krb5 = %{version}-%{release}
  102. #Requires: sssd-ipa = %{version}-%{release}
  103. #Requires: sssd-common-pac = %{version}-%{release}
  104. #Requires: sssd-ad = %{version}-%{release}
  105. #Requires: sssd-proxy = %{version}-%{release}
  106. Requires: python-sssdconfig = %{version}-%{release}
  107.  
  108. %global servicename sssd
  109. %global sssdstatedir %{_localstatedir}/lib/sss
  110. %global dbpath %{sssdstatedir}/db
  111. %global pipepath %{sssdstatedir}/pipes
  112. %global mcpath %{sssdstatedir}/mc
  113. %global pubconfpath %{sssdstatedir}/pubconf
  114.  
  115. ### Build Dependencies ###
  116.  
  117. BuildRequires: autoconf
  118. BuildRequires: automake
  119. BuildRequires: libtool
  120. BuildRequires: m4
  121. BuildRequires: popt-devel
  122. BuildRequires: libtalloc-devel
  123. BuildRequires: libtevent-devel
  124. BuildRequires: libtdb-devel
  125. BuildRequires: libldb-devel = %{ldb_version}
  126. BuildRequires: libdhash-devel >= 0.4.2
  127. BuildRequires: libcollection-devel
  128. BuildRequires: libini_config-devel >= 1.1.0
  129. BuildRequires: dbus-devel
  130. BuildRequires: dbus-libs
  131. BuildRequires: openldap-devel
  132. BuildRequires: pam-devel
  133. BuildRequires: nss-devel
  134. BuildRequires: nspr-devel
  135. BuildRequires: pcre-devel
  136. BuildRequires: libxslt
  137. BuildRequires: libxml2
  138. BuildRequires: docbook-style-xsl
  139. BuildRequires: krb5-devel >= 1.10
  140. BuildRequires: c-ares-devel
  141. BuildRequires: python-devel
  142. BuildRequires: check-devel
  143. BuildRequires: doxygen
  144. BuildRequires: libselinux-devel
  145. BuildRequires: libsemanage-devel
  146. BuildRequires: bind-utils
  147. BuildRequires: keyutils-libs-devel
  148. BuildRequires: libnl-devel
  149. BuildRequires: gettext-devel
  150. BuildRequires: pkgconfig
  151. BuildRequires: glib2-devel
  152. BuildRequires: diffstat
  153. BuildRequires: findutils
  154. # BuildRequires: samba4-devel >= 4.0.0-59beta2
  155. BuildRequires: selinux-policy-targeted >= 3.7.19-166
  156.  
  157. %description
  158. Provides a set of daemons to manage access to remote directories and
  159. authentication mechanisms. It provides an NSS and PAM interface toward
  160. the system and a pluggable backend system to connect to multiple different
  161. account sources. It is also the basis to provide client auditing and policy
  162. services for projects like FreeIPA.
  163.  
  164. The sssd subpackage is a meta-package that contains the deamon as well as all
  165. the existing back ends.
  166.  
  167. %package common
  168. Summary: Common files for the SSSD
  169. Group: Applications/System
  170. License: GPLv3+
  171. # Conflicts
  172. Conflicts: sssd < 1.10.0-8%{?dist}.beta2
  173. Conflicts: selinux-policy < 3.7.19-160
  174. # Requires
  175. Requires: libldb%{?_isa} = %{ldb_version}
  176. Requires: libtdb%{?_isa} >= 1.1.3
  177. Requires: sssd-client%{?_isa} = %{version}-%{release}
  178. Requires: libsss_idmap%{?_isa} = %{version}-%{release}
  179. Requires: libini_config >= 0.6.1
  180. Requires(post): initscripts chkconfig
  181. Requires(preun): initscripts chkconfig
  182. Requires(postun): initscripts chkconfig
  183.  
  184.  
  185. ### Provides ###
  186. Provides: libsss_sudo = %{version}-%{release}
  187. Obsoletes: libsss_sudo <= 1.10.0-7%{?dist}.beta1
  188. Provides: libsss_sudo-devel = %{version}-%{release}
  189. Obsoletes: libsss_sudo-devel <= 1.10.0-7%{?dist}.beta1
  190. Provides: libsss_autofs = %{version}-%{release}
  191. Obsoletes: libsss_autofs <= 1.10.0-7%{?dist}.beta1
  192.  
  193. %description common
  194. Common files for the SSSD. The common package includes all the files needed
  195. to run a particular back end, however, the back ends are packaged in separate
  196. subpackages such as sssd-ldap.
  197.  
  198. %package client
  199. Summary: SSSD Client libraries for NSS and PAM
  200. Group: Applications/System
  201. License: LGPLv3+
  202. Requires(post): /sbin/ldconfig
  203. Requires(postun): /sbin/ldconfig
  204.  
  205. %description client
  206. Provides the libraries needed by the PAM and NSS stacks to connect to the SSSD
  207. service.
  208.  
  209. %package tools
  210. Summary: Userspace tools for use with the SSSD
  211. Group: Applications/System
  212. License: GPLv3+
  213. Requires: sssd-common = %{version}-%{release}
  214.  
  215. %description tools
  216. Provides userspace tools for manipulating users, groups, and nested groups in
  217. SSSD when using id_provider = local in /etc/sssd/sssd.conf.
  218.  
  219. Also provides several other administrative tools:
  220. * sss_debuglevel to change the debug level on the fly
  221. * sss_seed which pre-creates a user entry for use in kickstarts
  222. * sss_obfuscate for generating an obfuscated LDAP password
  223.  
  224. %package -n python-sssdconfig
  225. Summary: SSSD and IPA configuration file manipulation classes and functions
  226. Group: Applications/System
  227. License: GPLv3+
  228. BuildArch: noarch
  229.  
  230. %description -n python-sssdconfig
  231. Provides python files for manipulation SSSD and IPA configuration files.
  232.  
  233. %package ldap
  234. Summary: The LDAP back end of the SSSD
  235. Group: Applications/System
  236. License: GPLv3+
  237. Conflicts: sssd < 1.10.0-8.beta2
  238. Requires: sssd-common = %{version}-%{release}
  239. #Requires: sssd-krb5-common = %{version}-%{release}
  240.  
  241. %description ldap
  242. Provides the LDAP back end that the SSSD can utilize to fetch identity data
  243. from and authenticate against an LDAP server.
  244.  
  245. %package krb5-common
  246. Summary: SSSD helpers needed for Kerberos and GSSAPI authentication
  247. Group: Applications/System
  248. License: GPLv3+
  249. Conflicts: sssd < 1.10.0-8.beta2
  250. Requires: cyrus-sasl-gssapi%{?_isa}
  251. Requires: sssd-common = %{version}-%{release}
  252.  
  253. %description krb5-common
  254. Provides helper processes that the LDAP and Kerberos back ends can use for
  255. Kerberos user or host authentication.
  256.  
  257. %package krb5
  258. Summary: The Kerberos authentication back end for the SSSD
  259. Group: Applications/System
  260. License: GPLv3+
  261. Conflicts: sssd < 1.10.0-8.beta2
  262. Requires: sssd-common = %{version}-%{release}
  263. Requires: sssd-krb5-common = %{version}-%{release}
  264.  
  265. %description krb5
  266. Provides the Kerberos back end that the SSSD can utilize authenticate
  267. against a Kerberos server.
  268.  
  269. # RHEL 5 is too old to support the PAC responder
  270. %if !0%{?is_rhel5}
  271. %package common-pac
  272. Summary: Common files needed for supporting PAC processing
  273. Group: Applications/System
  274. License: GPLv3+
  275. Requires: sssd-common = %{version}-%{release}
  276.  
  277. %description common-pac
  278. Provides common files needed by SSSD providers such as IPA and Active Directory
  279. for handling Kerberos PACs.
  280. %endif #is_rhel5
  281.  
  282. %package ipa
  283. Summary: The IPA back end of the SSSD
  284. Group: Applications/System
  285. License: GPLv3+
  286. Conflicts: sssd < 1.10.0-8.beta2
  287. Requires: sssd-common = %{version}-%{release}
  288. Requires: sssd-krb5-common = %{version}-%{release}
  289. Requires: libipa_hbac%{?_isa} = %{version}-%{release}
  290. Requires: bind-utils
  291. # RHEL 5 is too old to support the PAC responder
  292. %if !0%{?is_rhel5}
  293. Requires: sssd-common-pac = %{version}-%{release}
  294. %endif
  295.  
  296. %description ipa
  297. Provides the IPA back end that the SSSD can utilize to fetch identity data
  298. from and authenticate against an IPA server.
  299.  
  300. %package ad
  301. Summary: The AD back end of the SSSD
  302. Group: Applications/System
  303. License: GPLv3+
  304. Conflicts: sssd < 1.10.0-8.beta2
  305. Requires: sssd-common = %{version}-%{release}
  306. Requires: sssd-krb5-common = %{version}-%{release}
  307. Requires: bind-utils
  308. # RHEL 5 is too old to support the PAC responder
  309. %if !0%{?is_rhel5}
  310. Requires: sssd-common-pac = %{version}-%{release}
  311. %endif
  312.  
  313. %description ad
  314. Provides the Active Directory back end that the SSSD can utilize to fetch
  315. identity data from and authenticate against an Active Directory server.
  316.  
  317. %package proxy
  318. Summary: The proxy back end of the SSSD
  319. Group: Applications/System
  320. License: GPLv3+
  321. Conflicts: sssd < 1.10.0-8.beta2
  322. Requires: sssd-common = %{version}-%{release}
  323.  
  324. %description proxy
  325. Provides the proxy back end which can be used to wrap an existing NSS and/or
  326. PAM modules to leverage SSSD caching.
  327.  
  328. %package -n libsss_idmap
  329. Summary: FreeIPA Idmap library
  330. Group: Development/Libraries
  331. License: LGPLv3+
  332. Requires(post): /sbin/ldconfig
  333. Requires(postun): /sbin/ldconfig
  334.  
  335. %description -n libsss_idmap
  336. Utility library to convert SIDs to Unix uids and gids
  337.  
  338. %package -n libsss_idmap-devel
  339. Summary: FreeIPA Idmap library
  340. Group: Development/Libraries
  341. License: LGPLv3+
  342. Requires: libsss_idmap = %{version}-%{release}
  343.  
  344. %description -n libsss_idmap-devel
  345. Utility library to SIDs to Unix uids and gids
  346.  
  347. %package -n libipa_hbac
  348. Summary: FreeIPA HBAC Evaluator library
  349. Group: Development/Libraries
  350. License: LGPLv3+
  351. Requires(post): /sbin/ldconfig
  352. Requires(postun): /sbin/ldconfig
  353.  
  354. %description -n libipa_hbac
  355. Utility library to validate FreeIPA HBAC rules for authorization requests
  356.  
  357. %package -n libipa_hbac-devel
  358. Summary: FreeIPA HBAC Evaluator library
  359. Group: Development/Libraries
  360. License: LGPLv3+
  361. Requires: libipa_hbac = %{version}-%{release}
  362.  
  363. %description -n libipa_hbac-devel
  364. Utility library to validate FreeIPA HBAC rules for authorization requests
  365.  
  366. %package -n libipa_hbac-python
  367. Summary: Python bindings for the FreeIPA HBAC Evaluator library
  368. Group: Development/Libraries
  369. License: LGPLv3+
  370. Requires: libipa_hbac = %{version}-%{release}
  371.  
  372. %description -n libipa_hbac-python
  373. The libipa_hbac-python contains the bindings so that libipa_hbac can be
  374. used by Python applications.
  375.  
  376. %package -n libsss_nss_idmap
  377. Summary: Library for SID based lookups
  378. Group: Development/Libraries
  379. License: LGPLv3+
  380. Requires(post): /sbin/ldconfig
  381. Requires(postun): /sbin/ldconfig
  382.  
  383. %description -n libsss_nss_idmap
  384. Utility library for SID based lookups
  385.  
  386. %package -n libsss_nss_idmap-devel
  387. Summary: Library for SID based lookups
  388. Group: Development/Libraries
  389. License: LGPLv3+
  390. Requires: libsss_nss_idmap = %{version}-%{release}
  391.  
  392. %description -n libsss_nss_idmap-devel
  393. Utility library for SID based lookups
  394.  
  395. %package -n libsss_nss_idmap-python
  396. Summary: Python bindings for libsss_nss_idmap
  397. Group: Development/Libraries
  398. License: LGPLv3+
  399. Requires: libsss_nss_idmap = %{version}-%{release}
  400.  
  401. %description -n libsss_nss_idmap-python
  402. The libsss_nss_idmap-python contains the bindings so that libsss_nss_idmap can
  403. be used by Python applications.
  404.  
  405. %package dbus
  406. Summary: The D-Bus responder of the SSSD
  407. Group: Applications/System
  408. License: GPLv3+
  409. Requires: sssd-common = %{version}-%{release}
  410.  
  411. %description dbus
  412. Provides the D-Bus responder of the SSSD, called the InfoPipe, that allows
  413. the information from the SSSD to be transmitted over the system bus.
  414.  
  415. %prep
  416. # Update timestamps on the files touched by a patch, to avoid non-equal
  417. # .pyc/.pyo files across the multilib peers within a build, where "Level"
  418. # is the patch prefix option (e.g. -p1)
  419. # Taken from specfile for python-simplejson
  420. UpdateTimestamps() {
  421. Level=$1
  422. PatchFile=$2
  423.  
  424. # Locate the affected files:
  425. for f in $(diffstat $Level -l $PatchFile); do
  426. # Set the files to have the same timestamp as that of the patch:
  427. touch -r $PatchFile $f
  428. done
  429. }
  430.  
  431. %setup -q
  432.  
  433. for p in %patches ; do
  434. %__patch -p1 -i $p
  435. UpdateTimestamps -p1 $p
  436. done
  437.  
  438. %build
  439. autoreconf -ivf
  440. %configure \
  441. --without-samba \
  442. --disable-krb5-locator-plugin \
  443. --disable-pac-responder \
  444. --without-sudo \
  445. --without-autofs \
  446.  
  447. make %{?_smp_mflags} all docs
  448.  
  449. %check
  450. export CK_TIMEOUT_MULTIPLIER=10
  451. make %{?_smp_mflags} check
  452. unset CK_TIMEOUT_MULTIPLIER
  453.  
  454. %install
  455. rm -rf $RPM_BUILD_ROOT
  456.  
  457. make install DESTDIR=$RPM_BUILD_ROOT
  458.  
  459. # Prepare language files
  460. /usr/lib/rpm/find-lang.sh $RPM_BUILD_ROOT sssd
  461.  
  462. # Prepare empty config file
  463. mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sssd
  464. touch $RPM_BUILD_ROOT/%{_sysconfdir}/sssd/sssd.conf
  465.  
  466. # Copy default logrotate file
  467. mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d
  468. install -m644 src/examples/logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sssd
  469.  
  470. # Make sure SSSD is able to run on read-only root
  471. mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rwtab.d
  472. install -m644 src/examples/rwtab $RPM_BUILD_ROOT%{_sysconfdir}/rwtab.d/sssd
  473.  
  474. # Remove .la files created by libtool
  475. find $RPM_BUILD_ROOT -name "*.la" -exec rm -f {} \;
  476.  
  477. # Suppress developer-only documentation
  478. rm -Rf ${RPM_BUILD_ROOT}/%{_docdir}/%{name}
  479.  
  480. # Older versions of rpmbuild can only handle one -f option
  481. # So we need to append to the sssd*.lang file
  482. for file in `ls $RPM_BUILD_ROOT/%{python_sitelib}/*.egg-info 2> /dev/null`
  483. do
  484. echo %{python_sitelib}/`basename $file` >> python_sssdconfig.lang
  485. done
  486.  
  487. touch sssd_tools.lang
  488. touch sssd_client.lang
  489. for provider in ldap krb5 ipa ad proxy
  490. do
  491. touch sssd_$provider.lang
  492. done
  493.  
  494. for man in `find $RPM_BUILD_ROOT/%{_mandir}/??/man?/ -type f | sed -e "s#$RPM_BUILD_ROOT/%{_mandir}/##"`
  495. do
  496. lang=`echo $man | cut -c 1-2`
  497. case `basename $man` in
  498. sss_cache*)
  499. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd.lang
  500. ;;
  501. sss_*)
  502. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_tools.lang
  503. ;;
  504. sssd_krb5_*)
  505. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_client.lang
  506. ;;
  507. pam_sss*)
  508. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_client.lang
  509. ;;
  510. sssd-ldap*)
  511. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ldap.lang
  512. ;;
  513. sssd-krb5*)
  514. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_krb5.lang
  515. ;;
  516. sssd-ipa*)
  517. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ipa.lang
  518. ;;
  519. sssd-ad*)
  520. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ad.lang
  521. ;;
  522. sssd-proxy*)
  523. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_proxy.lang
  524. ;;
  525. *)
  526. echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd.lang
  527. ;;
  528. esac
  529. done
  530.  
  531. # Print these to the rpmbuild log
  532. echo "sssd.lang:"
  533. cat sssd.lang
  534.  
  535. echo "sssd_client.lang:"
  536. cat sssd_client.lang
  537.  
  538. echo "sssd_tools.lang:"
  539. cat sssd_tools.lang
  540.  
  541. for provider in ldap krb5 ipa ad proxy
  542. do
  543. echo "sssd_$provider.lang:"
  544. cat sssd_$provider.lang
  545. done
  546.  
  547.  
  548. %clean
  549. rm -rf $RPM_BUILD_ROOT
  550.  
  551. %files
  552. %defattr(-,root,root,-)
  553. %doc COPYING
  554.  
  555. %files common -f sssd.lang
  556. %defattr(-,root,root,-)
  557. %doc COPYING
  558. %doc src/examples/sssd-example.conf
  559. %{_initrddir}/%{name}
  560. %{_sbindir}/sssd
  561.  
  562. %dir %{_libexecdir}/%{servicename}
  563. %{_libexecdir}/%{servicename}/sssd_be
  564. %{_libexecdir}/%{servicename}/sssd_nss
  565. %{_libexecdir}/%{servicename}/sssd_pam
  566. %{_libexecdir}/%{servicename}/sssd_autofs
  567. %{_libexecdir}/%{servicename}/sssd_ssh
  568. %{_libexecdir}/%{servicename}/sssd_sudo
  569.  
  570. %dir %{_libdir}/%{name}
  571. %{_libdir}/%{name}/libsss_simple.so
  572.  
  573. #Internal shared libraries
  574. %{_libdir}/%{name}/libsss_child.so
  575. %{_libdir}/%{name}/libsss_crypt.so
  576. %{_libdir}/%{name}/libsss_debug.so
  577. %{_libdir}/%{name}/libsss_ldap_common.so
  578. %{_libdir}/%{name}/libsss_util.so
  579.  
  580. # 3rd party application libraries
  581. %{_libdir}/sssd/modules/libsss_autofs.so
  582. %{_libdir}/libsss_sudo.so
  583.  
  584. %{ldb_modulesdir}/memberof.so
  585. %{_bindir}/sss_ssh_authorizedkeys
  586. %{_bindir}/sss_ssh_knownhostsproxy
  587. %{_sbindir}/sss_cache
  588. %{_libexecdir}/%{servicename}/sss_signal
  589.  
  590. %dir %{sssdstatedir}
  591. %dir %{_localstatedir}/cache/krb5rcache
  592. %attr(700,root,root) %dir %{dbpath}
  593. %attr(755,root,root) %dir %{mcpath}
  594. %ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/passwd
  595. %ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group
  596. %attr(755,root,root) %dir %{pipepath}
  597. %attr(755,root,root) %dir %{pubconfpath}
  598. %attr(700,root,root) %dir %{pipepath}/private
  599. %attr(750,root,root) %dir %{_var}/log/%{name}
  600. %attr(700,root,root) %dir %{_sysconfdir}/sssd
  601. %ghost %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
  602. %config(noreplace) %{_sysconfdir}/logrotate.d/sssd
  603. %config(noreplace) %{_sysconfdir}/rwtab.d/sssd
  604. %dir %{_datadir}/sssd
  605. %{_datadir}/sssd/sssd.api.conf
  606. %{_datadir}/sssd/sssd.api.d
  607. %{_mandir}/man1/sss_ssh_authorizedkeys.1*
  608. %{_mandir}/man1/sss_ssh_knownhostsproxy.1*
  609. %{_mandir}/man5/sssd.conf.5*
  610. %{_mandir}/man5/sssd-simple.5*
  611. %{_mandir}/man5/sssd-sudo.5*
  612. %{_mandir}/man8/sssd.8*
  613. %{_mandir}/man8/sss_cache.8*
  614. %{python_sitearch}/pysss.so
  615. %{python_sitearch}/pysss_murmur.so
  616.  
  617. %files ldap -f sssd_ldap.lang
  618. %defattr(-,root,root,-)
  619. %doc COPYING
  620. %{_libdir}/%{name}/libsss_ldap.so
  621. %{_mandir}/man5/sssd-ldap.5*
  622.  
  623. %files krb5-common
  624. %defattr(-,root,root,-)
  625. %doc COPYING
  626. %{_libdir}/%{name}/libsss_krb5_common.so
  627. %{_libexecdir}/%{servicename}/ldap_child
  628. %{_libexecdir}/%{servicename}/krb5_child
  629.  
  630. %files krb5 -f sssd_krb5.lang
  631. %defattr(-,root,root,-)
  632. %doc COPYING
  633. %{_libdir}/%{name}/libsss_krb5.so
  634. %{_mandir}/man5/sssd-krb5.5*
  635.  
  636. # RHEL 5 is too old to support the PAC responder
  637. %if !0%{?is_rhel5}
  638. %files common-pac
  639. %defattr(-,root,root,-)
  640. %doc COPYING
  641. %{_libexecdir}/%{servicename}/sssd_pac
  642. %endif
  643.  
  644. %files ipa -f sssd_ipa.lang
  645. %defattr(-,root,root,-)
  646. %doc COPYING
  647. %attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
  648. %{_libdir}/%{name}/libsss_ipa.so
  649. %{_mandir}/man5/sssd-ipa.5*
  650.  
  651. %files ad -f sssd_ad.lang
  652. %defattr(-,root,root,-)
  653. %doc COPYING
  654. %{_libdir}/%{name}/libsss_ad.so
  655. %{_mandir}/man5/sssd-ad.5*
  656.  
  657. %files proxy
  658. %defattr(-,root,root,-)
  659. %doc COPYING
  660. %{_libexecdir}/%{servicename}/proxy_child
  661. %{_libdir}/%{name}/libsss_proxy.so
  662.  
  663. %files dbus
  664. %defattr(-,root,root,-)
  665. %doc COPYING
  666. %{_libexecdir}/%{servicename}/sssd_ifp
  667. %{_mandir}/man5/sssd-ifp.5*
  668. # InfoPipe DBus plumbing
  669. %{_sysconfdir}/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
  670. %{_datadir}/dbus-1/system-services/org.freedesktop.sssd.infopipe.service
  671.  
  672. %files client -f sssd_client.lang
  673. %defattr(-,root,root,-)
  674. %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
  675. /%{_lib}/libnss_sss.so.2
  676. /%{_lib}/security/pam_sss.so
  677. %{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
  678. %{_libdir}/krb5/plugins/authdata/sssd_pac_plugin.so
  679. %{_mandir}/man8/pam_sss.8*
  680. %{_mandir}/man8/sssd_krb5_locator_plugin.8*
  681.  
  682. %files tools -f sssd_tools.lang
  683. %defattr(-,root,root,-)
  684. %doc COPYING
  685. %{_sbindir}/sss_useradd
  686. %{_sbindir}/sss_userdel
  687. %{_sbindir}/sss_usermod
  688. %{_sbindir}/sss_groupadd
  689. %{_sbindir}/sss_groupdel
  690. %{_sbindir}/sss_groupmod
  691. %{_sbindir}/sss_groupshow
  692. %{_sbindir}/sss_obfuscate
  693. %{_sbindir}/sss_debuglevel
  694. %{_sbindir}/sss_seed
  695. %{_mandir}/man8/sss_groupadd.8*
  696. %{_mandir}/man8/sss_groupdel.8*
  697. %{_mandir}/man8/sss_groupmod.8*
  698. %{_mandir}/man8/sss_groupshow.8*
  699. %{_mandir}/man8/sss_useradd.8*
  700. %{_mandir}/man8/sss_userdel.8*
  701. %{_mandir}/man8/sss_usermod.8*
  702. %{_mandir}/man8/sss_obfuscate.8*
  703. %{_mandir}/man8/sss_debuglevel.8*
  704. %{_mandir}/man8/sss_seed.8*
  705.  
  706. %files -n python-sssdconfig -f python_sssdconfig.lang
  707. %defattr(-,root,root,-)
  708. %dir %{python_sitelib}/SSSDConfig
  709. %{python_sitelib}/SSSDConfig/*.py*
  710.  
  711. %files -n libsss_idmap
  712. %defattr(-,root,root,-)
  713. %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
  714. %{_libdir}/libsss_idmap.so.*
  715.  
  716. %files -n libsss_idmap-devel
  717. %defattr(-,root,root,-)
  718. %doc idmap_doc/html
  719. %{_includedir}/sss_idmap.h
  720. %{_libdir}/libsss_idmap.so
  721. %{_libdir}/pkgconfig/sss_idmap.pc
  722.  
  723. %files -n libipa_hbac
  724. %defattr(-,root,root,-)
  725. %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
  726. %{_libdir}/libipa_hbac.so.*
  727.  
  728. %files -n libipa_hbac-devel
  729. %defattr(-,root,root,-)
  730. %doc hbac_doc/html
  731. %{_includedir}/ipa_hbac.h
  732. %{_libdir}/libipa_hbac.so
  733. %{_libdir}/pkgconfig/ipa_hbac.pc
  734.  
  735. %files -n libipa_hbac-python
  736. %defattr(-,root,root,-)
  737. %{python_sitearch}/pyhbac.so
  738.  
  739. %files -n libsss_nss_idmap
  740. %defattr(-,root,root,-)
  741. %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
  742. %{_libdir}/libsss_nss_idmap.so.*
  743.  
  744. %files -n libsss_nss_idmap-devel
  745. %defattr(-,root,root,-)
  746. %doc nss_idmap_doc/html
  747. %{_includedir}/sss_nss_idmap.h
  748. %{_libdir}/libsss_nss_idmap.so
  749. %{_libdir}/pkgconfig/sss_nss_idmap.pc
  750.  
  751. %files -n libsss_nss_idmap-python
  752. %defattr(-,root,root,-)
  753. %{python_sitearch}/pysss_nss_idmap.so
  754.  
  755. %post common
  756. /sbin/chkconfig --add %{servicename}
  757.  
  758. # sssd-1.8.0-24 changed the startup order
  759. # We need to make sure this is always updated on
  760. # clients
  761. /sbin/chkconfig %{servicename} resetpriorities
  762.  
  763. if [ $1 -ge 1 ] ; then
  764. restorecon -R %{mcachepath} 2>/dev/null || :
  765. fi
  766.  
  767. %posttrans
  768. /sbin/service %{servicename} condrestart 2>&1 > /dev/null
  769.  
  770. %preun common
  771. if [ $1 = 0 ]; then
  772. /sbin/service %{servicename} stop 2>&1 > /dev/null
  773. /sbin/chkconfig --del %{servicename}
  774. fi
  775.  
  776. %post client -p /sbin/ldconfig
  777.  
  778. %postun client -p /sbin/ldconfig
  779.  
  780. %post -n libipa_hbac -p /sbin/ldconfig
  781.  
  782. %postun -n libipa_hbac -p /sbin/ldconfig
  783.  
  784. %post -n libsss_idmap -p /sbin/ldconfig
  785.  
  786. %postun -n libsss_idmap -p /sbin/ldconfig
  787.  
  788. %changelog
  789. * Mon Sep 15 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30
  790. - Resolves: rhbz#1139044 - RHEL6.6 ipa user private group not found
  791.  
  792. * Thu Sep 04 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-29
  793. - Resolves: rhbz#1103487 - CVE-2014-0249 - sssd: incorrect expansion of group
  794. membership when encountering a non-POSIX group
  795.  
  796. * Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-28
  797. - Resolves: rhbz#1125187 - simple_allow_groups does not lookup groups from
  798. other AD domains
  799.  
  800. * Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-27
  801. - Resolves: rhbz#1127270 - sssd connect to ipa-server is long
  802.  
  803. * Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-26
  804. - Resolves: rhbz#1130017 - Saving group membership fails if provider is AD,
  805. POSIX attributes are used and primary group contains
  806. the user as a member
  807.  
  808. * Mon Aug 25 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-25
  809. - Resolves: rhbz#1111528 - Expired shadow policy user(shadowLastChange=0)
  810. is not prompted for password change
  811.  
  812. * Fri Aug 22 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-24
  813. - Resolves: rhbz#1132361 - use-after-free in dyndns code
  814.  
  815. * Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-23
  816. - Resolves: rhbz#1099290: RFE: Be able to configure sssd to honor openldap
  817. account lock to restrict access via ssh key
  818.  
  819. * Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-22
  820. - Use the correct sudo iterator
  821. - Related: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk
  822.  
  823. * Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-21
  824. - Add notes about offline mode to sssd.conf
  825. - Related: rhbz#1110226 - Requests queued during transition from offline
  826. to online mode
  827.  
  828. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-20
  829. - Resolves: rhbz#1127278 - Auth fails when space in username is
  830. replaced with character set by
  831. override_default_whitespace
  832.  
  833. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-19
  834. - Resolves: rhbz#1127757 - sssd can't retrieve sudo rules when using the
  835. "default_domain_suffix" option
  836.  
  837. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-18
  838. - Resolves: rhbz#1127265 - Problems with tokengroups and ldap_group_search_base
  839.  
  840. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-17
  841. - Resolves: rhbz#1126636 - RHEL6.6 sssd not running after upgrade
  842.  
  843. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-16
  844. - Resolves: rhbz#1128612 - IFP: FQDN lookups are broken
  845.  
  846. * Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-15
  847. - Resolves: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk
  848.  
  849. * Thu Jul 31 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-14
  850. - Resolves: rhbz#1110226 - Requests queued during transition from offline
  851. to online mode
  852.  
  853. * Thu Jul 31 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-13
  854. - Resolves: rhbz#1122873 - Failover does not always happen from SRV
  855. to hostname resolution(via /etc/hosts)
  856. - Remove spurious systemctl call on %postun
  857.  
  858. * Mon Jul 28 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-12
  859. - Resolves: rhbz#1111317 - [RFE] Add option for sssd to replace space with
  860. specified character in LDAP group
  861.  
  862. * Fri Jul 25 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-11
  863. - Resolves: rhbz#1109188 - dereferencing control failure against openldap
  864. server
  865.  
  866. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-10
  867. - Resolves: rhbz#1084532 - sssd_sudo process segfaults
  868.  
  869. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-9
  870. - Resolves: rhbz#1122158 - ad: group membership is empty when id mapping
  871. is off and tokengroups are enabled
  872.  
  873. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-8
  874. - Resolves: rhbz#1118541 - Floating point exception using ldap
  875.  
  876. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-7
  877. - Resolves: rhbz#1042922 - [RFE] Add fallback to sudoRunAs when sudoRunAsUser
  878. is not defined and no ldap_sudorule_runasuser mapping
  879. has been defined in SSSD
  880.  
  881. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-6
  882. - Resolves: rhbz#1120508 - tokengroups do not work with id_provider=ldap
  883.  
  884. * Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-5
  885. - Fix potential NULL dereference in IFP code
  886. - Related: rhbz#1110369 - sssd is started before messagebus, making
  887. sssd-ifp fail
  888.  
  889. * Wed Jul 16 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-4
  890. - BuildRequire the latest libini_config
  891. - Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
  892.  
  893. * Mon Jul 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-3
  894. - Resolves: rhbz#1110369 - sssd is started before messagebus, making
  895. sssd-ifp fail
  896.  
  897. * Tue Jun 03 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-2
  898. - Resolves: rhbz#1104145 - public key validator is too strict and does not
  899. allow newlines anywhere in the public key string,
  900. not even at the end
  901.  
  902. * Tue Jun 03 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-1
  903. - Rebase to 1.11.6
  904. - Resolves: #1051164 - Rebase SSSD to 1.11+ in RHEL6
  905.  
  906. * Thu May 29 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-4
  907. - Rebuild against new ding-libs
  908. - Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
  909.  
  910. * Wed May 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-3
  911. - Backport the InfoPipe patches needed for Sat6 integration
  912. - Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
  913.  
  914. * Mon May 12 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-2
  915. - Resolves: #1085412 - SSSD Crashes when storage experiences high latency
  916.  
  917. * Wed Apr 16 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-1
  918. - Resolves: #1051164 - Rebase SSSD to 1.11+ in RHEL6
  919.  
  920. * Mon Feb 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-134
  921. Resolves: #1036168 - sssd can't retrieve auto.master when using the
  922. "default_domain_suffix"
  923.  
  924. * Mon Feb 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-133
  925. - Resolves: #1065534 - SSSD pam module accepts usernames with leading spaces
  926.  
  927. * Thu Dec 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-132
  928. - Resolves: #1038098 - sssd_nss grows memory footprint when netgroups
  929. are requested
  930.  
  931. * Tue Nov 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-131
  932. - Allow combination of proxy id backend and LDAP auth backend
  933. - Resolves: #1025813 - SSSD: Allow for custom attributes in RDN when using
  934. id_provider = proxy
  935.  
  936. * Tue Nov 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-130
  937. - Inherit UID limits for subdomains
  938. - Resolves: #1020905 - Creating system accounts on a IdM client takes up
  939. to 10 minutes when AD trust is configured in the IdM.
  940.  
  941. * Tue Oct 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129
  942. - Do not crash when LDAP disconnects while a search is still in progress
  943. - Resolves: #1019979 - sssd_be segfault when authenticating against active
  944. directory
  945.  
  946. * Thu Sep 26 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-128
  947. - More upstream fixes to prevent memcache crashes
  948. - Related: #997406 - sssd_nss core dumps under load
  949.  
  950. * Thu Sep 12 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-127
  951. - Resolves: #1002929 - sssd_be segfaults if IPA dynamic DNS update times out
  952.  
  953. * Tue Sep 3 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-126
  954. - Make IPA SELinux provider aware of subdomain users
  955. - A better version of already committed patch
  956. - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
  957. 'sysdb_search_user_by_name failed' error when
  958. AD user tries to login via ipa client.
  959.  
  960. * Fri Aug 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-125
  961. - Resolves: #997406 - sssd_nss core dumps under load
  962. - Resolves: #984814 - sssd_nss terminated with segmentation fault
  963.  
  964. * Fri Aug 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-124
  965. - Resolves: #1002161 - large number of sudo rules results in error -
  966. Unable to create response: Invalid argument
  967.  
  968. * Mon Aug 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-123
  969. - Silence restorecon on clean install
  970. - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
  971. /var/lib/sss/mc context
  972.  
  973. * Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-122
  974. - Make IPA SELinux provider aware of subdomain users
  975. - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
  976. 'sysdb_search_user_by_name failed' error when
  977. AD user tries to login via ipa client.
  978.  
  979. * Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-121
  980. - Print password complexity hint when password change fails with
  981. constraint violation
  982. - Related: #983028 - passwd returns "Authentication token manipulation
  983. error" when entering wrong current password
  984.  
  985. * Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-120
  986. - Resolves: #983028 - passwd returns "Authentication token manipulation
  987. error" when entering wrong current password
  988.  
  989. * Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-119
  990. - Resolves: #948830 - sssd do too many disk writes causing delay in
  991. "getent netgroup allmachines-netgroup" nested netgroups.
  992.  
  993. * Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-118
  994. - Resolves: #984814 - sssd_nss terminated with segmentation fault
  995.  
  996. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-117
  997. - Resolves: #966757 - SSSD failover doesn't work if the first DNS server
  998. in resolv.conf is unavailable
  999.  
  1000. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-116
  1001. - Resolves: #963235 - sssd_be crashing with nested ldap groups
  1002.  
  1003. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-115
  1004. - Apply a forgotten dependency for patch #254
  1005. - Related: #916997 - getgrnam / getgrgid for large user groups
  1006. is too slow due to range retrieval functionality
  1007. - Add two fixes for better handling of faulty SRV processing
  1008. - Related: #954275 - sssd fails connect to IPA server during boot when
  1009. spanning tree is enabled in network router.
  1010. - Remove enumerate=true from example in man page
  1011. - Related: #988381 - clarify the disadvantages of enumeration in sssd.conf
  1012.  
  1013. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-114
  1014. - Resolves: #914433 - sssd pam write_selinux_login_file creating the temp
  1015. file for SELinux data failed
  1016.  
  1017. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-113
  1018. - Resolves: #916997 - getgrnam / getgrgid for large user groups
  1019. is too slow due to range retrieval functionality
  1020.  
  1021. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-112
  1022. - Resolves: #918394 - sssd etas 99% CPU and runs out of file descriptors
  1023. when clearing cache
  1024.  
  1025. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-111
  1026. - Resolves: #924113 - man sssd-sudo has wrong title
  1027.  
  1028. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-110
  1029. - Resolves: #924397 - document what does access_provider=ad do
  1030.  
  1031. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-109
  1032. - Use permissive control when adding ghost users
  1033. - Resolves: #928797 - cyclic group memberships may not work depending on
  1034. order of operations
  1035.  
  1036. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-108
  1037. - Set correct state of SRV servers on resolving error
  1038. - Resolves: #954275 - sssd fails connect to IPA server during boot when
  1039. spanning tree is enabled in network router.
  1040.  
  1041. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-107
  1042. - Resolves: #954323 - SSSD doesn't display warning for last grace login.
  1043.  
  1044. * Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-106
  1045. - Format patch to configure sysv script differently
  1046. - RHEL-6 patch(1) apparently doesn't like the output of git format-patch
  1047. -M -C and doesn't properly copy files on renames
  1048. - Resolves: #971435 - Enhance sssd init script so that it would source a
  1049. configuration.
  1050.  
  1051. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-105
  1052. - Resolves: #973345 - SSSD service randomly dies
  1053.  
  1054. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-104
  1055. - Resolves: #971435 - Enhance sssd init script so that it would source
  1056. a configuration
  1057.  
  1058. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-103
  1059. - Resolves: #961356 - SUDO is not working for users from trusted AD domain
  1060.  
  1061. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-102
  1062. - Resolves: #970519 - [RFE] Add support for suppressing group members
  1063.  
  1064. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-101
  1065. - Resolves: #976273 - [RFE] Add a new override_homedir expansion for the
  1066. "original value"
  1067.  
  1068. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-100
  1069. - Resolves: #978966 - sudoHost mismatch response is incorrect sometimes
  1070.  
  1071. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-99
  1072. - Clarify the min_id/max_id limits further
  1073. - Resolves: #978994 - SSSD filter out ldap user/group if uid/gid is zero
  1074.  
  1075. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-98
  1076. - Resolves: #979046 - sssd_be goes to 99% CPU and causes significant login
  1077. delays when client is under load
  1078.  
  1079. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-97
  1080. - Resolves: #986379 - sss_cache -N/-n should invalidate the hash table
  1081. in sssd_nss
  1082.  
  1083. * Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-96
  1084. - Resolves: #988525 - sssd fails instead of skipping when a sudo ldap
  1085. filter returns entries with multiple CNs
  1086.  
  1087. * Thu Jul 25 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-95
  1088. - Mention that enumeration should be discouraged
  1089. - Resolves: #988381 - clarify the disadvantages of enumeration in sssd.conf
  1090.  
  1091. * Thu Jul 25 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-94
  1092. - Call restorecon on memcache files to force the right context on upgrades
  1093. - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
  1094. /var/lib/sss/mc context
  1095.  
  1096. * Wed Jul 24 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-93
  1097. - Resolves: #987479 - libsss_sudo should depend on sudo package with
  1098. sssd support
  1099.  
  1100. * Fri Jul 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-92
  1101. - Resolves: #951086 - sssd_pam segfaults if sssd_be is stuck
  1102.  
  1103. * Thu May 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-91
  1104. - Resolves: #967636 - SSSD frequently fails to return automount maps
  1105. from LDAP
  1106.  
  1107. * Wed May 1 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-90
  1108. - Resolves: #953165 - Enabling enumeration causes sssd_be process to
  1109. utilize 100% of the CPU
  1110.  
  1111. * Tue Apr 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-89
  1112. - Resolves: #906398 - sssd_be crashes sometimes
  1113.  
  1114. * Mon Apr 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-88
  1115. - Resolves: #950874: Simple access control always denies uppercased users
  1116. in case insensitive domain
  1117.  
  1118. * Tue Mar 20 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-87
  1119. - Resolves: #921454: Resolve local group members in LDAP groups
  1120.  
  1121. * Tue Mar 05 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-86
  1122. - Resolves: rhbz#911299 - sssd: simple access provider flaw prevents intended
  1123. ACL use when client to an AD provider
  1124.  
  1125. * Fri Mar 01 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-85
  1126. - Fix pwd_expiration_warning=0
  1127. - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
  1128. Kerberos
  1129.  
  1130. * Fri Feb 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-84
  1131. - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
  1132. Kerberos
  1133.  
  1134. * Wed Jan 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-83
  1135. - Resolves: rhbz#872827 - Serious performance regression in sssd
  1136.  
  1137. * Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82
  1138. - Resolves: rhbz#888614 - Failure in memberof can lead to failed
  1139. database update
  1140.  
  1141. * Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-81
  1142. - Resolves: rhbz#903078 - TOCTOU race conditions by copying
  1143. and removing directory trees
  1144.  
  1145. * Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-80
  1146. - Resolves: rhbz#903078 - Out-of-bounds read flaws in
  1147. autofs and ssh services responders
  1148.  
  1149. * Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-79
  1150. - Resolves: rhbz#902716 - Rule mismatch isn't noticed before smart refresh
  1151. on ppc64 and s390x
  1152.  
  1153. * Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-78
  1154. - Resolves: rhbz#896476 - SSSD should warn when pam_pwd_expiration_warning
  1155. value is higher than passwordWarning LDAP attribute.
  1156.  
  1157. * Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-77
  1158. - Resolves: rhbz#902436 - possible segfault when backend callback is removed
  1159.  
  1160. * Mon Jan 21 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-76
  1161. - Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
  1162. reflected in memory cache
  1163.  
  1164. * Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-75
  1165. - Resolves: rhbz#894302 - sssd fails to update to changes on autofs maps
  1166.  
  1167. * Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-74
  1168. - Resolves: rhbz894381 - memory cache is not updated after user is deleted
  1169. from ldb cache
  1170.  
  1171. * Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-73
  1172. - Resolves: rhbz895615 - ipa-client-automount: autofs failed in s390x and
  1173. ppc64 platform
  1174.  
  1175. * Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-72
  1176. - Resolves: rhbz#894997 - sssd_be crashes looking up members with groups
  1177. outside the nesting limit
  1178.  
  1179. * Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-71
  1180. - Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
  1181. reflected in memory cache
  1182.  
  1183. * Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-70
  1184. - Resolves: rhbz#894428 - wrong filter for autofs maps in sss_cache
  1185.  
  1186. * Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-69
  1187. - Resolves: rhbz#894738 - Failover to ldap_chpass_backup_uri doesn't work
  1188.  
  1189. * Wed Jan 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-68
  1190. - Resolves: rhbz#887961 - AD provider: getgrgid removes nested group
  1191. memberships
  1192.  
  1193. * Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-67
  1194. - Resolves: rhbz#878583 - IPA Trust does not show secondary groups for AD
  1195. Users for commands like id and getent
  1196.  
  1197. * Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-66
  1198. - Resolves: rhbz#874579 - sssd caching not working as expected for selinux
  1199. usermap contexts
  1200.  
  1201. * Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-65
  1202. - Resolves: rhbz#892197 - Incorrect principal searched for in keytab
  1203.  
  1204. * Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-64
  1205. - Resolves: rhbz#891356 - Smart refresh doesn't notice "defaults" addition
  1206. with OpenLDAP
  1207.  
  1208. * Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-63
  1209. - Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
  1210. cache
  1211.  
  1212. * Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-62
  1213. - Resolves: rhbz#886848 - user id lookup fails for case sensitive users
  1214. using proxy provider
  1215.  
  1216. * Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-61
  1217. - Resolves: rhbz#890520 - Failover to krb5_backup_kpasswd doesn't work
  1218.  
  1219. * Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-60
  1220. - Resolves: rhbz#874618 - sss_cache: fqdn not accepted
  1221.  
  1222. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-59
  1223. - Resolves: rhbz#889182 - crash in memory cache
  1224.  
  1225. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-58
  1226. - Resolves: rhbz#889168 - krb5 ticket renewal does not read the renewable
  1227. tickets from cache
  1228.  
  1229. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-57
  1230. - Resolves: rhbz#886091 - Disallow root SSH public key authentication
  1231. - Add default section to switch statement (Related: rhbz#884666)
  1232.  
  1233. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-56
  1234. - Resolves: rhbz#886038 - sssd components seem to mishandle sighup
  1235.  
  1236. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-55
  1237. - Resolves: rhbz#888800 - Memory leak in new memcache initgr cleanup function
  1238.  
  1239. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-54
  1240. - Resolves: rhbz#888614 - Failure in memberof can lead to failed database
  1241. update
  1242.  
  1243. * Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-53
  1244. - Resolves: rhbz#885078 - sssd_nss crashes during enumeration if the
  1245. enumeration is taking too long
  1246.  
  1247. * Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-52
  1248. - Related: rhbz#875851 - sysdb upgrade failed converting db to 0.11
  1249. - Include more debugging during the sysdb upgrade
  1250.  
  1251. * Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-51
  1252. - Resolves: rhbz#877972 - ldap_sasl_authid no longer accepts full principal
  1253.  
  1254. * Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-50
  1255. - Resolves: rhbz#870045 - always reread the master map from LDAP
  1256. - Resolves: rhbz#876531 - sss_cache does not work for automount maps
  1257.  
  1258. * Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-49
  1259. - Resolves: rhbz#884666 - sudo: if first full refresh fails, schedule
  1260. another first full refresh
  1261.  
  1262. * Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-48
  1263. - Resolves: rhbz#880956 - Primary server status is not always reset after
  1264. failover to backup server happened
  1265. - Silence a compilation warning in the memberof plugin (Related: rhbz#877974)
  1266. - Do not steal resolv result on error (Related: rhbz#882076)
  1267.  
  1268. * Mon Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-47
  1269. - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
  1270. provider
  1271.  
  1272. * Sat Dec 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-46
  1273. - Resolves: rhbz#884600 - ldap_chpass_uri failover fails on using same
  1274. hostname
  1275.  
  1276. * Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-45
  1277. - Resolves: rhbz#858345 - pam_sss(crond:account): Request to sssd
  1278. failed. Timer expired
  1279.  
  1280. * Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-44
  1281. - Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
  1282. cache
  1283.  
  1284. * Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-43
  1285. - Resolves: rhbz#880176 - memberUid required for primary groups to match
  1286. sudo rule
  1287.  
  1288. * Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-42
  1289. - Resolves: rhbz#885105 - sudo denies access with disabled
  1290. ldap_sudo_use_host_filter
  1291.  
  1292. * Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-41
  1293. - Resolves: rhbz#883408 - Option ldap_sudo_include_regexp named incorrectly
  1294.  
  1295. * Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-40
  1296. - Resolves: rhbz#880546 - krb5_kpasswd failover doesn't work
  1297. - Fix the error handler in sss_mc_create_file (Related: #789507)
  1298.  
  1299. * Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-39
  1300. - Resolves: rhbz#882221 - Offline sudo denies access with expired
  1301. entry_cache_timeout
  1302. - Fix several bugs found by Coverity and clang:
  1303. - Check the return value of diff_gid_lists (Related: #869071)
  1304. - Move misplaced sysdb assignment (Related: #827606)
  1305. - Remove dead assignment (Related: #827606)
  1306. - Fix copy-n-paste error in the memberof plugin (Related: #877974)
  1307.  
  1308. * Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-38
  1309. - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
  1310. provider
  1311. - Link sss_ssh_authorizedkeys and sss_ssh_knowhostsproxy with the client
  1312. libraries (Related: #870060)
  1313. - Move sss_ssh_knownhosts documentation to the correct section
  1314. (Related: #870060)
  1315.  
  1316. * Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-37
  1317. - Resolves: rhbz#884480 - user is not removed from group membership during
  1318. initgroups
  1319. - Fix incorrect synchronization in mmap cache (Related: #789507)
  1320.  
  1321. * Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-36
  1322. - Resolves: rhbz#883336 - sssd crashes during start if id_provider is
  1323. not mentioned
  1324.  
  1325. * Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-35
  1326. - Resolves: rhbz#882290 - arithmetic bug in the SSSD causes netgroup
  1327. midpoint refresh to be always set to 10 seconds
  1328.  
  1329. * Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-34
  1330. - Resolves: rhbz#877974 - updating top-level group does not reflect ghost
  1331. members correctly
  1332. - Resolves: rhbz#880159 - delete operation is not implemented for ghost users
  1333.  
  1334. * Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-33
  1335. - Resolves: rhbz#881773 - mmap cache needs update after db changes
  1336.  
  1337. * Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-32
  1338. - Resolves: rhbz#875677 - password expiry warning message doesn't appear
  1339. during auth
  1340. - Fix potential NULL dereference when skipping built-in AD groups
  1341. (Related: rhbz#874616)
  1342. - Add missing parameter to DEBUG message (Related: rhbz#829742)
  1343.  
  1344. * Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-31
  1345. - Resolves: rhbz#882076 - SSSD crashes when c-ares returns success but an
  1346. empty hostent during the DNS update
  1347. - Do not version libsss_sudo, it's not supposed to be linked against, but
  1348. dlopened (Related: rhbz#761573)
  1349.  
  1350. * Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-30
  1351. - Resolves: rhbz#880140 - sssd hangs at startup with broken configurations
  1352.  
  1353. * Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-29
  1354. - Resolves: rhbz#878420 - SIGSEGV in IPA provider when ldap_sasl_authid is not set
  1355.  
  1356. * Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-28
  1357. - Resolves: rhbz#874616 - Silence the DEBUG messages when ID mapping code
  1358. skips a built-in group
  1359.  
  1360. * Tue Nov 27 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-27
  1361. - Resolves: rhbz#824244 - sssd does not warn into sssd.log for broken
  1362. configurations
  1363.  
  1364. * Tue Nov 27 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-26
  1365. - Resolves: rhbz#874673 - user id lookup fails using proxy provider
  1366. - Fix a possibly uninitialized variable in the LDAP provider
  1367. - Related: rhbz#877130
  1368.  
  1369. * Wed Nov 21 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-25
  1370. - Resolves: rhbz#878262 - ipa password auth failing for user principal
  1371. name when shorter than IPA Realm name
  1372. - Resolves: rhbz#871843 - Nested groups are not retrieved appropriately
  1373. from cache
  1374.  
  1375. * Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-24
  1376. - Resolves: rhbz#870238 - IPA client cannot change AD Trusted User password
  1377.  
  1378. * Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-23
  1379. - Resolves: rhbz#877972 - ldap_sasl_authid no longer accepts full principal
  1380.  
  1381. * Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-22
  1382. - Resolves: rhbz#861075 - SSSD_NSS failure to gracefully restart
  1383. after sbus failure
  1384.  
  1385. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-21
  1386. - Resolves: rhbz#877354 - ldap_connection_expire_timeout doesn't expire
  1387. ldap connections
  1388.  
  1389. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
  1390. - Related: rhbz#877126 - Bump the release tag
  1391.  
  1392. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
  1393. - Resolves: rhbz#877126 - subdomains code does not save the proper
  1394. user/group name
  1395.  
  1396. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-19
  1397. - Resolves: rhbz#877130 - LDAP provider fails to save empty groups
  1398. - Related: rhbz#869466 - check the return value of waitpid()
  1399.  
  1400. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-18
  1401. - Resolves: rhbz#870039 - sss_cache says 'Wrong DB version'
  1402.  
  1403. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-17
  1404. - Resolves: rhbz#875740 - "defaults" entry ignored
  1405.  
  1406. * Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-16
  1407. - Resolves: rhbz#875738 - offline authentication failure always returns
  1408. System Error
  1409.  
  1410. * Sun Nov 18 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-15
  1411. - Resolves: rhbz#875851 - sysdb upgrade failed converting db to 0.11
  1412.  
  1413. * Thu Nov 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-14
  1414. - Resolves: rhbz#870278 - ipa client setup should configure host properly
  1415. in a trust is in place
  1416.  
  1417. * Wed Nov 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-13
  1418. - Resolves: rhbz#871160 - sudo failing for ad trusted user in IPA environment
  1419.  
  1420. * Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-12
  1421. - Resolves: rhbz#870278 - ipa client setup should configure host properly
  1422. in a trust is in place
  1423.  
  1424. * Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-11
  1425. - Resolves: rhbz#869678 - sssd not granting access for AD trusted user in HBAC rule
  1426.  
  1427. * Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-10
  1428. - Resolves: rhbz#872180 - subdomains: Invalid sub-domain request type
  1429. - Related: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
  1430. if the sssd is not running
  1431.  
  1432. * Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-9
  1433. - Resolves: rhbz#873988 - Man page issue to list 'force_timeout' as an
  1434. option for the [sssd] section
  1435.  
  1436. * Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-8
  1437. - Resolves: rhbz#873032 - Move sss_cache to the main subpackage
  1438.  
  1439. * Tue Nov 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-7
  1440. - Resolves: rhbz#873032 - Move sss_cache to the main subpackage
  1441. - Resolves: rhbz#829740 - Init script reports complete before sssd is actually
  1442. working
  1443. - Resolves: rhbz#869466 - SSSD starts multiple processes due to syntax error in
  1444. ldap_uri
  1445. - Resolves: rhbz#870505 - sss_cache: Multiple domains not handled properly
  1446. - Resolves: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
  1447. if the sssd is not running
  1448. - Resolves: rhbz#872110 - User appears twice on looking up a nested group
  1449.  
  1450. * Sun Nov 04 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-6
  1451. - Resolves: rhbz#871576 - sssd does not resolve group names from AD
  1452. - Resolves: rhbz#872324 - pam: fd leak when writing the selinux login file
  1453. in the pam responder
  1454. - Resolves: rhbz#871424 - authconfig chokes on sssd.conf with chpass_provider
  1455. directive
  1456.  
  1457. * Fri Nov 02 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-5
  1458. - Do not send SIGKILL to service right after sending SIGTERM
  1459. - Resolves: #771975
  1460. - Fix the initial sudo smart refresh
  1461. - Resolves: #869013
  1462. - Implement password authentication for users from trusted domains
  1463. - Resolves: #869071
  1464. - LDAP child crashed with a wrong keytab
  1465. - Resolves: #869150
  1466. - The sssd_nss process grows the memory consumption over time
  1467. - Resolves: #869443
  1468.  
  1469. * Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-4
  1470. - BuildRequire selinux-policy so that selinux login support is built in
  1471. - Resolves: #867932
  1472.  
  1473. * Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-3
  1474. - Do not segfault if namingContexts contain no values or multiple values
  1475. - Resolves: rhbz#866542
  1476.  
  1477. * Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-2
  1478. - Fix the "ca" translation of the sssd-simple manual page
  1479. - Related: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  1480.  
  1481. * Sun Oct 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-1
  1482. - New upstream release 1.9.2
  1483.  
  1484. * Sun Oct 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-1
  1485. - Rebase to 1.9.1
  1486.  
  1487. * Wed Oct 03 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-3
  1488. - Require the latest libldb
  1489.  
  1490. * Tue Sep 25 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-2
  1491. - Rebase to 1.9.0
  1492. - Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  1493.  
  1494. * Mon Sep 24 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-1.rc1
  1495. - Rebase to 1.9.0 RC1
  1496. - Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  1497. - Bump the selinux-policy version number to pull in required fixes
  1498.  
  1499. * Thu Aug 09 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.8.0-33
  1500. - Resolves: rhbz#840089 - Update the shadowLastChange attribute
  1501. with days since the Epoch, not seconds
  1502.  
  1503. * Tue May 29 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-32
  1504. - Fix protocol break for services map
  1505. - Related: rhbz#825028 - Service lookups by port number doesn't work on
  1506. s390x/ppc64 arches
  1507.  
  1508. * Thu May 24 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-31
  1509. - Resolves: rhbz#825028 - Service lookups by port number doesn't work on
  1510. s390x/ppc64 arches
  1511.  
  1512. * Thu May 24 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-30
  1513. - Resolves: rhbz#824616 - sssd_nss crashes when configured with
  1514. use_fully_qualified_names = true
  1515.  
  1516. * Tue May 22 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-29
  1517. - Resolves: rhbz#824062 - sssd_be crashed with SIGSEGV in
  1518. _tevent_schedule_immediate()
  1519.  
  1520. * Wed May 16 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-28
  1521. - Resolves: rhbz#822236 - SSSD netgroups do not honor
  1522. entry_cache_nowait_percentage
  1523.  
  1524. * Fri May 11 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-27
  1525. - Resolves: rhbz#820759 - AVC denial seen on sssd upgrade during ipa-client
  1526. upgrade
  1527. - Resolves: rhbz#821044 - sss_groupadd no longer detects duplicate GID numbers
  1528.  
  1529. * Thu May 10 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-26
  1530. - Resolves: rhbz#818642 - Auth fails for user with non-default attribute names
  1531. - Resolves: rhbz#819063 - sssd fails to provide partial data till paged search
  1532. returns "Size Limit Exceeded"
  1533. - Resolves: rhbz#820585 - Group enumeration fails in proxy provider
  1534.  
  1535. * Mon Apr 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-25
  1536. - Resolves: rhbz#816616 - group members are now lowercased in case insensitive
  1537. domains
  1538.  
  1539. * Wed Apr 25 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-24
  1540. - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
  1541. top level directory is chowned by a SSSD user
  1542.  
  1543. * Fri Apr 20 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-23
  1544. - Resolves: rhbz#805924 - SSSD should attempt to get the RootDSE after binding
  1545. - Resolves: rhbz#814237 - sdap_check_aliases must not error when detects the
  1546. same user
  1547. - Resolves: rhbz#812281 - autofs client: map name length used as key length
  1548. - Related: rhbz#784870 - SSSD fails during autodetection of search bases for
  1549. new LDAP features
  1550. - Related: rhbz#814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes
  1551.  
  1552. * Mon Apr 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-22
  1553. - Fix typo in patch for SSH umask
  1554. - Related: rhbz#808107 - Coverity revealed memory management defects
  1555.  
  1556. * Mon Apr 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-21
  1557. - Resolves: rhbz#808458 - Authconfig crashes when sets krb realm
  1558. - Resolves: rhbz#808597 - sssd_nss crashes on request when no back end is
  1559. running
  1560. - Resolves: rhbz#808107 - Coverity revealed memory management defects
  1561.  
  1562. * Fri Mar 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-20
  1563. - Related: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
  1564. case_sensitive=false
  1565.  
  1566. * Fri Mar 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-18
  1567. - Resolves: rhbz#804057 - Initial service lookups having name with uppercase
  1568. alphabets doesn't work
  1569. - Resolves: rhbz#804065 - Service lookup using case-sensitive protocol names
  1570. doesn't work when case_sensitive=false
  1571. - Resolves: rhbz#805281 - sssd: Uses the wrong key when there a multiple
  1572. realms in a single keytab
  1573. - Resolves: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
  1574. case_sensitive=false
  1575. - Resolves: rhbz#805918 - Wrong resolv_status might cause crash when name
  1576. resolution times out
  1577. - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
  1578. top level directory is chowned by a SSSD user
  1579.  
  1580. * Fri Mar 16 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-17
  1581. - Related: rhbz#802207 - getent netgroup hangs when
  1582. "use_fully_qualified_names = TRUE" in sssd
  1583. - Resolves: rhbz#801719 - "Error looking up public keys" while ssh to replica
  1584. using IP address
  1585. - Resolves: rhbz#803659 - Service lookup shows case sensitive names twice with
  1586. case_sensitive=false
  1587. - Resolves: rhbz#803842 - Unable to bind to LDAP server when minssf set
  1588. - Resolves: rhbz#805034 - accessing an undefined variable might cause crash
  1589. - Resolves: rhbz#805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login
  1590.  
  1591. * Mon Mar 12 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-15
  1592. - Update translations
  1593. - Resolves: rhbz#802372 - Pick up latest translation files for SSSD
  1594. - Resolves: rhbz#802207 - getent netgroup hangs when
  1595. "use_fully_qualified_names = TRUE" in sssd
  1596. - Related: rhbz#801451 - Logging in with ssh pub key should consult
  1597. authentication authority policies
  1598.  
  1599. * Fri Mar 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-12
  1600. - Resolves: rhbz#801407 - sssd_nss gets hung processing identical search
  1601. requests
  1602. - Resolves: rhbz#801451 - Logging in with ssh pub key should consult
  1603. authentication authority policies
  1604. - Resolves: rhbz#795562 - Infinite loop checking Kerberos credentials
  1605. - Resolves: rhbz#798317 - sssd crashes when ipa_hbac_support_srchost is set to
  1606. true
  1607. - Resolves: rhbz#799039 - --debug option for sss_debuglevel doesn't work
  1608. - Resolves: rhbz#799915 - Unable to lookup netgroups with case_sensitive=false
  1609. - Resolves: rhbz#799929 - Raise limits for max num of files sssd_nss/sssd_pam
  1610. can use
  1611. - Resolves: rhbz#799971 - sssd_be crashes on shutdown
  1612. - Resolves: rhbz#801533 - sssd_be crashes when resolving non-trivial nested
  1613. group structure
  1614. - Resolves: rhbz#801368 - Group lookups doesn't return members with proxy
  1615. provider configured
  1616. - Resolves: rhbz#801377 - getent returns non-existing netgroup name, when sssd
  1617. is configured as proxy provider
  1618.  
  1619. * Thu Mar 01 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-11
  1620. - Do not auto-upgrade debug levels
  1621. - Tool still available for manual use
  1622. - Reverts: rhbz#753763 - Provide logging configuration compatibility on
  1623. SSSD 1.5/1.6 upgrade
  1624. - Resolves: rhbz#798881 - Install-time warnings
  1625. - Resolves: rhbz#798774 - IPA provider should assume that ipa_domain is also
  1626. the dns_discovery_domain
  1627. - Resolves: rhbz#798655 - Password logins failing due to a process with high
  1628. UID
  1629.  
  1630. * Wed Feb 29 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-10
  1631. - Fix explicit requires to use openldap instead of openldap-libs
  1632. - Related: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
  1633. openldap >= openldap-2.4.23-20.el6.x86_64
  1634.  
  1635. * Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-9
  1636. - Fix multilib-clean issue due to upgrade script
  1637. - Remove old copy from the spec file
  1638. - Related: rhbz#753763 - Provide logging configuration compatibility on
  1639. SSSD 1.5/1.6 upgrade
  1640.  
  1641. * Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-8
  1642. - Fix multilib-clean issue due to upgrade script
  1643. - Fix typo in the patch
  1644. - Related: rhbz#753763 - Provide logging configuration compatibility on
  1645. SSSD 1.5/1.6 upgrade
  1646.  
  1647. * Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-7
  1648. - Fix multilib-clean issue due to upgrade script
  1649. - Use a patch and install the script to python_sitelib
  1650. - Related: rhbz#753763 - Provide logging configuration compatibility on
  1651. SSSD 1.5/1.6 upgrade
  1652.  
  1653. * Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
  1654. - Fix multilib-clean issue due to upgrade script
  1655. - Related: rhbz#753763 - Provide logging configuration compatibility on
  1656. SSSD 1.5/1.6 upgrade
  1657.  
  1658. * Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-5
  1659. - Resolves: rhbz#753763 - Provide logging configuration compatibility on
  1660. SSSD 1.5/1.6 upgrade
  1661. - Resolves: rhbz#785871 - wrong build dependency on nscd
  1662. - Resolves: rhbz#785873 - IPA host search base cannot be set
  1663. - Resolves: rhbz#791208 - Entries lacking a POSIX username value break group
  1664. lookups
  1665. - Resolves: rhbz#796307 - Simple Paged Search control needs to be used more
  1666. sparingly
  1667. - Resolves: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
  1668. openldap >= openldap-2.4.23-20.el6.x86_64
  1669. - Resolves: rhbz#787035 - ipa - sssd slow response with thousands of user
  1670. entries
  1671. - Resolves: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  1672. - Resolves: rhbz#772297 - Fails to update if all nisNetgroupTriple or
  1673. memberNisNetgroup entries are deleted from a
  1674. netgroup
  1675. - Resolves: rhbz#783138 - Backend occasionally goes offline under heavy load
  1676. - Resolves: rhbz#797975 - sssd_be: The requested target is not configured is
  1677. logged at each login
  1678. - Resolves: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  1679.  
  1680. * Wed Feb 15 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
  1681. - Resolves: rhbz#761570 - [RFE] support looking up autofs maps via SSSD
  1682. - Resolves: rhbz#788979 - sssd crashes during initgroups against a user
  1683. belonging to nested rfc2307bis group
  1684.  
  1685. * Fri Feb 10 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-3.beta2
  1686. - Handle filtering python Provides in a safer way
  1687. - Related: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  1688.  
  1689. * Tue Feb 07 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-2.beta2
  1690. - Related: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  1691. - Resolves: rhbz#786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as
  1692. a dependancy
  1693. - Resolves: rhbz#785909 - --debug-timestamps=1 is not passed to providers
  1694. - Resolves: rhbz#785908 - ldap_*_search_base doesn't fully limit the group and
  1695. netgroup search base correctly
  1696. - Resolves: rhbz#785907 - [RFE] Add support to request canonicalization on krb
  1697. AS requests
  1698. - Resolves: rhbz#785905 - [RFE] DEBUG timestamps should offer higher precision
  1699. - Resolves: rhbz#785904 - [RFE] SSSD should have --version option
  1700. - Resolves: rhbz#785902 - Errors with empty loginShell and proxy provider
  1701. - Resolves: rhbz#785898 - Enable midway cache refresh by default
  1702. - Resolves: rhbz#785888 - sssd returns empty netgroup at a second request for
  1703. a non-existing netgroup
  1704. - Resolves: rhbz#785884 - Honour TTL when resolving host names
  1705. - Resolves: rhbz#785883 - check DNS records before updates
  1706. - Resolves: rhbz#785881 - List the keytab to pick the princiapl to use instead
  1707. of guessing
  1708. - Resolves: rhbz#785880 - debug_level in sssd.conf overrides command-line
  1709. - Resolves: rhbz#785879 - sss_obfuscate/python config parser modifies config
  1710. file too much
  1711. - Resolves: rhbz#785877 - on reconnect we need to detect that a ipa/ds server
  1712. has been reinitialized
  1713. - Resolves: rhbz#785741 - sssd.api.conf and sssd.api.d should not be in /etc
  1714. - Resolves: rhbz#773660 - Kerberos errors should go to syslog
  1715. - Resolves: rhbz#772163 - Iterator loop reuse cases a tight loop in the native
  1716. IPA netgroups code
  1717. - Resolves: rhbz#771706 - sssd_be crashes during auth when there exists UTF
  1718. source host group in an hbacrule
  1719. - Resolves: rhbz#771702 - sssd_pam crashes during change password operation
  1720. against a IPA server
  1721. - Resolves: rhbz#771361 - case_sensitive function not working as intended for
  1722. ldap
  1723. - Resolves: rhbz#768935 - Crash when applying settings
  1724. - Resolves: rhbz#766941 - The full dyndns update message should be logged into
  1725. debug logs
  1726. - Resolves: rhbz#766930 - [RFE] Add a new option to override home directory
  1727. value
  1728. - Resolves: rhbz#766913 - [RFE] Add option to select validate and FAST keytab
  1729. principal name
  1730. - Resolves: rhbz#766907 - Use [...] for IPv6 addresses in kdc info files
  1731. - Resolves: rhbz#766904 - [RFE] Create a command line tool to change the debug
  1732. levels on the fly
  1733. - Resolves: rhbz#766876 - [RFE] Make HBAC srchost processing optional
  1734. - Resolves: rhbz#766141 - [RFE] SSSD should support FreeIPA's internal
  1735. netgroup representation
  1736. - Resolves: rhbz#761582 - [RFE] Add ldap_sasl_minssf option
  1737. - Resolves: rhbz#759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
  1738. /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  1739. - Resolves: rhbz#755506 - [RFE] Add host-based (pam_host_attr) access control
  1740. - Resolves: rhbz#753876 - [RFE] Add support for the services map
  1741. - Resolves: rhbz#746181 - "getgrgid call returned more than one result" after
  1742. group name change in MSAD
  1743. - Resolves: rhbz#744197 - [RFE] close LDAP connection to the server when idle
  1744. for some (configurable) time
  1745. - Resolves: rhbz#742510 - [RFE] Separate Cache Timeouts for SSSD
  1746. - Related: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  1747. - Resolves: rhbz#742052 - id -G group resolution takes extremely long
  1748. - Resolves: rhbz#739312 - [RFE] sssd does not set shadowLastChange
  1749. - Resolves: rhbz#736150 - [RFE] SSSD should support multiple search bases
  1750. - Resolves: rhbz#735827 - [RFE] Ability to set a domain as case sensitive or
  1751. insensitive
  1752. - Resolves: rhbz#735405 - [RFE] Option to disable warnings for unknown users
  1753. - Resolves: rhbz#728212 - [RFE] sssd does not handle when paging control
  1754. disabled for openldap
  1755. - Resolves: rhbz#726467 - SSSD takes 30+ seconds to login
  1756. - Resolves: rhbz#721289 - Process /usr/libexec/sssd/sssd_be was killed by
  1757. signal 11 during auth when password for the user is
  1758. not set
  1759.  
  1760. * Tue Jan 17 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-68
  1761. - Resolves: rhbz#773655 - Race-condition bug in LDAP auth provider
  1762.  
  1763. * Tue Nov 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-67
  1764. - Resolves: rhbz#753842 - sssd_nss crashes when passed invalid UTF-8 for the
  1765. username in getpwnam()
  1766. - Resolves: rhbz#758157 - LDAP failover not working if server refuses
  1767. connections
  1768.  
  1769. * Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-66
  1770. - Related: rhbz#750359 - Major cached entry performance regression
  1771.  
  1772. * Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-65
  1773. - Resolves: rhbz#750359 - Major cached entry performance regression
  1774.  
  1775. * Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
  1776. - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
  1777. initgroups when groups appear in multiple nesting
  1778. levels
  1779.  
  1780. * Wed Oct 26 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-63
  1781. - Resolves: rhbz#749256 - SELinux errors with SSSD Downgrade
  1782.  
  1783. * Tue Oct 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-62
  1784. - Resolves: rhbz#748924 - RHEL6.1/sssd_pam segmentation fault
  1785.  
  1786. * Tue Oct 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-61
  1787. - Resolves: rhbz#748412 - Memory leaks during the initgroups() operation
  1788.  
  1789. * Tue Oct 18 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
  1790. - Related: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
  1791. socket
  1792.  
  1793. * Mon Oct 17 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
  1794. - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  1795. - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  1796. - Related: rhbz#743925 - HBAC processing is very slow when dealing with
  1797. FreeIPA deployments with large numbers of hosts
  1798. Fixes a crash introduced by the earlier patch.
  1799. - Related: rhbz#733382 - SSSD should pick a user/group name when there are
  1800. multi-valued names
  1801. Fixes for internationalization
  1802.  
  1803. * Fri Oct 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-58
  1804. - Related: rhbz#742278 - Rework the example config
  1805.  
  1806. * Fri Oct 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
  1807. - Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
  1808. FreeIPA deployments with large numbers of hosts
  1809. - Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
  1810. - Related: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
  1811. socket
  1812.  
  1813. * Thu Oct 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-56
  1814. - Resolves: rhbz#742278 - Rework the example config
  1815. - Resolves: rhbz#746037 - Only access sssd_nss internal hash table if it was
  1816. initialized
  1817. - Resolves: rhbz#742526 - SSSD's man pages are missing information
  1818. - Resolves: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
  1819. socket
  1820.  
  1821. * Thu Oct 06 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-55
  1822. - Resolves: rhbz#738621 - Lookup fails for non-primary usernames with
  1823. multi-valued uid
  1824. - Resolves: rhbz#738629 - Group lookups doesn't return it's member for
  1825. sometime when the member has multi-valued uid
  1826. - Resolves: rhbz#742295 - Use an explicit base 10 when converting uidNumber
  1827. to integer
  1828. - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
  1829. multi-valued names
  1830.  
  1831. * Fri Sep 30 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-53
  1832. - Resolves: rhbz#741751 - HBAC rule evaluation does not properly handle host
  1833. groups
  1834. - Resolves: rhbz#740501 - SSSD not functional after "self" reboot
  1835. - Resolves: rhbz#742539 - HBAC: Hostname comparisons should be
  1836. case-insensitive
  1837.  
  1838. * Tue Sep 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-52
  1839. - Resolves: rhbz#728343 - SSSD taking 5 minutes to log in
  1840. - Resolves: rhbz#739850 - Coverity defects newly introduced in rhel 6.2
  1841.  
  1842. * Mon Sep 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-51
  1843. - Resolves: rhbz#737157 - "System error" appears in log during change password
  1844. operation of a user in openldap server with ppolicy
  1845. enabled
  1846. - Resolves: rhbz#737172 - "Unknown (private extension) error(21853), (null)"
  1847. messages are logged during change password operation
  1848. of a user in openldap server with ppolicy enabled
  1849.  
  1850. * Wed Sep 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-50
  1851. - Resolves: rhbz#736314 - sssd crashes during auth while there exists multiple
  1852. external hosts along with managed host
  1853. - Resolves: rhbz#732974 - [RFE] Have SSSD cache properly with
  1854. krb5_validate = True and SElinux enabled
  1855.  
  1856. * Mon Aug 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-49
  1857. - Resolves: rhbz#732010 - LDAP+GSSAPI needs explicit Kerberos realm
  1858. - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
  1859. multi-valued names
  1860. - Resolves: rhbz#733409 - Improve password policy error message
  1861. - Resolves: rhbz#733663 - Authentication fails when there exists an empty
  1862. hbacsvcgroup
  1863. - Resolves: rhbz#732935 - Add LDAP provider option to set
  1864. LDAP_OPT_X_SASL_NOCANON
  1865. - Resolves: rhbz#734101 - sssd blocks login of ipa-users
  1866.  
  1867. * Wed Aug 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-48
  1868. - Related: rhbz#728353 - Resolve RPMDiff errors in SSSD
  1869.  
  1870. * Mon Aug 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-47
  1871. - Resolves: rhbz#728961 - Provide a mechanism for vetoing the use of certain
  1872. shells
  1873.  
  1874. * Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-46
  1875. - Related: rhbz#728267 - When non-posix groups are skipped, initgroups
  1876. returns random GID
  1877.  
  1878. * Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-45
  1879. - Related: rhbz#726466 - HBAC rule evaluation does not support extended
  1880. UTF-8 languages
  1881. - Related: rhbz#718250 - Remove DENY rules from the HBAC access provider
  1882. - Fixes an issue on big endian platforms
  1883.  
  1884. * Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-44
  1885. - Resolves: rhbz#700828 - Process /usr/libexec/sssd/sssd_be was killed by
  1886. signal 11 (SIGSEGV) when ldap_uri is misconfigured
  1887. - Resolves: rhbz#726438 - sssd doesn't honor ldap supportedControls
  1888. - Resolves: rhbz#726466 - HBAC rule evaluation does not support extended
  1889. UTF-8 languages
  1890. - Resolves: rhbz#718250 - Remove DENY rules from the HBAC access provider
  1891. - Resolves: rhbz#728267 - When non-posix groups are skipped, initgroups
  1892. returns random GID
  1893. - Resolves: rhbz#726475 - sssd_pam leaks file descriptors
  1894. - Resolves: rhbz#725868 - Explicitly ignore groups with gidNumber = 0
  1895.  
  1896. * Wed Jul 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-43
  1897. - Related: rhbz#721052 - sssd does not handle kerberos server IP change
  1898. - Use ares_search instead of ares_query to honor
  1899. - search entries in /etc/resolv.conf
  1900.  
  1901. * Wed Jul 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-42
  1902. - Resolves: rhbz#711416 - During the change password operation the ccache is
  1903. - not replaced by a new one if the old one isn't
  1904. - active anymore
  1905. - Resolves: rhbz#715609 - Certificate validation fails with message
  1906. - "Connection error: TLS: hostname does not match CN
  1907. - in peer certificate"
  1908. - Resolves: rhbz#719089 - IPA dynamic DNS update mangles AAAA records
  1909. - Resolves: rhbz#721052 - sssd does not handle kerberos server IP change
  1910. - Honor TTL values when resolving hostnames
  1911.  
  1912. * Fri Jun 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-41
  1913. - Resolves: rhbz#713961 - libsss_ldap segfault at login against OpenLDAP
  1914. - Resolves: rhbz#713438 - sssd shuts down if inotify crashes
  1915.  
  1916. * Thu Jun 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-40
  1917. - Resolves: rhbz#709081 - sssd.$arch should require sssd-client.$arch
  1918.  
  1919. * Thu Jun 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-39
  1920. - Resolves: rhbz#709342 - Typo in negative cache notification for initgroups()
  1921. - Resolves: rhbz#708009 - "renew_all_tgts" and "renew_handlers" messages are
  1922. - being logged multiple times when the provider comes
  1923. - back online
  1924. - Resolves: rhbz#707997 - The IPA provider does not work with IPv6
  1925. - Resolves: rhbz#677327 - [RFE] Support overriding attribute value
  1926. - Resolves: rhbz#692090 - SSSD is not populating nested groups in
  1927. - Active Directory
  1928.  
  1929.  
  1930. * Fri May 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-38
  1931. - Resolves: rhbz#707627 - Include valid "ldap_uri" formats in sssd-ldap man
  1932. - page
  1933.  
  1934. * Wed May 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
  1935. - Resolves: rhbz#707513 - Unable to authenticate users when username
  1936. - contains "\0"
  1937.  
  1938. * Tue May 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-36
  1939. - Resolves: rhbz#698723 - kpasswd fails when using sssd and
  1940. - kadmin server != kdc server
  1941.  
  1942. * Tue May 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
  1943. - Resolves: rhbz#707282 - latest sssd fails if ldap_default_authtok_type is
  1944. - not mentioned
  1945. - Resolves: rhbz#692404 - rfc2307bis groups are being enumerated even when the
  1946. - gidNumber is out of the range of min_id,max_id.
  1947. - Resolves: rhbz#699530 - Users with a local group as their primary GID are
  1948. - denied access by the simple access provider
  1949. - Resolves: rhbz#700172 - RFE: SSSD should support paged LDAP lookups
  1950. - Resolves: rhbz#705434 - IPA provider fails initgroups() if user is not a
  1951. - member of any group
  1952. - Resolves: rhbz#703624 - SSSD's async resolver only tries the first
  1953. - nameserver in /etc/resolv.conf
  1954.  
  1955. * Tue May 03 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-34
  1956. - Resolves: rhbz#701700 - sssd client libraries use select() but should use
  1957. - poll() instead
  1958.  
  1959. * Mon May 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-33
  1960. - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  1961. - Fix segfault in TGT renewal
  1962.  
  1963. * Fri Apr 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-32
  1964. - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  1965. - Fix typo causing build breakage
  1966.  
  1967. * Fri Apr 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-31
  1968. - Resolves: rhbz#693818 - Automatic TGT renewal overwrites cached password
  1969.  
  1970. * Fri Apr 15 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-30
  1971. - Resolves: rhbz#696972 - Filters not honoured against fully-qualified users
  1972.  
  1973. * Thu Apr 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-29
  1974. - Resolves: rhbz#694146 - SSSD consumes GBs of RAM, possible memory leak
  1975.  
  1976. * Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-28
  1977. - Related: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  1978. - information
  1979.  
  1980. * Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-27
  1981. - Related: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  1982. - disabled
  1983.  
  1984. * Mon Apr 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-26
  1985. - Resolves: rhbz#694444 - Unable to resolve SRV record when called with
  1986. - _srv_,<fixed ldap uri> in ldap_uri
  1987. - Related: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  1988. - disabled
  1989.  
  1990. * Fri Apr 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-25
  1991. - Resolves: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  1992. - disabled
  1993.  
  1994. * Fri Apr 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-24
  1995. - Resolves: rhbz#692472 - Process /usr/libexec/sssd/sssd_be was killed by
  1996. - signal 11 (SIGSEGV)
  1997. - Fix is to not attempt to resolve nameless servers
  1998.  
  1999. * Wed Mar 30 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-23
  2000. - Resolves: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  2001. - information
  2002.  
  2003. * Mon Mar 28 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-21
  2004. - Resolves: rhbz#690866 - Groups with a zero-length memberuid attribute can
  2005. - cause SSSD to stop caching and responding to
  2006. - requests
  2007.  
  2008. * Fri Mar 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-20
  2009. - Resolves: rhbz#690131 - Traceback messages seen while interrupting
  2010. - sss_obfuscate using ctrl+d
  2011. - Resolves: rhbz#690421 - [abrt] sssd-1.2.1-28.el6_0.4: _talloc_free: Process
  2012. - /usr/libexec/sssd/sssd_be was killed by signal 11
  2013. - (SIGSEGV)
  2014.  
  2015. * Mon Mar 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-17
  2016. - Related: rhbz#683885 - SSSD should skip over groups with multiple names
  2017.  
  2018. * Mon Mar 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-16
  2019. - Resolves: rhbz#683158 - SSSD breaks on RDNs with a comma in them
  2020. - Resolves: rhbz#689886 - group memberships are not populated correctly during
  2021. - IPA provider initgroups
  2022. - Resolves: rhbz#683885 - SSSD should skip over groups with multiple names
  2023.  
  2024. * Wed Mar 09 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-15
  2025. - Resolves: rhbz#683860 - Skip users and groups that have incomplete contents
  2026. - Resolves: rhbz#688491 - authconfig fails when access_provider is set as krb5
  2027. - in sssd.conf
  2028.  
  2029. * Wed Mar 09 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-14
  2030. - Resolves: rhbz#683255 - sudo/ldap lookup via sssd gets stuck for 5min
  2031. - waiting on netgroup
  2032. - Resolves: rhbz#683431 - sssd consumes 100% CPU
  2033. - Related: rhbz#680440 - sssd does not handle kerberos server IP change
  2034.  
  2035. * Tue Mar 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-13
  2036. - Related: rhbz#680440 - sssd does not handle kerberos server IP change
  2037. - SSSD was staying with the old server if it was still online
  2038.  
  2039. * Mon Mar 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-12
  2040. - Resolves: rhbz#682850 - IPA provider should use realm instead of ipa_domain
  2041. - for base DN
  2042.  
  2043. * Mon Mar 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-11
  2044. - Resolves: rhbz#682340 - sssd-be segmentation fault - ipa-client on
  2045. - ipa-server
  2046. - Resolves: rhbz#680440 - sssd does not handle kerberos server IP change
  2047. - Resolves: rhbz#680442 - Dynamic DNS update fails if multiple servers are
  2048. - given in ipa_server config option
  2049. - Resolves: rhbz#680932 - Do not delete sysdb memberOf if there is no memberOf
  2050. - attribute on the server
  2051. - Resolves: rhbz#682807 - sssd_nss core dumps with certain lookups
  2052.  
  2053. * Tue Feb 22 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-10
  2054. - Related: rhbz#678614 - SSSD needs to look at IPA's compat tree for netgroups
  2055. - Related: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
  2056.  
  2057. * Tue Feb 22 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-9
  2058. - Resolves: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
  2059. - Resolves: rhbz#677318 - Does not read renewable ccache at startup
  2060.  
  2061. * Mon Feb 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
  2062. - Resolves: rhbz#678593 - User information not updated on login for secondary
  2063. - domains
  2064. - Resolves: rhbz#678777 - IPA provider does not update removed group
  2065. - memberships on initgroups
  2066.  
  2067. * Sat Feb 19 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
  2068. - Resolves: rhbz#677588 - sssd crashes at the next tgt renewals it tries
  2069. - Resolves: rhbz#678410 - name service caches names, so id command shows
  2070. - recently deleted users
  2071. - Resolves: rhbz#678614 - SSSD needs to look at IPA's compat tree for
  2072. - netgroups
  2073.  
  2074. * Tue Feb 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
  2075. - Resolves: rhbz#670511 - SSSD and sftp-only jailed users with pubkey login
  2076. - Resolves: rhbz#675284 - "no matching rule" message logged on all successful
  2077. - requests
  2078. - Resolves: rhbz#676911 - SSSD attempts to use START_TLS over LDAPS for
  2079. - authentication
  2080.  
  2081. * Thu Feb 03 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
  2082. - Resolves: rhbz#674164 - sss_obfuscate fails if there's no domain named
  2083. - "default"
  2084. - Resolves: rhbz#674515 - -p option always uses empty string to obfuscate
  2085. - password
  2086. - Resolves: rhbz#674141 - Traceback call messages displayed while
  2087. - "sss_obfuscate" command is executed as a non-root
  2088. - user
  2089.  
  2090. * Tue Feb 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-4
  2091. - Resolves: rhbz#674172 - Group members are not sanitized in nested group
  2092. - processing
  2093. - Put translated tool manpages into the sssd-tools subpackage
  2094.  
  2095. * Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
  2096. - Related: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  2097. - Also add the updated ding-libs to the BuildRequires
  2098.  
  2099. * Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-2
  2100. - Related: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  2101. - Explicitly require updated ding-libs
  2102.  
  2103. * Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
  2104. - Resolves: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  2105. - New upstream release 1.5.1
  2106. - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  2107. - Vast performance improvements when enumerate = true
  2108. - All PAM actions will now perform a forced initgroups lookup instead of just
  2109. - a user information lookup
  2110. - This guarantees that all group information is available to other
  2111. - providers, such as the simple provider.
  2112. - For backwards-compatibility, DNS lookups will also fall back to trying the
  2113. - SSSD domain name as a DNS discovery domain.
  2114. - Support for more password expiration policies in LDAP
  2115. - 389 Directory Server
  2116. - FreeIPA
  2117. - ActiveDirectory
  2118. - Support for ldap_tls_{cert,key,cipher_suite} config options
  2119. - Assorted bugfixes
  2120.  
  2121. * Thu Jan 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-2
  2122. - Add noverify to sssd.conf
  2123. - Resolves: rhbz#627165 - TPS VerifyTest failure
  2124.  
  2125. * Thu Dec 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
  2126. - Related: rhbz#644072 - Rebase SSSD to 1.5
  2127. - New upstream release 1.5.0
  2128. - Fixed issues with LDAP search filters that needed to be escaped
  2129. - Add Kerberos FAST support on platforms that support it
  2130. - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  2131. - Added a Kerberos access provider to honor .k5login
  2132. - Addressed several thread-safety issues in the sss_client code
  2133. - Improved support for delayed online Kerberos auth
  2134. - Significantly reduced time between connecting to the network/VPN and
  2135. - acquiring a TGT
  2136. - Added feature for automatic Kerberos ticket renewal
  2137. - Provides the kerberos ticket for long-lived processes or cron jobs
  2138. - even when the user logs out
  2139. - Added several new features to the LDAP access provider
  2140. - Support for 'shadow' access control
  2141. - Support for authorizedService access control
  2142. - Ability to mix-and-match LDAP access control features
  2143. - Added an option for a separate password-change LDAP server for those
  2144. - platforms where LDAP referrals are not supported
  2145. - Added support for manpage translations
  2146.  
  2147. * Tue Dec 07 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.4
  2148. - Resolves: rhbz#660592 - SSSD shutdown sometimes hangs
  2149. - Resolves: rhbz#660585 - getent passwd <username>' returns nothing if its
  2150. - uidNumber gt 2147483647
  2151.  
  2152. * Thu Dec 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-36
  2153. - Resolves: rhbz#659401 - SSSD shutdown sometimes hangs
  2154.  
  2155. * Thu Dec 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-35
  2156. - Resolves: rhbz#645449 - 'getent passwd <username>' returns nothing if its
  2157. - uidNumber gt 2147483647
  2158.  
  2159. * Tue Nov 30 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.3
  2160. - Resolves: rhbz#658374 - sssd stops on upgrade
  2161.  
  2162. * Wed Nov 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-34
  2163. - Resolves: rhbz#658158 - sssd stops on upgrade
  2164.  
  2165. * Wed Nov 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.2
  2166. - Resolves: rhbz#649312 - SSSD will sometimes lose groups from the cache
  2167.  
  2168. * Wed Nov 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-33
  2169. - Resolves: rhbz#649286 - SSSD will sometimes lose groups from the cache
  2170.  
  2171. * Mon Oct 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.1
  2172. - Resolves: rhbz#637070 - the krb5 locator plugin isn't packaged for multilib
  2173. - Resolves: rhbz#642412 - SSSD initgroups does not behave as expected
  2174.  
  2175. * Mon Oct 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-32
  2176. - Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
  2177. - Resolves: rhbz#633487 - SSSD initgroups does not behave as expected
  2178.  
  2179. * Thu Sep 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-29
  2180. - Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
  2181.  
  2182. * Fri Sep 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28
  2183. - Resolves: rhbz#629949 - sssd stops on upgrade
  2184.  
  2185. * Wed Aug 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-27
  2186. - Resolves: rhbz#625122 - GNOME Lock Screen unocks without a password
  2187.  
  2188. * Wed Aug 04 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-26
  2189. - Resolves: rhbz#621307 - Password changes are broken on LDAP
  2190.  
  2191. * Fri Jul 30 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-23
  2192. - Resolves: rhbz#617623 - SSSD suffers from serious performance issues on
  2193. - initgroups calls
  2194.  
  2195. * Fri Jul 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-21
  2196. - Resolves: rhbz#607233 - SSSD users cannot log in through GDM
  2197. - - Real issue was that long-running services
  2198. - - do not reconnect if sssd is restarted
  2199.  
  2200. * Fri Jul 09 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-20
  2201. - Resolves: rhbz#591715 - sssd should emit warnings if there are problems with
  2202. - /etc/krb5.keytab file
  2203.  
  2204. * Mon Jun 28 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
  2205. - Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
  2206. - final
  2207. - Resolves: rhbz#608661 - SASL with OpenLDAP server fails
  2208. - Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes
  2209.  
  2210. * Fri Jun 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
  2211. - New upstream bugfix release 1.2.1
  2212. - Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  2213. - bugs.
  2214. - Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
  2215. - Resolves: rhbz#604704 - authconfig should provide error with no trace back
  2216. - if disabling sssd when sssd is not enabled
  2217. - Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
  2218. - auth logs continuous error messages to sssd_ldap.log
  2219. - Resolves: rhbz#596295 - Authentication fails for user from the second domain
  2220. - when the same user name is filtered out from the
  2221. - first domain
  2222. - Related: rhbz#598559 - Update translation files for SSSD before RHEL 6
  2223. - final
  2224.  
  2225. * Thu Jun 10 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-14
  2226. - Resolves: rhbz#593696 - Empty list of simple_allow_users causes sssd service
  2227. - to fail while restart
  2228. - Resolves: rhbz#600352 - Wrapping the value for "ldap_access_filter" in
  2229. - parentheses causes ldap_search_ext to fail
  2230. - Resolves: rhbz#600468 - Segfault in krb5_child
  2231. - Related: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  2232. - bugs.
  2233.  
  2234. * Wed Jun 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-13
  2235. - Resolves: rhbz#598670 - Ccache file of a user is removed too early
  2236. - Resolves: rhbz#599057 - Incomplete comparison of a service name in
  2237. - IPA access provider
  2238. - Resolves: rhbz#598496 - Failure with IPA access provider
  2239. - Resolves: rhbz#599027 - Makefile typo causes SSSD not to use the
  2240. - kernel keyring
  2241.  
  2242. * Mon May 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
  2243. - New stable upstream version 1.2.0
  2244. - Support ServiceGroups for FreeIPA v2 HBAC rules
  2245. - Fix long-standing issue with auth_provider = proxy
  2246. - Better logging for TLS issues in LDAP
  2247. - Resolves: rhbz#584001 - Rebase sssd to 1.2
  2248. - Resolves: rhbz#584017 - Unconfiguring sssd leaves KDC locator file
  2249. - Resolves: rhbz#587384 - authconfig fails if krb5_kpasswd in sssd.conf
  2250. - Resolves: rhbz#587743 - Need to replicate pam_ldap's pam_filter in sssd.conf
  2251. - Resolves: rhbz#590134 - sssd: auth_provider = proxy regression
  2252. - Resolves: rhbz#591131 - Kerberos provider needs to rewrite kdcinfo file when
  2253. - going online
  2254. - Resolves: rhbz#591136 - Change SSSD ipa BE to handle new structure of the
  2255. - HBAC rule
  2256.  
  2257. * Wed May 19 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11.1
  2258. - Improve DEBUG logs for STARTTLS failures
  2259.  
  2260. * Tue May 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
  2261. - New LDAP access provider allows for filtering user access by LDAP attribute
  2262. - Reduced default timeout for detecting offline status with LDAP
  2263. - GSSAPI ticket lifetime made configurable
  2264. - Better offline->online transition support in Kerberos
  2265.  
  2266. * Fri May 07 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
  2267. - Release new upstream version 1.1.91
  2268. - Enhancements when using SSSD with FreeIPA v2
  2269. - Support for deferred kinit
  2270. - Support for DNS SRV records for failover
  2271.  
  2272. * Fri Apr 02 2010 Simo Sorce <ssorce@redhat.com> - 1.1.1-3
  2273. - Bump up release number to avoid library sub-packages version issues with
  2274. previous releases.
  2275.  
  2276. * Thu Apr 01 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
  2277. - New upstream release 1.1.1
  2278. - Fixed the IPA provider (which was segfaulting at start)
  2279. - Fixed a bug in the SSSDConfig API causing some options to revert to
  2280. - their defaults
  2281. - This impacted the Authconfig UI
  2282. - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
  2283.  
  2284. * Tue Mar 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
  2285. - Release SSSD 1.1.0 final
  2286. - Fix two potential segfaults
  2287. - Fix memory leak in monitor
  2288. - Better error message for unusable confdb
  2289.  
  2290. * Wed Mar 17 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
  2291. - Release candidate for SSSD 1.1
  2292. - Add simple access provider
  2293. - Create subpackages for libcollection, libini_config, libdhash and librefarray
  2294. - Support IPv6
  2295. - Support LDAP referrals
  2296. - Fix cache issues
  2297. - Better feedback from PAM when offline
  2298.  
  2299. * Wed Feb 24 2010 Stephen Gallagehr <sgallagh@redhat.com> - 1.0.5-2
  2300. - Rebuild against new libtevent
  2301.  
  2302. * Fri Feb 19 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.5-1
  2303. - Fix licenses in sources and on RPMs
  2304.  
  2305. * Mon Jan 25 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.4-1
  2306. - Fix regression on 64-bit platforms
  2307.  
  2308. * Fri Jan 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
  2309. - Fixes link error on platforms that do not do implicit linking
  2310. - Fixes double-free segfault in PAM
  2311. - Fixes double-free error in async resolver
  2312. - Fixes support for TCP-based DNS lookups in async resolver
  2313. - Fixes memory alignment issues on ARM processors
  2314. - Manpage fixes
  2315.  
  2316. * Thu Jan 14 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
  2317. - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  2318. - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  2319. - Several segfault bugfixes
  2320.  
  2321. * Mon Jan 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.1-1
  2322. - Fix CVE-2010-0014
  2323.  
  2324. * Mon Dec 21 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-2
  2325. - Patch SSSDConfig API to address
  2326. - https://bugzilla.redhat.com/show_bug.cgi?id=549482
  2327.  
  2328. * Fri Dec 18 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-1
  2329. - New upstream stable release 1.0.0
  2330.  
  2331. * Fri Dec 11 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.1-1
  2332. - New upstream bugfix release 0.99.1
  2333.  
  2334. * Mon Nov 30 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.0-1
  2335. - New upstream release 0.99.0
  2336.  
  2337. * Tue Oct 27 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
  2338. - Fix segfault in sssd_pam when cache_credentials was enabled
  2339. - Update the sample configuration
  2340. - Fix upgrade issues caused by data provider service removal
  2341.  
  2342. * Mon Oct 26 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-2
  2343. - Fix upgrade issues from old (pre-0.5.0) releases of SSSD
  2344.  
  2345. * Fri Oct 23 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-1
  2346. - New upstream release 0.7.0
  2347.  
  2348. * Thu Oct 15 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-2
  2349. - Fix missing file permissions for sssd-clients
  2350.  
  2351. * Tue Oct 13 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
  2352. - Add SSSDConfig API
  2353. - Update polish translation for 0.6.0
  2354. - Fix long timeout on ldap operation
  2355. - Make dp requests more robust
  2356.  
  2357. * Tue Sep 29 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
  2358. - Ensure that the configuration upgrade script always writes the config
  2359. file with 0600 permissions
  2360. - Eliminate an infinite loop in group enumerations
  2361.  
  2362. * Mon Sep 28 2009 Sumit Bose <sbose@redhat.com> - 0.6.0-0
  2363. - New upstream release 0.6.0
  2364.  
  2365. * Mon Aug 24 2009 Simo Sorce <ssorce@redhat.com> - 0.5.0-0
  2366. - New upstream release 0.5.0
  2367.  
  2368. * Wed Jul 29 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
  2369. - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
  2370. without a password. (Patch by Stephen Gallagher)
  2371.  
  2372. * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.1-3
  2373. - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
  2374.  
  2375. * Mon Jun 22 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-2
  2376. - Fix a couple of segfaults that may happen on reload
  2377.  
  2378. * Thu Jun 11 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-1
  2379. - add missing configure check that broke stopping the daemon
  2380. - also fix default config to add a missing required option
  2381.  
  2382. * Mon Jun 8 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-0
  2383. - latest upstream release.
  2384. - also add a patch that fixes debugging output (potential segfault)
  2385.  
  2386. * Mon Apr 20 2009 Simo Sorce <ssorce@redhat.com> - 0.3.2-2
  2387. - release out of the official 0.3.2 tarball
  2388.  
  2389. * Mon Apr 20 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
  2390. - bugfix release 0.3.2
  2391. - includes previous release patches
  2392. - change permissions of the /etc/sssd/sssd.conf to 0600
  2393.  
  2394. * Tue Apr 14 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-2
  2395. - Add last minute bug fixes, found in testing the package
  2396.  
  2397. * Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-1
  2398. - Version 0.3.1
  2399. - includes previous release patches
  2400.  
  2401. * Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-2
  2402. - Try to fix build adding automake as an explicit BuildRequire
  2403. - Add also a couple of last minute patches from upstream
  2404.  
  2405. * Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-1
  2406. - Version 0.3.0
  2407. - Provides file based configuration and lots of improvements
  2408.  
  2409. * Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.1-1
  2410. - Version 0.2.1
  2411.  
  2412. * Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.0-1
  2413. - Version 0.2.0
  2414.  
  2415. * Sun Mar 08 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-5.20090309git691c9b3
  2416. - package git snapshot
  2417.  
  2418. * Fri Mar 06 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-4
  2419. - fixed items found during review
  2420. - added initscript
  2421.  
  2422. * Thu Mar 05 2009 Sumit Bose <sbose@redhat.com> - 0.1.0-3
  2423. - added sss_client
  2424.  
  2425. * Mon Feb 23 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-2
  2426. - Small cleanup and fixes in the spec file
  2427.  
  2428. * Thu Feb 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.1.0-1
  2429. - Initial release (based on version 0.1.0 upstream code)
  2430.  
  2431. [root@ldapklient rpmbuild]#
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!