[Freeipa-interest] Announcing SSSD 1.10.0 Beta 1

Jakub Hrozek jhrozek at redhat.com
Fri May 3 20:16:35 UTC 2013 

                  === SSSD 1.10 Beta 1 ===

The SSSD team is proud to announce the beta release of version 1.10 of
the System Security Services Daemon.

This beta release includes several new features, mostly targeted at better
integration with Microsoft Active Directory.

As always, the source is available from https://fedorahosted.org/sssd.
RPM packages will be made available for Fedora 19 and rawhide shortly.

The SSSD 1.10 Beta 2 release is tentatively scheduled for next week,
before the Fedora Test Day which will happen on May 9th. The Beta 2
release will contain the remaining features we finish before the Test Day.

There might be another pre-release if any of the planned features are not
ready for the test day, after this last pre-release, the SSSD will enter a
period of string-freeze and the 1.10 development will switch to bug fixing
in preparation for the 1.10 final release.

== Feedback ==

Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
    https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
    https://lists.fedorahosted.org/mailman/listinfo/sssd-users

== Highlights ==
 * The Active Directory provider now includes support for Site-based
   discovery. This feature allows the Active Directory clients to find the
   most suitable Domain Controller to connect to.
 * Support for dynamic DNS updates in the Active Directory provider. This
   feature enables the clients to automatically update or refresh their DNS
   records stored in the AD server.
 * A new library, called libsss_nss_idmap was introduced. This library
   allows the user to convert Windows Security Identifiers (SIDs) to names
   and vice versa. The library also includes Python bindings.
 * Setting the SELinux context on the IPA server now also works for users
   coming from a trusted Active Directory domain
 * Fixed a serious performance issue when enumerating large number of users
 * The subdomain_homedir configuration option gained a new template expansion
   %F that expands to the flat name (NetBIOS name) of the trusted AD domain

== Packaging Changes ==
 * The SSSD python ConfigAPI was moved to its own noarch subpackage to
   make the SSSD packaging more compliant with the Fedora packaging guidelines
 * The libsss_nss_idmap library and its Python bindings are packaged in
   separate subpackages

== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/453
    [RFE] Replace pam status codes with sssd specific codes
https://fedorahosted.org/sssd/ticket/902
    [RFE] Allow setting krb5_renew_interval with a delimiter
https://fedorahosted.org/sssd/ticket/1032
    [RFE] sssd should support DNS sites
https://fedorahosted.org/sssd/ticket/1414
    [RFE] Improve syslog message when configuration cannot be loaded
https://fedorahosted.org/sssd/ticket/1609
    [RFE] Subdomain homedir template should be configurable/use flatname by default
https://fedorahosted.org/sssd/ticket/1625
    Confusing error messages for invalid sssd.conf
https://fedorahosted.org/sssd/ticket/1741
    sss_cache doesn't support subdomains
https://fedorahosted.org/sssd/ticket/1767
    unify sss_mc_set_recycled
https://fedorahosted.org/sssd/ticket/1774
    move processing of password expiration back to PAM provider only
https://fedorahosted.org/sssd/ticket/1784
    rewrite nested group processing to follow the tevent_req coding style
https://fedorahosted.org/sssd/ticket/1786
    Use new interface from ding-libs ini interface
https://fedorahosted.org/sssd/ticket/1809
    Document that SSSD domains should only be named using ASCII characters
https://fedorahosted.org/sssd/ticket/1830
    make the authtok structure really opaque
https://fedorahosted.org/sssd/ticket/1839
    Incorrect *.py[co] files placement
https://fedorahosted.org/sssd/ticket/1842
    Allow usage of enterprise principals
https://fedorahosted.org/sssd/ticket/1844
    add a call to calculated the range for a given domain SID to libsss_idmap
https://fedorahosted.org/sssd/ticket/1848
    unused parameter in ipa_selinux handler
https://fedorahosted.org/sssd/ticket/1860
    pidfile() may leak memory on error
https://fedorahosted.org/sssd/ticket/1861
    potential out-of-bounds-write in sss_idmap_sid_to_dom_sid
https://fedorahosted.org/sssd/ticket/1862
    negative return in files.c
https://fedorahosted.org/sssd/ticket/1864
    Bad comparisons in checks found by new Coverity instance
https://fedorahosted.org/sssd/ticket/1865
    Logically dead code in tools_util.c
https://fedorahosted.org/sssd/ticket/1867
    document that AD provider is always case insensitive
https://fedorahosted.org/sssd/ticket/1877
    ding-libs.dhash: uninitialized pointer read
https://fedorahosted.org/sssd/ticket/1888
    freeipa 3.2 trusted ad user not listed in external group
https://fedorahosted.org/sssd/ticket/1889
    coverity: dead code in sudo client
https://fedorahosted.org/sssd/ticket/1890
    SSSD doesn't display warning for last grace login.
https://fedorahosted.org/sssd/ticket/1892
    In IPA AD trust setup, the sssd logs throws 'sysdb_search_user_by_name failed' error when AD user tries to login via ipa client.

== Detailed Changelog ==
Abhishek Singh (3):
      * cmocka unittest for find_uid added
      * cmocka unittest for io added
      * Fix segmentation fault in test_io.

Ariel Barria (2):
      * Allow setting krb5_renew_interval with a delimiter
      * Confusing error messages for invalid sssd.conf

Jakub Hrozek (38):
      * Updating the version for the 1.10 beta1 release
      * krb5 child: Use the correct type when processing OTP
      * pidfile(): Do not leak fd on error
      * Fix potential out-of-bounds write in sss_idmap_sid_to_dom_sid
      * Return errno, not -1 on failure in files.c
      * Check for correct variable name
      * Init failover with be_res options
      * Centralize resolv_init, remove resolv context list
      * dyndns: Fix initializing sdap_id_ctx
      * Check for the correct variables
      * Allocate PAM DP request data on responder context
      * LDAP: Always fail if a map can't be found
      * Put the override_homedir into an included xml file
      * Allow using flatname for subdomain home dir template
      * Fix simple access group control in case-insensitive domains
      * Make leak checks usable in tests that do not utilize check
      * tests: Fix the order of key/values
      * LDAP: do not invalidate pointer with realloc while processing ghost users
      * Convert the simple access check to new error codes
      * tests: Link the simple access tests with -ldl
      * Do not keep growing event context
      * Document the naming convention for SSSD domains
      * Document that the AD provider is case-insensitive
      * selinux: if no domain matches, make the debug message louder
      * Only try to relink ghost users if we're not enumerating
      * Display the last grace warning, too
      * Refactor dynamic DNS updates
      * Convert IPA-specific options to be back-end agnostic
      * dyndns: new option dyndns_refresh_interval
      * resolver: Return PTR record as string
      * dyndns: New option dyndns_update_ptr
      * dyndns: new option dyndns_force_tcp
      * dyndns: new option dyndns_auth
      * Split out the common code from timed DNS updates
      * Active Directory dynamic DNS updates
      * AD: Always initialize ID mapping
      * Only check UPN if enterprise principals are not used
      * Updating the translations for the 1.10 beta1 release

Jan Cholasta (1):
      * Add exit status section to sss_ssh_* man pages

Lukas Slebodnik (5):
      * LDAP: Fix value initialization warnings
      * Incorrect *.py[co] files placement
      * Fix krbcc dir creation issue with MIT krb5 1.11
      * Default TEST_DIR to cwd, not empty string if not set explicitly
      * SUDO: IPA provider

Michal Zidek (6):
      * Check for waitpid failure at wrong place.
      * Wrong condition after waitpid.
      * sss_cache: support for subdomains
      * sss_cache: Remove annoying messages
      * Inform about function duplication.
      * libsss_idmap: function to calculate range

Ondrej Kos (3):
      * DB: Switch to new libini_config API
      * CONFDB: prevent double free
      * IDMAP: Fix variable initialization

Pavel Březina (18):
      * resolv: add resolv_get_domain request to resolv utils
      * resolv: add resolv_discover_srv request to resolv utils
      * DNS sites support - SRV lookup plugin interface
      * DNS sites support - SRV DNS lookup plugin
      * fail over - add function to insert multiple servers to the list
      * DNS sites support - replace SRV lookup code with a plugin call
      * DNS sites support - use SRV DNS lookup plugin in all providers
      * DNS sites support - add IPA SRV plugin
      * sudo client: remove dead code
      * add fo_discover_servers request
      * IPA SRV plugin: use fo_discover_servers request
      * IPA SRV plugin: improve debugging
      * sdap: add sdap_connect_host request
      * add sss_ldap_encode_ndr_uint32
      * DNS sites support - add AD SRV plugin
      * dns srv plugin: compare domain names case insensitive
      * AD SRV plugin: check if site name is empty
      * fo_discover_servers_send: don't crash when backup_domain is NULL

Simo Sorce (1):
      * Further restrict become_user drop of privileges.

Sumit Bose (21):
      * Fix and rename get_my_domain_data()
      * Refactoring: remove duplicated code in nss responder
      * Allow usage of enterprise principals
      * Make IPA SELinux provider aware of subdomain users
      * Add override_homedir.xml to po4a.cfg
      * Remove unused TALLOC_CTX from responder_get_domain()
      * responder_get_domain: do not return disabled domains
      * responder_get_domain(): remove timeout calculation
      * LDAP: always store SID if available
      * Add secid filter to responder-dp protocol
      * Add two new request types to the data-provider interface
      * Add idmap context to nss context
      * Add responder_get_domain_by_id()
      * sysdb: add sysdb_search_object_by_sid()
      * Add sss_ncache_set_sid() and sss_ncache_check_sid()
      * Remove unused attribute list
      * Use struct to hold different types of request parameters
      * Add SID related lookups to IPA subdomains
      * Add SID related calls to the NSS responder
      * Add client library for SID related lookups
      * Add python interface to libsss_nss_idmap

Yuri Chornoivan (1):
      * Fix typos in man pages

More information about the Freeipa-interest mailing list