· 11 years ago · Jun 25, 2015, 04:05 PM
1[root@ldapklient rpmbuild]# cat SPECS/sssd.spec
2%if ! (0%{?fedora} > 12 || 0%{?rhel} > 5)
3%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
4%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
5%endif
6
7# we don't want to provide private python extension libs
8%define __provides_exclude_from %{python_sitearch}.*.so$
9
10# Determine the location of the LDB modules directory
11%global ldb_modulesdir %(pkg-config --variable=modulesdir ldb)
12%global ldb_version 1.1.13
13
14Name: sssd
15Version: 1.11.6
16Release: 30%{?dist}
17Group: Applications/System
18Summary: System Security Services Daemon
19License: GPLv3+
20URL: http://fedorahosted.org/sssd/
21Source0: https://fedorahosted.org/released/sssd/%{name}-%{version}.tar.gz
22BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
23
24### Patches ###
25Patch0001: 0001-SSH-Allow-newline-at-the-end-of-public-key-values-in.patch
26Patch0002: 0002-TESTS-sss_ssh-textual-public-key-format.patch
27Patch0003: 0003-BUILD-dbusintrospectdir-is-not-used-anymore.patch
28Patch0004: 0004-IFP-Fix-DEBUG-messages.patch
29Patch0005: 0005-IFP-Return-a-specific-value-on-failure-connecting-to.patch
30Patch0006: 0006-IFP-Provide-a-SBUS-method-to-reconnect-to-sysbus.patch
31Patch0007: 0007-MONITOR-Signal-InfoPipe-to-reconnect-on-SIGUSR2.patch
32Patch0008: 0008-TOOLS-New-helper-tool-sss_signal.patch
33Patch0009: 0009-BUILD-Add-the-DBus-service-activation.patch
34Patch0010: 0010-sbus_request-fix-potential-NULL-dereference.patch
35Patch0011: 0011-LDAP-tokengroups-do-not-work-with-id_provider-ldap.patch
36Patch0012: 0012-SDAP-Continue-resolving-SID-even-if-some-fail.patch
37Patch0013: 0013-sudo-fetch-sudoRunAs-attribute.patch
38Patch0014: 0014-sss_client-thread-safe-initialisation-of-sss_cli_mc_.patch
39Patch0015: 0015-sss_client-Fix-memory-leak-in-nss_mc_-group-passwd.patch
40Patch0016: 0016-ad-comment-ENOENT-when-id-mapping-is-disabled.patch
41Patch0017: 0017-ad-update-membership-after-SIDs-are-resolved.patch
42Patch0018: 0018-sudo-use-dbus-array-for-rules-refresh.patch
43Patch0019: 0019-LDAP-Remove-unused-option-ldap_netgroup_uuid.patch
44Patch0020: 0020-LDAP-Remove-unused-option-ldap_group_uuid.patch
45Patch0021: 0021-LDAP-Remove-unused-option-ldap_user_uuid.patch
46Patch0022: 0022-test_utils-Use-common-header-file-for-libsss_util-te.patch
47Patch0023: 0023-UTIL-Add-functions-for-replacing-whitespaces.patch
48Patch0024: 0024-NSS-Replace-spaces-with-specified-string-in-names.patch
49Patch0025: 0025-failover-set-port-status-to-not-working-if-previous-.patch
50Patch0026: 0026-ptask-Allow-adding-random_offset-to-scheduled-execut.patch
51Patch0027: 0027-ptask-Add-backoff-feature-to-the-ptask-api.patch
52Patch0028: 0028-Exit-offline-mode-only-if-server-is-available.patch
53Patch0029: 0029-sudo-replace-asterisk-with-escape-sequence-in-host-f.patch
54Patch0030: 0030-IFP-Fix-lookups-with-fully-qualified-names.patch
55Patch0031: 0031-RPM-Restart-service-in-posttrans-not-post.patch
56Patch0032: 0032-ad-initgroups-continue-if-resolved-SID-is-still-miss.patch
57Patch0033: 0033-NSS-Ignore-default_domain-for-netgroups.patch
58Patch0034: 0034-LDAP-SUDO-sudo-provider-doesn-t-fetch-EntryUSN.patch
59Patch0035: 0035-Only-replace-space-with-the-specified-substitution.patch
60Patch0036: 0036-Make-the-space-override-responder-agnostic.patch
61Patch0037: 0037-PAM-Use-the-override_space-option.patch
62Patch0038: 0038-IFP-Use-the-override_space-option.patch
63Patch0039: 0039-SUDO-Use-the-override_space-option.patch
64Patch0040: 0040-MAN-How-much-time-sssd-spends-offline.patch
65Patch0041: 0041-sudo-work-with-correct-D-Bus-iterator.patch
66Patch0042: 0042-IPA-handle-searches-by-SID-in-apply_subdomain_homedi.patch
67Patch0043: 0043-SDAP-split-sdap_access_filter_get_access_done.patch
68Patch0044: 0044-SDAP-refactor-sdap_access_filter_send.patch
69Patch0045: 0045-SDAP-nitpicks-in-sdap_access_filter_get_access_done.patch
70Patch0046: 0046-SDAP-refactor-sdap_access_filter_done.patch
71Patch0047: 0047-SDAP-don-t-log-error-on-access-denied.patch
72Patch0048: 0048-SDAP-refactor-AC-offline-checks.patch
73Patch0049: 0049-SDAP-new-option-DN-to-ppolicy-on-LDAP.patch
74Patch0050: 0050-SDAP-account-lockout-to-restrict-access-via-ssh-key.patch
75Patch0051: 0051-MAN-options-lockout-and-ldap_pwdlockout_dn.patch
76Patch0052: 0052-dyndns_test-Use-right-socket-length-of-for-IPv4-addr.patch
77Patch0053: 0053-responder-get-domains-tests-fix-checking-of-leaks.patch
78Patch0054: 0054-test_dyndns-Use-different-talloc-context-in-wrapped-.patch
79Patch0055: 0055-TESTS-leak_check-functions-shouldn-t-be-called-with-.patch
80Patch0056: 0056-dyndns-Fix-talloc-hierarchy-of-struct-sss_iface_addr.patch
81Patch0057: 0057-test_dyndns-sss_iface_addr_list_get-can-return-more-.patch
82Patch0058: 0058-SDAP-free-subrequest-in-sdap_dyndns_update_addrs_don.patch
83Patch0059: 0059-sss_client-Fix-struct-sss_cli_mc_ctx-reinitialize-on.patch
84Patch0060: 0060-LDAP-Do-not-shortcut-on-ret-EOK-during-password-expi.patch
85Patch0061: 0061-LDAP-Split-out-linking-primary-group-members-into-a-.patch
86Patch0062: 0062-LDAP-Don-t-add-a-user-member-twice-when-adding-a-pri.patch
87Patch0063: 0063-LDAP-Use-tmp_ctx-in-ldap_child-for-temporary-data.patch
88Patch0064: 0064-LDAP-Use-randomized-ccname-for-storing-credentials.patch
89Patch0065: 0065-SDAP-Immediately-finish-request-for-empty-array.patch
90Patch0066: 0066-SDAP-Use-different-talloc_context-for-array-of-names.patch
91Patch0067: 0067-SDAP-Update-groups-for-user-just-once.patch
92Patch0068: 0068-IPA-process-non-posix-nested-groups.patch
93Patch0069: 0069-AD-process-non-posix-nested-groups-w-o-tokenGroups.patch
94Patch0070: 0070-AD-process-non-posix-nested-groups-using-tokenGroups.patch
95Patch0071: 0071-Add-alternative-objectClass-to-group-attribute-maps.patch
96Patch0073: 0072-Use-the-alternative-objectclass-in-group-maps.patch
97
98### Dependencies ###
99Requires: sssd-common = %{version}-%{release}
100Requires: sssd-ldap = %{version}-%{release}
101#Requires: sssd-krb5 = %{version}-%{release}
102#Requires: sssd-ipa = %{version}-%{release}
103#Requires: sssd-common-pac = %{version}-%{release}
104#Requires: sssd-ad = %{version}-%{release}
105#Requires: sssd-proxy = %{version}-%{release}
106Requires: python-sssdconfig = %{version}-%{release}
107
108%global servicename sssd
109%global sssdstatedir %{_localstatedir}/lib/sss
110%global dbpath %{sssdstatedir}/db
111%global pipepath %{sssdstatedir}/pipes
112%global mcpath %{sssdstatedir}/mc
113%global pubconfpath %{sssdstatedir}/pubconf
114
115### Build Dependencies ###
116
117BuildRequires: autoconf
118BuildRequires: automake
119BuildRequires: libtool
120BuildRequires: m4
121BuildRequires: popt-devel
122BuildRequires: libtalloc-devel
123BuildRequires: libtevent-devel
124BuildRequires: libtdb-devel
125BuildRequires: libldb-devel = %{ldb_version}
126BuildRequires: libdhash-devel >= 0.4.2
127BuildRequires: libcollection-devel
128BuildRequires: libini_config-devel >= 1.1.0
129BuildRequires: dbus-devel
130BuildRequires: dbus-libs
131BuildRequires: openldap-devel
132BuildRequires: pam-devel
133BuildRequires: nss-devel
134BuildRequires: nspr-devel
135BuildRequires: pcre-devel
136BuildRequires: libxslt
137BuildRequires: libxml2
138BuildRequires: docbook-style-xsl
139BuildRequires: krb5-devel >= 1.10
140BuildRequires: c-ares-devel
141BuildRequires: python-devel
142BuildRequires: check-devel
143BuildRequires: doxygen
144BuildRequires: libselinux-devel
145BuildRequires: libsemanage-devel
146BuildRequires: bind-utils
147BuildRequires: keyutils-libs-devel
148BuildRequires: libnl-devel
149BuildRequires: gettext-devel
150BuildRequires: pkgconfig
151BuildRequires: glib2-devel
152BuildRequires: diffstat
153BuildRequires: findutils
154# BuildRequires: samba4-devel >= 4.0.0-59beta2
155BuildRequires: selinux-policy-targeted >= 3.7.19-166
156
157%description
158Provides a set of daemons to manage access to remote directories and
159authentication mechanisms. It provides an NSS and PAM interface toward
160the system and a pluggable backend system to connect to multiple different
161account sources. It is also the basis to provide client auditing and policy
162services for projects like FreeIPA.
163
164The sssd subpackage is a meta-package that contains the deamon as well as all
165the existing back ends.
166
167%package common
168Summary: Common files for the SSSD
169Group: Applications/System
170License: GPLv3+
171# Conflicts
172Conflicts: sssd < 1.10.0-8%{?dist}.beta2
173Conflicts: selinux-policy < 3.7.19-160
174# Requires
175Requires: libldb%{?_isa} = %{ldb_version}
176Requires: libtdb%{?_isa} >= 1.1.3
177Requires: sssd-client%{?_isa} = %{version}-%{release}
178Requires: libsss_idmap%{?_isa} = %{version}-%{release}
179Requires: libini_config >= 0.6.1
180Requires(post): initscripts chkconfig
181Requires(preun): initscripts chkconfig
182Requires(postun): initscripts chkconfig
183
184
185### Provides ###
186Provides: libsss_sudo = %{version}-%{release}
187Obsoletes: libsss_sudo <= 1.10.0-7%{?dist}.beta1
188Provides: libsss_sudo-devel = %{version}-%{release}
189Obsoletes: libsss_sudo-devel <= 1.10.0-7%{?dist}.beta1
190Provides: libsss_autofs = %{version}-%{release}
191Obsoletes: libsss_autofs <= 1.10.0-7%{?dist}.beta1
192
193%description common
194Common files for the SSSD. The common package includes all the files needed
195to run a particular back end, however, the back ends are packaged in separate
196subpackages such as sssd-ldap.
197
198%package client
199Summary: SSSD Client libraries for NSS and PAM
200Group: Applications/System
201License: LGPLv3+
202Requires(post): /sbin/ldconfig
203Requires(postun): /sbin/ldconfig
204
205%description client
206Provides the libraries needed by the PAM and NSS stacks to connect to the SSSD
207service.
208
209%package tools
210Summary: Userspace tools for use with the SSSD
211Group: Applications/System
212License: GPLv3+
213Requires: sssd-common = %{version}-%{release}
214
215%description tools
216Provides userspace tools for manipulating users, groups, and nested groups in
217SSSD when using id_provider = local in /etc/sssd/sssd.conf.
218
219Also provides several other administrative tools:
220 * sss_debuglevel to change the debug level on the fly
221 * sss_seed which pre-creates a user entry for use in kickstarts
222 * sss_obfuscate for generating an obfuscated LDAP password
223
224%package -n python-sssdconfig
225Summary: SSSD and IPA configuration file manipulation classes and functions
226Group: Applications/System
227License: GPLv3+
228BuildArch: noarch
229
230%description -n python-sssdconfig
231Provides python files for manipulation SSSD and IPA configuration files.
232
233%package ldap
234Summary: The LDAP back end of the SSSD
235Group: Applications/System
236License: GPLv3+
237Conflicts: sssd < 1.10.0-8.beta2
238Requires: sssd-common = %{version}-%{release}
239#Requires: sssd-krb5-common = %{version}-%{release}
240
241%description ldap
242Provides the LDAP back end that the SSSD can utilize to fetch identity data
243from and authenticate against an LDAP server.
244
245%package krb5-common
246Summary: SSSD helpers needed for Kerberos and GSSAPI authentication
247Group: Applications/System
248License: GPLv3+
249Conflicts: sssd < 1.10.0-8.beta2
250Requires: cyrus-sasl-gssapi%{?_isa}
251Requires: sssd-common = %{version}-%{release}
252
253%description krb5-common
254Provides helper processes that the LDAP and Kerberos back ends can use for
255Kerberos user or host authentication.
256
257%package krb5
258Summary: The Kerberos authentication back end for the SSSD
259Group: Applications/System
260License: GPLv3+
261Conflicts: sssd < 1.10.0-8.beta2
262Requires: sssd-common = %{version}-%{release}
263Requires: sssd-krb5-common = %{version}-%{release}
264
265%description krb5
266Provides the Kerberos back end that the SSSD can utilize authenticate
267against a Kerberos server.
268
269# RHEL 5 is too old to support the PAC responder
270%if !0%{?is_rhel5}
271%package common-pac
272Summary: Common files needed for supporting PAC processing
273Group: Applications/System
274License: GPLv3+
275Requires: sssd-common = %{version}-%{release}
276
277%description common-pac
278Provides common files needed by SSSD providers such as IPA and Active Directory
279for handling Kerberos PACs.
280%endif #is_rhel5
281
282%package ipa
283Summary: The IPA back end of the SSSD
284Group: Applications/System
285License: GPLv3+
286Conflicts: sssd < 1.10.0-8.beta2
287Requires: sssd-common = %{version}-%{release}
288Requires: sssd-krb5-common = %{version}-%{release}
289Requires: libipa_hbac%{?_isa} = %{version}-%{release}
290Requires: bind-utils
291# RHEL 5 is too old to support the PAC responder
292%if !0%{?is_rhel5}
293Requires: sssd-common-pac = %{version}-%{release}
294%endif
295
296%description ipa
297Provides the IPA back end that the SSSD can utilize to fetch identity data
298from and authenticate against an IPA server.
299
300%package ad
301Summary: The AD back end of the SSSD
302Group: Applications/System
303License: GPLv3+
304Conflicts: sssd < 1.10.0-8.beta2
305Requires: sssd-common = %{version}-%{release}
306Requires: sssd-krb5-common = %{version}-%{release}
307Requires: bind-utils
308# RHEL 5 is too old to support the PAC responder
309%if !0%{?is_rhel5}
310Requires: sssd-common-pac = %{version}-%{release}
311%endif
312
313%description ad
314Provides the Active Directory back end that the SSSD can utilize to fetch
315identity data from and authenticate against an Active Directory server.
316
317%package proxy
318Summary: The proxy back end of the SSSD
319Group: Applications/System
320License: GPLv3+
321Conflicts: sssd < 1.10.0-8.beta2
322Requires: sssd-common = %{version}-%{release}
323
324%description proxy
325Provides the proxy back end which can be used to wrap an existing NSS and/or
326PAM modules to leverage SSSD caching.
327
328%package -n libsss_idmap
329Summary: FreeIPA Idmap library
330Group: Development/Libraries
331License: LGPLv3+
332Requires(post): /sbin/ldconfig
333Requires(postun): /sbin/ldconfig
334
335%description -n libsss_idmap
336Utility library to convert SIDs to Unix uids and gids
337
338%package -n libsss_idmap-devel
339Summary: FreeIPA Idmap library
340Group: Development/Libraries
341License: LGPLv3+
342Requires: libsss_idmap = %{version}-%{release}
343
344%description -n libsss_idmap-devel
345Utility library to SIDs to Unix uids and gids
346
347%package -n libipa_hbac
348Summary: FreeIPA HBAC Evaluator library
349Group: Development/Libraries
350License: LGPLv3+
351Requires(post): /sbin/ldconfig
352Requires(postun): /sbin/ldconfig
353
354%description -n libipa_hbac
355Utility library to validate FreeIPA HBAC rules for authorization requests
356
357%package -n libipa_hbac-devel
358Summary: FreeIPA HBAC Evaluator library
359Group: Development/Libraries
360License: LGPLv3+
361Requires: libipa_hbac = %{version}-%{release}
362
363%description -n libipa_hbac-devel
364Utility library to validate FreeIPA HBAC rules for authorization requests
365
366%package -n libipa_hbac-python
367Summary: Python bindings for the FreeIPA HBAC Evaluator library
368Group: Development/Libraries
369License: LGPLv3+
370Requires: libipa_hbac = %{version}-%{release}
371
372%description -n libipa_hbac-python
373The libipa_hbac-python contains the bindings so that libipa_hbac can be
374used by Python applications.
375
376%package -n libsss_nss_idmap
377Summary: Library for SID based lookups
378Group: Development/Libraries
379License: LGPLv3+
380Requires(post): /sbin/ldconfig
381Requires(postun): /sbin/ldconfig
382
383%description -n libsss_nss_idmap
384Utility library for SID based lookups
385
386%package -n libsss_nss_idmap-devel
387Summary: Library for SID based lookups
388Group: Development/Libraries
389License: LGPLv3+
390Requires: libsss_nss_idmap = %{version}-%{release}
391
392%description -n libsss_nss_idmap-devel
393Utility library for SID based lookups
394
395%package -n libsss_nss_idmap-python
396Summary: Python bindings for libsss_nss_idmap
397Group: Development/Libraries
398License: LGPLv3+
399Requires: libsss_nss_idmap = %{version}-%{release}
400
401%description -n libsss_nss_idmap-python
402The libsss_nss_idmap-python contains the bindings so that libsss_nss_idmap can
403be used by Python applications.
404
405%package dbus
406Summary: The D-Bus responder of the SSSD
407Group: Applications/System
408License: GPLv3+
409Requires: sssd-common = %{version}-%{release}
410
411%description dbus
412Provides the D-Bus responder of the SSSD, called the InfoPipe, that allows
413the information from the SSSD to be transmitted over the system bus.
414
415%prep
416# Update timestamps on the files touched by a patch, to avoid non-equal
417# .pyc/.pyo files across the multilib peers within a build, where "Level"
418# is the patch prefix option (e.g. -p1)
419# Taken from specfile for python-simplejson
420UpdateTimestamps() {
421 Level=$1
422 PatchFile=$2
423
424 # Locate the affected files:
425 for f in $(diffstat $Level -l $PatchFile); do
426 # Set the files to have the same timestamp as that of the patch:
427 touch -r $PatchFile $f
428 done
429}
430
431%setup -q
432
433for p in %patches ; do
434 %__patch -p1 -i $p
435 UpdateTimestamps -p1 $p
436done
437
438%build
439autoreconf -ivf
440%configure \
441 --without-samba \
442 --disable-krb5-locator-plugin \
443 --disable-pac-responder \
444 --without-sudo \
445 --without-autofs \
446
447make %{?_smp_mflags} all docs
448
449%check
450export CK_TIMEOUT_MULTIPLIER=10
451make %{?_smp_mflags} check
452unset CK_TIMEOUT_MULTIPLIER
453
454%install
455rm -rf $RPM_BUILD_ROOT
456
457make install DESTDIR=$RPM_BUILD_ROOT
458
459# Prepare language files
460/usr/lib/rpm/find-lang.sh $RPM_BUILD_ROOT sssd
461
462# Prepare empty config file
463mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sssd
464touch $RPM_BUILD_ROOT/%{_sysconfdir}/sssd/sssd.conf
465
466# Copy default logrotate file
467mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d
468install -m644 src/examples/logrotate $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sssd
469
470# Make sure SSSD is able to run on read-only root
471mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rwtab.d
472install -m644 src/examples/rwtab $RPM_BUILD_ROOT%{_sysconfdir}/rwtab.d/sssd
473
474# Remove .la files created by libtool
475find $RPM_BUILD_ROOT -name "*.la" -exec rm -f {} \;
476
477# Suppress developer-only documentation
478rm -Rf ${RPM_BUILD_ROOT}/%{_docdir}/%{name}
479
480# Older versions of rpmbuild can only handle one -f option
481# So we need to append to the sssd*.lang file
482for file in `ls $RPM_BUILD_ROOT/%{python_sitelib}/*.egg-info 2> /dev/null`
483do
484 echo %{python_sitelib}/`basename $file` >> python_sssdconfig.lang
485done
486
487touch sssd_tools.lang
488touch sssd_client.lang
489for provider in ldap krb5 ipa ad proxy
490do
491 touch sssd_$provider.lang
492done
493
494for man in `find $RPM_BUILD_ROOT/%{_mandir}/??/man?/ -type f | sed -e "s#$RPM_BUILD_ROOT/%{_mandir}/##"`
495do
496 lang=`echo $man | cut -c 1-2`
497 case `basename $man` in
498 sss_cache*)
499 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd.lang
500 ;;
501 sss_*)
502 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_tools.lang
503 ;;
504 sssd_krb5_*)
505 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_client.lang
506 ;;
507 pam_sss*)
508 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_client.lang
509 ;;
510 sssd-ldap*)
511 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ldap.lang
512 ;;
513 sssd-krb5*)
514 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_krb5.lang
515 ;;
516 sssd-ipa*)
517 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ipa.lang
518 ;;
519 sssd-ad*)
520 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_ad.lang
521 ;;
522 sssd-proxy*)
523 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd_proxy.lang
524 ;;
525 *)
526 echo \%lang\(${lang}\) \%{_mandir}/${man}\* >> sssd.lang
527 ;;
528 esac
529done
530
531# Print these to the rpmbuild log
532echo "sssd.lang:"
533cat sssd.lang
534
535echo "sssd_client.lang:"
536cat sssd_client.lang
537
538echo "sssd_tools.lang:"
539cat sssd_tools.lang
540
541for provider in ldap krb5 ipa ad proxy
542do
543 echo "sssd_$provider.lang:"
544 cat sssd_$provider.lang
545done
546
547
548%clean
549rm -rf $RPM_BUILD_ROOT
550
551%files
552%defattr(-,root,root,-)
553%doc COPYING
554
555%files common -f sssd.lang
556%defattr(-,root,root,-)
557%doc COPYING
558%doc src/examples/sssd-example.conf
559%{_initrddir}/%{name}
560%{_sbindir}/sssd
561
562%dir %{_libexecdir}/%{servicename}
563%{_libexecdir}/%{servicename}/sssd_be
564%{_libexecdir}/%{servicename}/sssd_nss
565%{_libexecdir}/%{servicename}/sssd_pam
566%{_libexecdir}/%{servicename}/sssd_autofs
567%{_libexecdir}/%{servicename}/sssd_ssh
568%{_libexecdir}/%{servicename}/sssd_sudo
569
570%dir %{_libdir}/%{name}
571%{_libdir}/%{name}/libsss_simple.so
572
573#Internal shared libraries
574%{_libdir}/%{name}/libsss_child.so
575%{_libdir}/%{name}/libsss_crypt.so
576%{_libdir}/%{name}/libsss_debug.so
577%{_libdir}/%{name}/libsss_ldap_common.so
578%{_libdir}/%{name}/libsss_util.so
579
580# 3rd party application libraries
581%{_libdir}/sssd/modules/libsss_autofs.so
582%{_libdir}/libsss_sudo.so
583
584%{ldb_modulesdir}/memberof.so
585%{_bindir}/sss_ssh_authorizedkeys
586%{_bindir}/sss_ssh_knownhostsproxy
587%{_sbindir}/sss_cache
588%{_libexecdir}/%{servicename}/sss_signal
589
590%dir %{sssdstatedir}
591%dir %{_localstatedir}/cache/krb5rcache
592%attr(700,root,root) %dir %{dbpath}
593%attr(755,root,root) %dir %{mcpath}
594%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/passwd
595%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group
596%attr(755,root,root) %dir %{pipepath}
597%attr(755,root,root) %dir %{pubconfpath}
598%attr(700,root,root) %dir %{pipepath}/private
599%attr(750,root,root) %dir %{_var}/log/%{name}
600%attr(700,root,root) %dir %{_sysconfdir}/sssd
601%ghost %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
602%config(noreplace) %{_sysconfdir}/logrotate.d/sssd
603%config(noreplace) %{_sysconfdir}/rwtab.d/sssd
604%dir %{_datadir}/sssd
605%{_datadir}/sssd/sssd.api.conf
606%{_datadir}/sssd/sssd.api.d
607%{_mandir}/man1/sss_ssh_authorizedkeys.1*
608%{_mandir}/man1/sss_ssh_knownhostsproxy.1*
609%{_mandir}/man5/sssd.conf.5*
610%{_mandir}/man5/sssd-simple.5*
611%{_mandir}/man5/sssd-sudo.5*
612%{_mandir}/man8/sssd.8*
613%{_mandir}/man8/sss_cache.8*
614%{python_sitearch}/pysss.so
615%{python_sitearch}/pysss_murmur.so
616
617%files ldap -f sssd_ldap.lang
618%defattr(-,root,root,-)
619%doc COPYING
620%{_libdir}/%{name}/libsss_ldap.so
621%{_mandir}/man5/sssd-ldap.5*
622
623%files krb5-common
624%defattr(-,root,root,-)
625%doc COPYING
626%{_libdir}/%{name}/libsss_krb5_common.so
627%{_libexecdir}/%{servicename}/ldap_child
628%{_libexecdir}/%{servicename}/krb5_child
629
630%files krb5 -f sssd_krb5.lang
631%defattr(-,root,root,-)
632%doc COPYING
633%{_libdir}/%{name}/libsss_krb5.so
634%{_mandir}/man5/sssd-krb5.5*
635
636# RHEL 5 is too old to support the PAC responder
637%if !0%{?is_rhel5}
638%files common-pac
639%defattr(-,root,root,-)
640%doc COPYING
641%{_libexecdir}/%{servicename}/sssd_pac
642%endif
643
644%files ipa -f sssd_ipa.lang
645%defattr(-,root,root,-)
646%doc COPYING
647%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
648%{_libdir}/%{name}/libsss_ipa.so
649%{_mandir}/man5/sssd-ipa.5*
650
651%files ad -f sssd_ad.lang
652%defattr(-,root,root,-)
653%doc COPYING
654%{_libdir}/%{name}/libsss_ad.so
655%{_mandir}/man5/sssd-ad.5*
656
657%files proxy
658%defattr(-,root,root,-)
659%doc COPYING
660%{_libexecdir}/%{servicename}/proxy_child
661%{_libdir}/%{name}/libsss_proxy.so
662
663%files dbus
664%defattr(-,root,root,-)
665%doc COPYING
666%{_libexecdir}/%{servicename}/sssd_ifp
667%{_mandir}/man5/sssd-ifp.5*
668# InfoPipe DBus plumbing
669%{_sysconfdir}/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
670%{_datadir}/dbus-1/system-services/org.freedesktop.sssd.infopipe.service
671
672%files client -f sssd_client.lang
673%defattr(-,root,root,-)
674%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
675/%{_lib}/libnss_sss.so.2
676/%{_lib}/security/pam_sss.so
677%{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
678%{_libdir}/krb5/plugins/authdata/sssd_pac_plugin.so
679%{_mandir}/man8/pam_sss.8*
680%{_mandir}/man8/sssd_krb5_locator_plugin.8*
681
682%files tools -f sssd_tools.lang
683%defattr(-,root,root,-)
684%doc COPYING
685%{_sbindir}/sss_useradd
686%{_sbindir}/sss_userdel
687%{_sbindir}/sss_usermod
688%{_sbindir}/sss_groupadd
689%{_sbindir}/sss_groupdel
690%{_sbindir}/sss_groupmod
691%{_sbindir}/sss_groupshow
692%{_sbindir}/sss_obfuscate
693%{_sbindir}/sss_debuglevel
694%{_sbindir}/sss_seed
695%{_mandir}/man8/sss_groupadd.8*
696%{_mandir}/man8/sss_groupdel.8*
697%{_mandir}/man8/sss_groupmod.8*
698%{_mandir}/man8/sss_groupshow.8*
699%{_mandir}/man8/sss_useradd.8*
700%{_mandir}/man8/sss_userdel.8*
701%{_mandir}/man8/sss_usermod.8*
702%{_mandir}/man8/sss_obfuscate.8*
703%{_mandir}/man8/sss_debuglevel.8*
704%{_mandir}/man8/sss_seed.8*
705
706%files -n python-sssdconfig -f python_sssdconfig.lang
707%defattr(-,root,root,-)
708%dir %{python_sitelib}/SSSDConfig
709%{python_sitelib}/SSSDConfig/*.py*
710
711%files -n libsss_idmap
712%defattr(-,root,root,-)
713%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
714%{_libdir}/libsss_idmap.so.*
715
716%files -n libsss_idmap-devel
717%defattr(-,root,root,-)
718%doc idmap_doc/html
719%{_includedir}/sss_idmap.h
720%{_libdir}/libsss_idmap.so
721%{_libdir}/pkgconfig/sss_idmap.pc
722
723%files -n libipa_hbac
724%defattr(-,root,root,-)
725%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
726%{_libdir}/libipa_hbac.so.*
727
728%files -n libipa_hbac-devel
729%defattr(-,root,root,-)
730%doc hbac_doc/html
731%{_includedir}/ipa_hbac.h
732%{_libdir}/libipa_hbac.so
733%{_libdir}/pkgconfig/ipa_hbac.pc
734
735%files -n libipa_hbac-python
736%defattr(-,root,root,-)
737%{python_sitearch}/pyhbac.so
738
739%files -n libsss_nss_idmap
740%defattr(-,root,root,-)
741%doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
742%{_libdir}/libsss_nss_idmap.so.*
743
744%files -n libsss_nss_idmap-devel
745%defattr(-,root,root,-)
746%doc nss_idmap_doc/html
747%{_includedir}/sss_nss_idmap.h
748%{_libdir}/libsss_nss_idmap.so
749%{_libdir}/pkgconfig/sss_nss_idmap.pc
750
751%files -n libsss_nss_idmap-python
752%defattr(-,root,root,-)
753%{python_sitearch}/pysss_nss_idmap.so
754
755%post common
756/sbin/chkconfig --add %{servicename}
757
758# sssd-1.8.0-24 changed the startup order
759# We need to make sure this is always updated on
760# clients
761/sbin/chkconfig %{servicename} resetpriorities
762
763if [ $1 -ge 1 ] ; then
764 restorecon -R %{mcachepath} 2>/dev/null || :
765fi
766
767%posttrans
768/sbin/service %{servicename} condrestart 2>&1 > /dev/null
769
770%preun common
771if [ $1 = 0 ]; then
772 /sbin/service %{servicename} stop 2>&1 > /dev/null
773 /sbin/chkconfig --del %{servicename}
774fi
775
776%post client -p /sbin/ldconfig
777
778%postun client -p /sbin/ldconfig
779
780%post -n libipa_hbac -p /sbin/ldconfig
781
782%postun -n libipa_hbac -p /sbin/ldconfig
783
784%post -n libsss_idmap -p /sbin/ldconfig
785
786%postun -n libsss_idmap -p /sbin/ldconfig
787
788%changelog
789* Mon Sep 15 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30
790- Resolves: rhbz#1139044 - RHEL6.6 ipa user private group not found
791
792* Thu Sep 04 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-29
793- Resolves: rhbz#1103487 - CVE-2014-0249 - sssd: incorrect expansion of group
794 membership when encountering a non-POSIX group
795
796* Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-28
797- Resolves: rhbz#1125187 - simple_allow_groups does not lookup groups from
798 other AD domains
799
800* Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-27
801- Resolves: rhbz#1127270 - sssd connect to ipa-server is long
802
803* Tue Aug 26 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-26
804- Resolves: rhbz#1130017 - Saving group membership fails if provider is AD,
805 POSIX attributes are used and primary group contains
806 the user as a member
807
808* Mon Aug 25 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-25
809- Resolves: rhbz#1111528 - Expired shadow policy user(shadowLastChange=0)
810 is not prompted for password change
811
812* Fri Aug 22 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-24
813- Resolves: rhbz#1132361 - use-after-free in dyndns code
814
815* Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-23
816- Resolves: rhbz#1099290: RFE: Be able to configure sssd to honor openldap
817 account lock to restrict access via ssh key
818
819* Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-22
820- Use the correct sudo iterator
821- Related: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk
822
823* Tue Aug 19 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-21
824- Add notes about offline mode to sssd.conf
825- Related: rhbz#1110226 - Requests queued during transition from offline
826 to online mode
827
828* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-20
829- Resolves: rhbz#1127278 - Auth fails when space in username is
830 replaced with character set by
831 override_default_whitespace
832
833* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-19
834- Resolves: rhbz#1127757 - sssd can't retrieve sudo rules when using the
835 "default_domain_suffix" option
836
837* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-18
838- Resolves: rhbz#1127265 - Problems with tokengroups and ldap_group_search_base
839
840* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-17
841- Resolves: rhbz#1126636 - RHEL6.6 sssd not running after upgrade
842
843* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-16
844- Resolves: rhbz#1128612 - IFP: FQDN lookups are broken
845
846* Thu Aug 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-15
847- Resolves: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk
848
849* Thu Jul 31 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-14
850- Resolves: rhbz#1110226 - Requests queued during transition from offline
851 to online mode
852
853* Thu Jul 31 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-13
854- Resolves: rhbz#1122873 - Failover does not always happen from SRV
855 to hostname resolution(via /etc/hosts)
856- Remove spurious systemctl call on %postun
857
858* Mon Jul 28 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-12
859- Resolves: rhbz#1111317 - [RFE] Add option for sssd to replace space with
860 specified character in LDAP group
861
862* Fri Jul 25 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-11
863- Resolves: rhbz#1109188 - dereferencing control failure against openldap
864 server
865
866* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-10
867- Resolves: rhbz#1084532 - sssd_sudo process segfaults
868
869* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-9
870- Resolves: rhbz#1122158 - ad: group membership is empty when id mapping
871 is off and tokengroups are enabled
872
873* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-8
874- Resolves: rhbz#1118541 - Floating point exception using ldap
875
876* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-7
877- Resolves: rhbz#1042922 - [RFE] Add fallback to sudoRunAs when sudoRunAsUser
878 is not defined and no ldap_sudorule_runasuser mapping
879 has been defined in SSSD
880
881* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-6
882- Resolves: rhbz#1120508 - tokengroups do not work with id_provider=ldap
883
884* Thu Jul 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-5
885- Fix potential NULL dereference in IFP code
886- Related: rhbz#1110369 - sssd is started before messagebus, making
887 sssd-ifp fail
888
889* Wed Jul 16 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-4
890- BuildRequire the latest libini_config
891- Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
892
893* Mon Jul 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-3
894- Resolves: rhbz#1110369 - sssd is started before messagebus, making
895 sssd-ifp fail
896
897* Tue Jun 03 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-2
898- Resolves: rhbz#1104145 - public key validator is too strict and does not
899 allow newlines anywhere in the public key string,
900 not even at the end
901
902* Tue Jun 03 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-1
903- Rebase to 1.11.6
904- Resolves: #1051164 - Rebase SSSD to 1.11+ in RHEL6
905
906* Thu May 29 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-4
907- Rebuild against new ding-libs
908- Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
909
910* Wed May 14 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-3
911- Backport the InfoPipe patches needed for Sat6 integration
912- Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6
913
914* Mon May 12 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-2
915- Resolves: #1085412 - SSSD Crashes when storage experiences high latency
916
917* Wed Apr 16 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-1
918- Resolves: #1051164 - Rebase SSSD to 1.11+ in RHEL6
919
920* Mon Feb 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-134
921Resolves: #1036168 - sssd can't retrieve auto.master when using the
922 "default_domain_suffix"
923
924* Mon Feb 24 2014 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-133
925- Resolves: #1065534 - SSSD pam module accepts usernames with leading spaces
926
927* Thu Dec 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-132
928- Resolves: #1038098 - sssd_nss grows memory footprint when netgroups
929 are requested
930
931* Tue Nov 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-131
932- Allow combination of proxy id backend and LDAP auth backend
933- Resolves: #1025813 - SSSD: Allow for custom attributes in RDN when using
934 id_provider = proxy
935
936* Tue Nov 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-130
937- Inherit UID limits for subdomains
938- Resolves: #1020905 - Creating system accounts on a IdM client takes up
939 to 10 minutes when AD trust is configured in the IdM.
940
941* Tue Oct 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129
942- Do not crash when LDAP disconnects while a search is still in progress
943- Resolves: #1019979 - sssd_be segfault when authenticating against active
944 directory
945
946* Thu Sep 26 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-128
947- More upstream fixes to prevent memcache crashes
948- Related: #997406 - sssd_nss core dumps under load
949
950* Thu Sep 12 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-127
951- Resolves: #1002929 - sssd_be segfaults if IPA dynamic DNS update times out
952
953* Tue Sep 3 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-126
954- Make IPA SELinux provider aware of subdomain users
955- A better version of already committed patch
956- Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
957 'sysdb_search_user_by_name failed' error when
958 AD user tries to login via ipa client.
959
960* Fri Aug 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-125
961- Resolves: #997406 - sssd_nss core dumps under load
962- Resolves: #984814 - sssd_nss terminated with segmentation fault
963
964* Fri Aug 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-124
965- Resolves: #1002161 - large number of sudo rules results in error -
966 Unable to create response: Invalid argument
967
968* Mon Aug 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-123
969- Silence restorecon on clean install
970- Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
971 /var/lib/sss/mc context
972
973* Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-122
974- Make IPA SELinux provider aware of subdomain users
975- Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
976 'sysdb_search_user_by_name failed' error when
977 AD user tries to login via ipa client.
978
979* Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-121
980- Print password complexity hint when password change fails with
981 constraint violation
982- Related: #983028 - passwd returns "Authentication token manipulation
983 error" when entering wrong current password
984
985* Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-120
986- Resolves: #983028 - passwd returns "Authentication token manipulation
987 error" when entering wrong current password
988
989* Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-119
990- Resolves: #948830 - sssd do too many disk writes causing delay in
991 "getent netgroup allmachines-netgroup" nested netgroups.
992
993* Sun Aug 11 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-118
994- Resolves: #984814 - sssd_nss terminated with segmentation fault
995
996* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-117
997- Resolves: #966757 - SSSD failover doesn't work if the first DNS server
998 in resolv.conf is unavailable
999
1000* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-116
1001- Resolves: #963235 - sssd_be crashing with nested ldap groups
1002
1003* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-115
1004- Apply a forgotten dependency for patch #254
1005- Related: #916997 - getgrnam / getgrgid for large user groups
1006 is too slow due to range retrieval functionality
1007- Add two fixes for better handling of faulty SRV processing
1008- Related: #954275 - sssd fails connect to IPA server during boot when
1009 spanning tree is enabled in network router.
1010- Remove enumerate=true from example in man page
1011- Related: #988381 - clarify the disadvantages of enumeration in sssd.conf
1012
1013* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-114
1014- Resolves: #914433 - sssd pam write_selinux_login_file creating the temp
1015 file for SELinux data failed
1016
1017* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-113
1018- Resolves: #916997 - getgrnam / getgrgid for large user groups
1019 is too slow due to range retrieval functionality
1020
1021* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-112
1022- Resolves: #918394 - sssd etas 99% CPU and runs out of file descriptors
1023 when clearing cache
1024
1025* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-111
1026- Resolves: #924113 - man sssd-sudo has wrong title
1027
1028* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-110
1029- Resolves: #924397 - document what does access_provider=ad do
1030
1031* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-109
1032- Use permissive control when adding ghost users
1033- Resolves: #928797 - cyclic group memberships may not work depending on
1034 order of operations
1035
1036* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-108
1037- Set correct state of SRV servers on resolving error
1038- Resolves: #954275 - sssd fails connect to IPA server during boot when
1039 spanning tree is enabled in network router.
1040
1041* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-107
1042- Resolves: #954323 - SSSD doesn't display warning for last grace login.
1043
1044* Fri Aug 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-106
1045- Format patch to configure sysv script differently
1046- RHEL-6 patch(1) apparently doesn't like the output of git format-patch
1047 -M -C and doesn't properly copy files on renames
1048- Resolves: #971435 - Enhance sssd init script so that it would source a
1049 configuration.
1050
1051* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-105
1052- Resolves: #973345 - SSSD service randomly dies
1053
1054* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-104
1055- Resolves: #971435 - Enhance sssd init script so that it would source
1056 a configuration
1057
1058* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-103
1059- Resolves: #961356 - SUDO is not working for users from trusted AD domain
1060
1061* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-102
1062- Resolves: #970519 - [RFE] Add support for suppressing group members
1063
1064* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-101
1065- Resolves: #976273 - [RFE] Add a new override_homedir expansion for the
1066 "original value"
1067
1068* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-100
1069- Resolves: #978966 - sudoHost mismatch response is incorrect sometimes
1070
1071* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-99
1072- Clarify the min_id/max_id limits further
1073- Resolves: #978994 - SSSD filter out ldap user/group if uid/gid is zero
1074
1075* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-98
1076- Resolves: #979046 - sssd_be goes to 99% CPU and causes significant login
1077 delays when client is under load
1078
1079* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-97
1080- Resolves: #986379 - sss_cache -N/-n should invalidate the hash table
1081 in sssd_nss
1082
1083* Thu Aug 08 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-96
1084- Resolves: #988525 - sssd fails instead of skipping when a sudo ldap
1085 filter returns entries with multiple CNs
1086
1087* Thu Jul 25 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-95
1088- Mention that enumeration should be discouraged
1089- Resolves: #988381 - clarify the disadvantages of enumeration in sssd.conf
1090
1091* Thu Jul 25 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-94
1092- Call restorecon on memcache files to force the right context on upgrades
1093- Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
1094 /var/lib/sss/mc context
1095
1096* Wed Jul 24 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-93
1097- Resolves: #987479 - libsss_sudo should depend on sudo package with
1098 sssd support
1099
1100* Fri Jul 19 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-92
1101- Resolves: #951086 - sssd_pam segfaults if sssd_be is stuck
1102
1103* Thu May 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-91
1104- Resolves: #967636 - SSSD frequently fails to return automount maps
1105 from LDAP
1106
1107* Wed May 1 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-90
1108- Resolves: #953165 - Enabling enumeration causes sssd_be process to
1109 utilize 100% of the CPU
1110
1111* Tue Apr 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-89
1112- Resolves: #906398 - sssd_be crashes sometimes
1113
1114* Mon Apr 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-88
1115- Resolves: #950874: Simple access control always denies uppercased users
1116 in case insensitive domain
1117
1118* Tue Mar 20 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-87
1119- Resolves: #921454: Resolve local group members in LDAP groups
1120
1121* Tue Mar 05 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-86
1122- Resolves: rhbz#911299 - sssd: simple access provider flaw prevents intended
1123 ACL use when client to an AD provider
1124
1125* Fri Mar 01 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-85
1126- Fix pwd_expiration_warning=0
1127- Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
1128 Kerberos
1129
1130* Fri Feb 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-84
1131- Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
1132 Kerberos
1133
1134* Wed Jan 30 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-83
1135- Resolves: rhbz#872827 - Serious performance regression in sssd
1136
1137* Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82
1138- Resolves: rhbz#888614 - Failure in memberof can lead to failed
1139 database update
1140
1141* Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-81
1142- Resolves: rhbz#903078 - TOCTOU race conditions by copying
1143 and removing directory trees
1144
1145* Wed Jan 23 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-80
1146- Resolves: rhbz#903078 - Out-of-bounds read flaws in
1147 autofs and ssh services responders
1148
1149* Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-79
1150- Resolves: rhbz#902716 - Rule mismatch isn't noticed before smart refresh
1151 on ppc64 and s390x
1152
1153* Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-78
1154- Resolves: rhbz#896476 - SSSD should warn when pam_pwd_expiration_warning
1155 value is higher than passwordWarning LDAP attribute.
1156
1157* Tue Jan 22 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-77
1158- Resolves: rhbz#902436 - possible segfault when backend callback is removed
1159
1160* Mon Jan 21 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-76
1161- Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
1162 reflected in memory cache
1163
1164* Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-75
1165- Resolves: rhbz#894302 - sssd fails to update to changes on autofs maps
1166
1167* Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-74
1168- Resolves: rhbz894381 - memory cache is not updated after user is deleted
1169 from ldb cache
1170
1171* Wed Jan 16 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-73
1172- Resolves: rhbz895615 - ipa-client-automount: autofs failed in s390x and
1173 ppc64 platform
1174
1175* Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-72
1176- Resolves: rhbz#894997 - sssd_be crashes looking up members with groups
1177 outside the nesting limit
1178
1179* Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-71
1180- Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
1181 reflected in memory cache
1182
1183* Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-70
1184- Resolves: rhbz#894428 - wrong filter for autofs maps in sss_cache
1185
1186* Tue Jan 15 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-69
1187- Resolves: rhbz#894738 - Failover to ldap_chpass_backup_uri doesn't work
1188
1189* Wed Jan 09 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-68
1190- Resolves: rhbz#887961 - AD provider: getgrgid removes nested group
1191 memberships
1192
1193* Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-67
1194- Resolves: rhbz#878583 - IPA Trust does not show secondary groups for AD
1195 Users for commands like id and getent
1196
1197* Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-66
1198- Resolves: rhbz#874579 - sssd caching not working as expected for selinux
1199 usermap contexts
1200
1201* Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-65
1202- Resolves: rhbz#892197 - Incorrect principal searched for in keytab
1203
1204* Mon Jan 07 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-64
1205- Resolves: rhbz#891356 - Smart refresh doesn't notice "defaults" addition
1206 with OpenLDAP
1207
1208* Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-63
1209- Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
1210 cache
1211
1212* Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-62
1213- Resolves: rhbz#886848 - user id lookup fails for case sensitive users
1214 using proxy provider
1215
1216* Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-61
1217- Resolves: rhbz#890520 - Failover to krb5_backup_kpasswd doesn't work
1218
1219* Fri Jan 04 2013 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-60
1220- Resolves: rhbz#874618 - sss_cache: fqdn not accepted
1221
1222* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-59
1223- Resolves: rhbz#889182 - crash in memory cache
1224
1225* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-58
1226- Resolves: rhbz#889168 - krb5 ticket renewal does not read the renewable
1227 tickets from cache
1228
1229* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-57
1230- Resolves: rhbz#886091 - Disallow root SSH public key authentication
1231- Add default section to switch statement (Related: rhbz#884666)
1232
1233* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-56
1234- Resolves: rhbz#886038 - sssd components seem to mishandle sighup
1235
1236* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-55
1237- Resolves: rhbz#888800 - Memory leak in new memcache initgr cleanup function
1238
1239* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-54
1240- Resolves: rhbz#888614 - Failure in memberof can lead to failed database
1241 update
1242
1243* Thu Dec 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-53
1244- Resolves: rhbz#885078 - sssd_nss crashes during enumeration if the
1245 enumeration is taking too long
1246
1247* Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-52
1248- Related: rhbz#875851 - sysdb upgrade failed converting db to 0.11
1249- Include more debugging during the sysdb upgrade
1250
1251* Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-51
1252- Resolves: rhbz#877972 - ldap_sasl_authid no longer accepts full principal
1253
1254* Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-50
1255- Resolves: rhbz#870045 - always reread the master map from LDAP
1256- Resolves: rhbz#876531 - sss_cache does not work for automount maps
1257
1258* Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-49
1259- Resolves: rhbz#884666 - sudo: if first full refresh fails, schedule
1260 another first full refresh
1261
1262* Tue Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-48
1263- Resolves: rhbz#880956 - Primary server status is not always reset after
1264 failover to backup server happened
1265- Silence a compilation warning in the memberof plugin (Related: rhbz#877974)
1266- Do not steal resolv result on error (Related: rhbz#882076)
1267
1268* Mon Dec 17 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-47
1269- Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
1270 provider
1271
1272* Sat Dec 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-46
1273- Resolves: rhbz#884600 - ldap_chpass_uri failover fails on using same
1274 hostname
1275
1276* Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-45
1277- Resolves: rhbz#858345 - pam_sss(crond:account): Request to sssd
1278 failed. Timer expired
1279
1280* Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-44
1281- Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
1282 cache
1283
1284* Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-43
1285- Resolves: rhbz#880176 - memberUid required for primary groups to match
1286 sudo rule
1287
1288* Fri Dec 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-42
1289- Resolves: rhbz#885105 - sudo denies access with disabled
1290 ldap_sudo_use_host_filter
1291
1292* Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-41
1293- Resolves: rhbz#883408 - Option ldap_sudo_include_regexp named incorrectly
1294
1295* Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-40
1296- Resolves: rhbz#880546 - krb5_kpasswd failover doesn't work
1297- Fix the error handler in sss_mc_create_file (Related: #789507)
1298
1299* Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-39
1300- Resolves: rhbz#882221 - Offline sudo denies access with expired
1301 entry_cache_timeout
1302- Fix several bugs found by Coverity and clang:
1303- Check the return value of diff_gid_lists (Related: #869071)
1304- Move misplaced sysdb assignment (Related: #827606)
1305- Remove dead assignment (Related: #827606)
1306- Fix copy-n-paste error in the memberof plugin (Related: #877974)
1307
1308* Tue Dec 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-38
1309- Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
1310 provider
1311- Link sss_ssh_authorizedkeys and sss_ssh_knowhostsproxy with the client
1312 libraries (Related: #870060)
1313- Move sss_ssh_knownhosts documentation to the correct section
1314 (Related: #870060)
1315
1316* Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-37
1317- Resolves: rhbz#884480 - user is not removed from group membership during
1318 initgroups
1319- Fix incorrect synchronization in mmap cache (Related: #789507)
1320
1321* Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-36
1322- Resolves: rhbz#883336 - sssd crashes during start if id_provider is
1323 not mentioned
1324
1325* Fri Dec 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-35
1326- Resolves: rhbz#882290 - arithmetic bug in the SSSD causes netgroup
1327 midpoint refresh to be always set to 10 seconds
1328
1329* Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-34
1330- Resolves: rhbz#877974 - updating top-level group does not reflect ghost
1331 members correctly
1332- Resolves: rhbz#880159 - delete operation is not implemented for ghost users
1333
1334* Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-33
1335- Resolves: rhbz#881773 - mmap cache needs update after db changes
1336
1337* Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-32
1338- Resolves: rhbz#875677 - password expiry warning message doesn't appear
1339 during auth
1340- Fix potential NULL dereference when skipping built-in AD groups
1341 (Related: rhbz#874616)
1342- Add missing parameter to DEBUG message (Related: rhbz#829742)
1343
1344* Thu Dec 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-31
1345- Resolves: rhbz#882076 - SSSD crashes when c-ares returns success but an
1346 empty hostent during the DNS update
1347- Do not version libsss_sudo, it's not supposed to be linked against, but
1348 dlopened (Related: rhbz#761573)
1349
1350* Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-30
1351- Resolves: rhbz#880140 - sssd hangs at startup with broken configurations
1352
1353* Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-29
1354- Resolves: rhbz#878420 - SIGSEGV in IPA provider when ldap_sasl_authid is not set
1355
1356* Wed Nov 28 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-28
1357- Resolves: rhbz#874616 - Silence the DEBUG messages when ID mapping code
1358 skips a built-in group
1359
1360* Tue Nov 27 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-27
1361- Resolves: rhbz#824244 - sssd does not warn into sssd.log for broken
1362 configurations
1363
1364* Tue Nov 27 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-26
1365- Resolves: rhbz#874673 - user id lookup fails using proxy provider
1366- Fix a possibly uninitialized variable in the LDAP provider
1367- Related: rhbz#877130
1368
1369* Wed Nov 21 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-25
1370- Resolves: rhbz#878262 - ipa password auth failing for user principal
1371 name when shorter than IPA Realm name
1372- Resolves: rhbz#871843 - Nested groups are not retrieved appropriately
1373 from cache
1374
1375* Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-24
1376- Resolves: rhbz#870238 - IPA client cannot change AD Trusted User password
1377
1378* Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-23
1379- Resolves: rhbz#877972 - ldap_sasl_authid no longer accepts full principal
1380
1381* Tue Nov 20 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-22
1382- Resolves: rhbz#861075 - SSSD_NSS failure to gracefully restart
1383 after sbus failure
1384
1385* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-21
1386- Resolves: rhbz#877354 - ldap_connection_expire_timeout doesn't expire
1387 ldap connections
1388
1389* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
1390- Related: rhbz#877126 - Bump the release tag
1391
1392* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
1393- Resolves: rhbz#877126 - subdomains code does not save the proper
1394 user/group name
1395
1396* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-19
1397- Resolves: rhbz#877130 - LDAP provider fails to save empty groups
1398- Related: rhbz#869466 - check the return value of waitpid()
1399
1400* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-18
1401- Resolves: rhbz#870039 - sss_cache says 'Wrong DB version'
1402
1403* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-17
1404- Resolves: rhbz#875740 - "defaults" entry ignored
1405
1406* Mon Nov 19 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-16
1407- Resolves: rhbz#875738 - offline authentication failure always returns
1408 System Error
1409
1410* Sun Nov 18 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-15
1411- Resolves: rhbz#875851 - sysdb upgrade failed converting db to 0.11
1412
1413* Thu Nov 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-14
1414- Resolves: rhbz#870278 - ipa client setup should configure host properly
1415 in a trust is in place
1416
1417* Wed Nov 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-13
1418- Resolves: rhbz#871160 - sudo failing for ad trusted user in IPA environment
1419
1420* Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-12
1421- Resolves: rhbz#870278 - ipa client setup should configure host properly
1422 in a trust is in place
1423
1424* Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-11
1425- Resolves: rhbz#869678 - sssd not granting access for AD trusted user in HBAC rule
1426
1427* Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-10
1428- Resolves: rhbz#872180 - subdomains: Invalid sub-domain request type
1429- Related: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
1430 if the sssd is not running
1431
1432* Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-9
1433- Resolves: rhbz#873988 - Man page issue to list 'force_timeout' as an
1434 option for the [sssd] section
1435
1436* Sun Nov 11 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-8
1437- Resolves: rhbz#873032 - Move sss_cache to the main subpackage
1438
1439* Tue Nov 06 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-7
1440- Resolves: rhbz#873032 - Move sss_cache to the main subpackage
1441- Resolves: rhbz#829740 - Init script reports complete before sssd is actually
1442 working
1443- Resolves: rhbz#869466 - SSSD starts multiple processes due to syntax error in
1444 ldap_uri
1445- Resolves: rhbz#870505 - sss_cache: Multiple domains not handled properly
1446- Resolves: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
1447 if the sssd is not running
1448- Resolves: rhbz#872110 - User appears twice on looking up a nested group
1449
1450* Sun Nov 04 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-6
1451- Resolves: rhbz#871576 - sssd does not resolve group names from AD
1452- Resolves: rhbz#872324 - pam: fd leak when writing the selinux login file
1453 in the pam responder
1454- Resolves: rhbz#871424 - authconfig chokes on sssd.conf with chpass_provider
1455 directive
1456
1457* Fri Nov 02 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-5
1458- Do not send SIGKILL to service right after sending SIGTERM
1459- Resolves: #771975
1460- Fix the initial sudo smart refresh
1461- Resolves: #869013
1462- Implement password authentication for users from trusted domains
1463- Resolves: #869071
1464- LDAP child crashed with a wrong keytab
1465- Resolves: #869150
1466- The sssd_nss process grows the memory consumption over time
1467- Resolves: #869443
1468
1469* Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-4
1470- BuildRequire selinux-policy so that selinux login support is built in
1471- Resolves: #867932
1472
1473* Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-3
1474- Do not segfault if namingContexts contain no values or multiple values
1475- Resolves: rhbz#866542
1476
1477* Mon Oct 15 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-2
1478- Fix the "ca" translation of the sssd-simple manual page
1479- Related: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
1480
1481* Sun Oct 14 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-1
1482- New upstream release 1.9.2
1483
1484* Sun Oct 07 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-1
1485- Rebase to 1.9.1
1486
1487* Wed Oct 03 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-3
1488- Require the latest libldb
1489
1490* Tue Sep 25 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-2
1491- Rebase to 1.9.0
1492- Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
1493
1494* Mon Sep 24 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-1.rc1
1495- Rebase to 1.9.0 RC1
1496- Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
1497- Bump the selinux-policy version number to pull in required fixes
1498
1499* Thu Aug 09 2012 Jakub Hrozek <jhrozek@redhat.com> - 1.8.0-33
1500- Resolves: rhbz#840089 - Update the shadowLastChange attribute
1501 with days since the Epoch, not seconds
1502
1503* Tue May 29 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-32
1504- Fix protocol break for services map
1505- Related: rhbz#825028 - Service lookups by port number doesn't work on
1506 s390x/ppc64 arches
1507
1508* Thu May 24 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-31
1509- Resolves: rhbz#825028 - Service lookups by port number doesn't work on
1510 s390x/ppc64 arches
1511
1512* Thu May 24 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-30
1513- Resolves: rhbz#824616 - sssd_nss crashes when configured with
1514 use_fully_qualified_names = true
1515
1516* Tue May 22 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-29
1517- Resolves: rhbz#824062 - sssd_be crashed with SIGSEGV in
1518 _tevent_schedule_immediate()
1519
1520* Wed May 16 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-28
1521- Resolves: rhbz#822236 - SSSD netgroups do not honor
1522 entry_cache_nowait_percentage
1523
1524* Fri May 11 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-27
1525- Resolves: rhbz#820759 - AVC denial seen on sssd upgrade during ipa-client
1526 upgrade
1527- Resolves: rhbz#821044 - sss_groupadd no longer detects duplicate GID numbers
1528
1529* Thu May 10 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-26
1530- Resolves: rhbz#818642 - Auth fails for user with non-default attribute names
1531- Resolves: rhbz#819063 - sssd fails to provide partial data till paged search
1532 returns "Size Limit Exceeded"
1533- Resolves: rhbz#820585 - Group enumeration fails in proxy provider
1534
1535* Mon Apr 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-25
1536- Resolves: rhbz#816616 - group members are now lowercased in case insensitive
1537 domains
1538
1539* Wed Apr 25 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-24
1540- Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
1541 top level directory is chowned by a SSSD user
1542
1543* Fri Apr 20 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-23
1544- Resolves: rhbz#805924 - SSSD should attempt to get the RootDSE after binding
1545- Resolves: rhbz#814237 - sdap_check_aliases must not error when detects the
1546 same user
1547- Resolves: rhbz#812281 - autofs client: map name length used as key length
1548- Related: rhbz#784870 - SSSD fails during autodetection of search bases for
1549 new LDAP features
1550- Related: rhbz#814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes
1551
1552* Mon Apr 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-22
1553- Fix typo in patch for SSH umask
1554- Related: rhbz#808107 - Coverity revealed memory management defects
1555
1556* Mon Apr 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-21
1557- Resolves: rhbz#808458 - Authconfig crashes when sets krb realm
1558- Resolves: rhbz#808597 - sssd_nss crashes on request when no back end is
1559 running
1560- Resolves: rhbz#808107 - Coverity revealed memory management defects
1561
1562* Fri Mar 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-20
1563- Related: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
1564 case_sensitive=false
1565
1566* Fri Mar 30 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-18
1567- Resolves: rhbz#804057 - Initial service lookups having name with uppercase
1568 alphabets doesn't work
1569- Resolves: rhbz#804065 - Service lookup using case-sensitive protocol names
1570 doesn't work when case_sensitive=false
1571- Resolves: rhbz#805281 - sssd: Uses the wrong key when there a multiple
1572 realms in a single keytab
1573- Resolves: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
1574 case_sensitive=false
1575- Resolves: rhbz#805918 - Wrong resolv_status might cause crash when name
1576 resolution times out
1577- Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
1578 top level directory is chowned by a SSSD user
1579
1580* Fri Mar 16 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-17
1581- Related: rhbz#802207 - getent netgroup hangs when
1582 "use_fully_qualified_names = TRUE" in sssd
1583- Resolves: rhbz#801719 - "Error looking up public keys" while ssh to replica
1584 using IP address
1585- Resolves: rhbz#803659 - Service lookup shows case sensitive names twice with
1586 case_sensitive=false
1587- Resolves: rhbz#803842 - Unable to bind to LDAP server when minssf set
1588- Resolves: rhbz#805034 - accessing an undefined variable might cause crash
1589- Resolves: rhbz#805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login
1590
1591* Mon Mar 12 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-15
1592- Update translations
1593- Resolves: rhbz#802372 - Pick up latest translation files for SSSD
1594- Resolves: rhbz#802207 - getent netgroup hangs when
1595 "use_fully_qualified_names = TRUE" in sssd
1596- Related: rhbz#801451 - Logging in with ssh pub key should consult
1597 authentication authority policies
1598
1599* Fri Mar 09 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-12
1600- Resolves: rhbz#801407 - sssd_nss gets hung processing identical search
1601 requests
1602- Resolves: rhbz#801451 - Logging in with ssh pub key should consult
1603 authentication authority policies
1604- Resolves: rhbz#795562 - Infinite loop checking Kerberos credentials
1605- Resolves: rhbz#798317 - sssd crashes when ipa_hbac_support_srchost is set to
1606 true
1607- Resolves: rhbz#799039 - --debug option for sss_debuglevel doesn't work
1608- Resolves: rhbz#799915 - Unable to lookup netgroups with case_sensitive=false
1609- Resolves: rhbz#799929 - Raise limits for max num of files sssd_nss/sssd_pam
1610 can use
1611- Resolves: rhbz#799971 - sssd_be crashes on shutdown
1612- Resolves: rhbz#801533 - sssd_be crashes when resolving non-trivial nested
1613 group structure
1614- Resolves: rhbz#801368 - Group lookups doesn't return members with proxy
1615 provider configured
1616- Resolves: rhbz#801377 - getent returns non-existing netgroup name, when sssd
1617 is configured as proxy provider
1618
1619* Thu Mar 01 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-11
1620- Do not auto-upgrade debug levels
1621- Tool still available for manual use
1622- Reverts: rhbz#753763 - Provide logging configuration compatibility on
1623 SSSD 1.5/1.6 upgrade
1624- Resolves: rhbz#798881 - Install-time warnings
1625- Resolves: rhbz#798774 - IPA provider should assume that ipa_domain is also
1626 the dns_discovery_domain
1627- Resolves: rhbz#798655 - Password logins failing due to a process with high
1628 UID
1629
1630* Wed Feb 29 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-10
1631- Fix explicit requires to use openldap instead of openldap-libs
1632- Related: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
1633 openldap >= openldap-2.4.23-20.el6.x86_64
1634
1635* Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-9
1636- Fix multilib-clean issue due to upgrade script
1637- Remove old copy from the spec file
1638- Related: rhbz#753763 - Provide logging configuration compatibility on
1639 SSSD 1.5/1.6 upgrade
1640
1641* Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-8
1642- Fix multilib-clean issue due to upgrade script
1643- Fix typo in the patch
1644- Related: rhbz#753763 - Provide logging configuration compatibility on
1645 SSSD 1.5/1.6 upgrade
1646
1647* Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-7
1648- Fix multilib-clean issue due to upgrade script
1649- Use a patch and install the script to python_sitelib
1650- Related: rhbz#753763 - Provide logging configuration compatibility on
1651 SSSD 1.5/1.6 upgrade
1652
1653* Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
1654- Fix multilib-clean issue due to upgrade script
1655- Related: rhbz#753763 - Provide logging configuration compatibility on
1656 SSSD 1.5/1.6 upgrade
1657
1658* Tue Feb 28 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-5
1659- Resolves: rhbz#753763 - Provide logging configuration compatibility on
1660 SSSD 1.5/1.6 upgrade
1661- Resolves: rhbz#785871 - wrong build dependency on nscd
1662- Resolves: rhbz#785873 - IPA host search base cannot be set
1663- Resolves: rhbz#791208 - Entries lacking a POSIX username value break group
1664 lookups
1665- Resolves: rhbz#796307 - Simple Paged Search control needs to be used more
1666 sparingly
1667- Resolves: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
1668 openldap >= openldap-2.4.23-20.el6.x86_64
1669- Resolves: rhbz#787035 - ipa - sssd slow response with thousands of user
1670 entries
1671- Resolves: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
1672- Resolves: rhbz#772297 - Fails to update if all nisNetgroupTriple or
1673 memberNisNetgroup entries are deleted from a
1674 netgroup
1675- Resolves: rhbz#783138 - Backend occasionally goes offline under heavy load
1676- Resolves: rhbz#797975 - sssd_be: The requested target is not configured is
1677 logged at each login
1678- Resolves: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
1679
1680* Wed Feb 15 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
1681- Resolves: rhbz#761570 - [RFE] support looking up autofs maps via SSSD
1682- Resolves: rhbz#788979 - sssd crashes during initgroups against a user
1683 belonging to nested rfc2307bis group
1684
1685* Fri Feb 10 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-3.beta2
1686- Handle filtering python Provides in a safer way
1687- Related: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
1688
1689* Tue Feb 07 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-2.beta2
1690- Related: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
1691- Resolves: rhbz#786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as
1692 a dependancy
1693- Resolves: rhbz#785909 - --debug-timestamps=1 is not passed to providers
1694- Resolves: rhbz#785908 - ldap_*_search_base doesn't fully limit the group and
1695 netgroup search base correctly
1696- Resolves: rhbz#785907 - [RFE] Add support to request canonicalization on krb
1697 AS requests
1698- Resolves: rhbz#785905 - [RFE] DEBUG timestamps should offer higher precision
1699- Resolves: rhbz#785904 - [RFE] SSSD should have --version option
1700- Resolves: rhbz#785902 - Errors with empty loginShell and proxy provider
1701- Resolves: rhbz#785898 - Enable midway cache refresh by default
1702- Resolves: rhbz#785888 - sssd returns empty netgroup at a second request for
1703 a non-existing netgroup
1704- Resolves: rhbz#785884 - Honour TTL when resolving host names
1705- Resolves: rhbz#785883 - check DNS records before updates
1706- Resolves: rhbz#785881 - List the keytab to pick the princiapl to use instead
1707 of guessing
1708- Resolves: rhbz#785880 - debug_level in sssd.conf overrides command-line
1709- Resolves: rhbz#785879 - sss_obfuscate/python config parser modifies config
1710 file too much
1711- Resolves: rhbz#785877 - on reconnect we need to detect that a ipa/ds server
1712 has been reinitialized
1713- Resolves: rhbz#785741 - sssd.api.conf and sssd.api.d should not be in /etc
1714- Resolves: rhbz#773660 - Kerberos errors should go to syslog
1715- Resolves: rhbz#772163 - Iterator loop reuse cases a tight loop in the native
1716 IPA netgroups code
1717- Resolves: rhbz#771706 - sssd_be crashes during auth when there exists UTF
1718 source host group in an hbacrule
1719- Resolves: rhbz#771702 - sssd_pam crashes during change password operation
1720 against a IPA server
1721- Resolves: rhbz#771361 - case_sensitive function not working as intended for
1722 ldap
1723- Resolves: rhbz#768935 - Crash when applying settings
1724- Resolves: rhbz#766941 - The full dyndns update message should be logged into
1725 debug logs
1726- Resolves: rhbz#766930 - [RFE] Add a new option to override home directory
1727 value
1728- Resolves: rhbz#766913 - [RFE] Add option to select validate and FAST keytab
1729 principal name
1730- Resolves: rhbz#766907 - Use [...] for IPv6 addresses in kdc info files
1731- Resolves: rhbz#766904 - [RFE] Create a command line tool to change the debug
1732 levels on the fly
1733- Resolves: rhbz#766876 - [RFE] Make HBAC srchost processing optional
1734- Resolves: rhbz#766141 - [RFE] SSSD should support FreeIPA's internal
1735 netgroup representation
1736- Resolves: rhbz#761582 - [RFE] Add ldap_sasl_minssf option
1737- Resolves: rhbz#759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
1738 /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
1739- Resolves: rhbz#755506 - [RFE] Add host-based (pam_host_attr) access control
1740- Resolves: rhbz#753876 - [RFE] Add support for the services map
1741- Resolves: rhbz#746181 - "getgrgid call returned more than one result" after
1742 group name change in MSAD
1743- Resolves: rhbz#744197 - [RFE] close LDAP connection to the server when idle
1744 for some (configurable) time
1745- Resolves: rhbz#742510 - [RFE] Separate Cache Timeouts for SSSD
1746- Related: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
1747- Resolves: rhbz#742052 - id -G group resolution takes extremely long
1748- Resolves: rhbz#739312 - [RFE] sssd does not set shadowLastChange
1749- Resolves: rhbz#736150 - [RFE] SSSD should support multiple search bases
1750- Resolves: rhbz#735827 - [RFE] Ability to set a domain as case sensitive or
1751 insensitive
1752- Resolves: rhbz#735405 - [RFE] Option to disable warnings for unknown users
1753- Resolves: rhbz#728212 - [RFE] sssd does not handle when paging control
1754 disabled for openldap
1755- Resolves: rhbz#726467 - SSSD takes 30+ seconds to login
1756- Resolves: rhbz#721289 - Process /usr/libexec/sssd/sssd_be was killed by
1757 signal 11 during auth when password for the user is
1758 not set
1759
1760* Tue Jan 17 2012 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-68
1761- Resolves: rhbz#773655 - Race-condition bug in LDAP auth provider
1762
1763* Tue Nov 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-67
1764- Resolves: rhbz#753842 - sssd_nss crashes when passed invalid UTF-8 for the
1765 username in getpwnam()
1766- Resolves: rhbz#758157 - LDAP failover not working if server refuses
1767 connections
1768
1769* Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-66
1770- Related: rhbz#750359 - Major cached entry performance regression
1771
1772* Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-65
1773- Resolves: rhbz#750359 - Major cached entry performance regression
1774
1775* Mon Oct 31 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
1776- Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
1777 initgroups when groups appear in multiple nesting
1778 levels
1779
1780* Wed Oct 26 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-63
1781- Resolves: rhbz#749256 - SELinux errors with SSSD Downgrade
1782
1783* Tue Oct 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-62
1784- Resolves: rhbz#748924 - RHEL6.1/sssd_pam segmentation fault
1785
1786* Tue Oct 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-61
1787- Resolves: rhbz#748412 - Memory leaks during the initgroups() operation
1788
1789* Tue Oct 18 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
1790- Related: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
1791 socket
1792
1793* Mon Oct 17 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
1794- Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
1795- Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
1796- Related: rhbz#743925 - HBAC processing is very slow when dealing with
1797 FreeIPA deployments with large numbers of hosts
1798 Fixes a crash introduced by the earlier patch.
1799- Related: rhbz#733382 - SSSD should pick a user/group name when there are
1800 multi-valued names
1801 Fixes for internationalization
1802
1803* Fri Oct 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-58
1804- Related: rhbz#742278 - Rework the example config
1805
1806* Fri Oct 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
1807- Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
1808 FreeIPA deployments with large numbers of hosts
1809- Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
1810- Related: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
1811 socket
1812
1813* Thu Oct 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-56
1814- Resolves: rhbz#742278 - Rework the example config
1815- Resolves: rhbz#746037 - Only access sssd_nss internal hash table if it was
1816 initialized
1817- Resolves: rhbz#742526 - SSSD's man pages are missing information
1818- Resolves: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
1819 socket
1820
1821* Thu Oct 06 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-55
1822- Resolves: rhbz#738621 - Lookup fails for non-primary usernames with
1823 multi-valued uid
1824- Resolves: rhbz#738629 - Group lookups doesn't return it's member for
1825 sometime when the member has multi-valued uid
1826- Resolves: rhbz#742295 - Use an explicit base 10 when converting uidNumber
1827 to integer
1828- Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
1829 multi-valued names
1830
1831* Fri Sep 30 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-53
1832- Resolves: rhbz#741751 - HBAC rule evaluation does not properly handle host
1833 groups
1834- Resolves: rhbz#740501 - SSSD not functional after "self" reboot
1835- Resolves: rhbz#742539 - HBAC: Hostname comparisons should be
1836 case-insensitive
1837
1838* Tue Sep 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-52
1839- Resolves: rhbz#728343 - SSSD taking 5 minutes to log in
1840- Resolves: rhbz#739850 - Coverity defects newly introduced in rhel 6.2
1841
1842* Mon Sep 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-51
1843- Resolves: rhbz#737157 - "System error" appears in log during change password
1844 operation of a user in openldap server with ppolicy
1845 enabled
1846- Resolves: rhbz#737172 - "Unknown (private extension) error(21853), (null)"
1847 messages are logged during change password operation
1848 of a user in openldap server with ppolicy enabled
1849
1850* Wed Sep 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-50
1851- Resolves: rhbz#736314 - sssd crashes during auth while there exists multiple
1852 external hosts along with managed host
1853- Resolves: rhbz#732974 - [RFE] Have SSSD cache properly with
1854 krb5_validate = True and SElinux enabled
1855
1856* Mon Aug 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-49
1857- Resolves: rhbz#732010 - LDAP+GSSAPI needs explicit Kerberos realm
1858- Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
1859 multi-valued names
1860- Resolves: rhbz#733409 - Improve password policy error message
1861- Resolves: rhbz#733663 - Authentication fails when there exists an empty
1862 hbacsvcgroup
1863- Resolves: rhbz#732935 - Add LDAP provider option to set
1864 LDAP_OPT_X_SASL_NOCANON
1865- Resolves: rhbz#734101 - sssd blocks login of ipa-users
1866
1867* Wed Aug 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-48
1868- Related: rhbz#728353 - Resolve RPMDiff errors in SSSD
1869
1870* Mon Aug 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-47
1871- Resolves: rhbz#728961 - Provide a mechanism for vetoing the use of certain
1872 shells
1873
1874* Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-46
1875- Related: rhbz#728267 - When non-posix groups are skipped, initgroups
1876 returns random GID
1877
1878* Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-45
1879- Related: rhbz#726466 - HBAC rule evaluation does not support extended
1880 UTF-8 languages
1881- Related: rhbz#718250 - Remove DENY rules from the HBAC access provider
1882- Fixes an issue on big endian platforms
1883
1884* Thu Aug 04 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-44
1885- Resolves: rhbz#700828 - Process /usr/libexec/sssd/sssd_be was killed by
1886 signal 11 (SIGSEGV) when ldap_uri is misconfigured
1887- Resolves: rhbz#726438 - sssd doesn't honor ldap supportedControls
1888- Resolves: rhbz#726466 - HBAC rule evaluation does not support extended
1889 UTF-8 languages
1890- Resolves: rhbz#718250 - Remove DENY rules from the HBAC access provider
1891- Resolves: rhbz#728267 - When non-posix groups are skipped, initgroups
1892 returns random GID
1893- Resolves: rhbz#726475 - sssd_pam leaks file descriptors
1894- Resolves: rhbz#725868 - Explicitly ignore groups with gidNumber = 0
1895
1896* Wed Jul 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-43
1897- Related: rhbz#721052 - sssd does not handle kerberos server IP change
1898- Use ares_search instead of ares_query to honor
1899- search entries in /etc/resolv.conf
1900
1901* Wed Jul 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-42
1902- Resolves: rhbz#711416 - During the change password operation the ccache is
1903- not replaced by a new one if the old one isn't
1904- active anymore
1905- Resolves: rhbz#715609 - Certificate validation fails with message
1906- "Connection error: TLS: hostname does not match CN
1907- in peer certificate"
1908- Resolves: rhbz#719089 - IPA dynamic DNS update mangles AAAA records
1909- Resolves: rhbz#721052 - sssd does not handle kerberos server IP change
1910- Honor TTL values when resolving hostnames
1911
1912* Fri Jun 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-41
1913- Resolves: rhbz#713961 - libsss_ldap segfault at login against OpenLDAP
1914- Resolves: rhbz#713438 - sssd shuts down if inotify crashes
1915
1916* Thu Jun 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-40
1917- Resolves: rhbz#709081 - sssd.$arch should require sssd-client.$arch
1918
1919* Thu Jun 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-39
1920- Resolves: rhbz#709342 - Typo in negative cache notification for initgroups()
1921- Resolves: rhbz#708009 - "renew_all_tgts" and "renew_handlers" messages are
1922- being logged multiple times when the provider comes
1923- back online
1924- Resolves: rhbz#707997 - The IPA provider does not work with IPv6
1925- Resolves: rhbz#677327 - [RFE] Support overriding attribute value
1926- Resolves: rhbz#692090 - SSSD is not populating nested groups in
1927- Active Directory
1928
1929
1930* Fri May 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-38
1931- Resolves: rhbz#707627 - Include valid "ldap_uri" formats in sssd-ldap man
1932- page
1933
1934* Wed May 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
1935- Resolves: rhbz#707513 - Unable to authenticate users when username
1936- contains "\0"
1937
1938* Tue May 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-36
1939- Resolves: rhbz#698723 - kpasswd fails when using sssd and
1940- kadmin server != kdc server
1941
1942* Tue May 24 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
1943- Resolves: rhbz#707282 - latest sssd fails if ldap_default_authtok_type is
1944- not mentioned
1945- Resolves: rhbz#692404 - rfc2307bis groups are being enumerated even when the
1946- gidNumber is out of the range of min_id,max_id.
1947- Resolves: rhbz#699530 - Users with a local group as their primary GID are
1948- denied access by the simple access provider
1949- Resolves: rhbz#700172 - RFE: SSSD should support paged LDAP lookups
1950- Resolves: rhbz#705434 - IPA provider fails initgroups() if user is not a
1951- member of any group
1952- Resolves: rhbz#703624 - SSSD's async resolver only tries the first
1953- nameserver in /etc/resolv.conf
1954
1955* Tue May 03 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-34
1956- Resolves: rhbz#701700 - sssd client libraries use select() but should use
1957- poll() instead
1958
1959* Mon May 02 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-33
1960- Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
1961- Fix segfault in TGT renewal
1962
1963* Fri Apr 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-32
1964- Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
1965- Fix typo causing build breakage
1966
1967* Fri Apr 29 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-31
1968- Resolves: rhbz#693818 - Automatic TGT renewal overwrites cached password
1969
1970* Fri Apr 15 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-30
1971- Resolves: rhbz#696972 - Filters not honoured against fully-qualified users
1972
1973* Thu Apr 14 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-29
1974- Resolves: rhbz#694146 - SSSD consumes GBs of RAM, possible memory leak
1975
1976* Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-28
1977- Related: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
1978- information
1979
1980* Tue Apr 12 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-27
1981- Related: rhbz#694783 - SSSD crashes during getent when anonymous bind is
1982- disabled
1983
1984* Mon Apr 11 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-26
1985- Resolves: rhbz#694444 - Unable to resolve SRV record when called with
1986- _srv_,<fixed ldap uri> in ldap_uri
1987- Related: rhbz#694783 - SSSD crashes during getent when anonymous bind is
1988- disabled
1989
1990* Fri Apr 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-25
1991- Resolves: rhbz#694783 - SSSD crashes during getent when anonymous bind is
1992- disabled
1993
1994* Fri Apr 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-24
1995- Resolves: rhbz#692472 - Process /usr/libexec/sssd/sssd_be was killed by
1996- signal 11 (SIGSEGV)
1997- Fix is to not attempt to resolve nameless servers
1998
1999* Wed Mar 30 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-23
2000- Resolves: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
2001- information
2002
2003* Mon Mar 28 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-21
2004- Resolves: rhbz#690866 - Groups with a zero-length memberuid attribute can
2005- cause SSSD to stop caching and responding to
2006- requests
2007
2008* Fri Mar 25 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-20
2009- Resolves: rhbz#690131 - Traceback messages seen while interrupting
2010- sss_obfuscate using ctrl+d
2011- Resolves: rhbz#690421 - [abrt] sssd-1.2.1-28.el6_0.4: _talloc_free: Process
2012- /usr/libexec/sssd/sssd_be was killed by signal 11
2013- (SIGSEGV)
2014
2015* Mon Mar 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-17
2016- Related: rhbz#683885 - SSSD should skip over groups with multiple names
2017
2018* Mon Mar 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-16
2019- Resolves: rhbz#683158 - SSSD breaks on RDNs with a comma in them
2020- Resolves: rhbz#689886 - group memberships are not populated correctly during
2021- IPA provider initgroups
2022- Resolves: rhbz#683885 - SSSD should skip over groups with multiple names
2023
2024* Wed Mar 09 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-15
2025- Resolves: rhbz#683860 - Skip users and groups that have incomplete contents
2026- Resolves: rhbz#688491 - authconfig fails when access_provider is set as krb5
2027- in sssd.conf
2028
2029* Wed Mar 09 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-14
2030- Resolves: rhbz#683255 - sudo/ldap lookup via sssd gets stuck for 5min
2031- waiting on netgroup
2032- Resolves: rhbz#683431 - sssd consumes 100% CPU
2033- Related: rhbz#680440 - sssd does not handle kerberos server IP change
2034
2035* Tue Mar 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-13
2036- Related: rhbz#680440 - sssd does not handle kerberos server IP change
2037- SSSD was staying with the old server if it was still online
2038
2039* Mon Mar 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-12
2040- Resolves: rhbz#682850 - IPA provider should use realm instead of ipa_domain
2041- for base DN
2042
2043* Mon Mar 07 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-11
2044- Resolves: rhbz#682340 - sssd-be segmentation fault - ipa-client on
2045- ipa-server
2046- Resolves: rhbz#680440 - sssd does not handle kerberos server IP change
2047- Resolves: rhbz#680442 - Dynamic DNS update fails if multiple servers are
2048- given in ipa_server config option
2049- Resolves: rhbz#680932 - Do not delete sysdb memberOf if there is no memberOf
2050- attribute on the server
2051- Resolves: rhbz#682807 - sssd_nss core dumps with certain lookups
2052
2053* Tue Feb 22 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-10
2054- Related: rhbz#678614 - SSSD needs to look at IPA's compat tree for netgroups
2055- Related: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
2056
2057* Tue Feb 22 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-9
2058- Resolves: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
2059- Resolves: rhbz#677318 - Does not read renewable ccache at startup
2060
2061* Mon Feb 21 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
2062- Resolves: rhbz#678593 - User information not updated on login for secondary
2063- domains
2064- Resolves: rhbz#678777 - IPA provider does not update removed group
2065- memberships on initgroups
2066
2067* Sat Feb 19 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
2068- Resolves: rhbz#677588 - sssd crashes at the next tgt renewals it tries
2069- Resolves: rhbz#678410 - name service caches names, so id command shows
2070- recently deleted users
2071- Resolves: rhbz#678614 - SSSD needs to look at IPA's compat tree for
2072- netgroups
2073
2074* Tue Feb 08 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
2075- Resolves: rhbz#670511 - SSSD and sftp-only jailed users with pubkey login
2076- Resolves: rhbz#675284 - "no matching rule" message logged on all successful
2077- requests
2078- Resolves: rhbz#676911 - SSSD attempts to use START_TLS over LDAPS for
2079- authentication
2080
2081* Thu Feb 03 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
2082- Resolves: rhbz#674164 - sss_obfuscate fails if there's no domain named
2083- "default"
2084- Resolves: rhbz#674515 - -p option always uses empty string to obfuscate
2085- password
2086- Resolves: rhbz#674141 - Traceback call messages displayed while
2087- "sss_obfuscate" command is executed as a non-root
2088- user
2089
2090* Tue Feb 01 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-4
2091- Resolves: rhbz#674172 - Group members are not sanitized in nested group
2092- processing
2093- Put translated tool manpages into the sssd-tools subpackage
2094
2095* Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
2096- Related: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
2097- Also add the updated ding-libs to the BuildRequires
2098
2099* Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-2
2100- Related: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
2101- Explicitly require updated ding-libs
2102
2103* Thu Jan 27 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
2104- Resolves: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
2105- New upstream release 1.5.1
2106- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
2107- Vast performance improvements when enumerate = true
2108- All PAM actions will now perform a forced initgroups lookup instead of just
2109- a user information lookup
2110- This guarantees that all group information is available to other
2111- providers, such as the simple provider.
2112- For backwards-compatibility, DNS lookups will also fall back to trying the
2113- SSSD domain name as a DNS discovery domain.
2114- Support for more password expiration policies in LDAP
2115- 389 Directory Server
2116- FreeIPA
2117- ActiveDirectory
2118- Support for ldap_tls_{cert,key,cipher_suite} config options
2119- Assorted bugfixes
2120
2121* Thu Jan 13 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-2
2122- Add noverify to sssd.conf
2123- Resolves: rhbz#627165 - TPS VerifyTest failure
2124
2125* Thu Dec 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
2126- Related: rhbz#644072 - Rebase SSSD to 1.5
2127- New upstream release 1.5.0
2128- Fixed issues with LDAP search filters that needed to be escaped
2129- Add Kerberos FAST support on platforms that support it
2130- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
2131- Added a Kerberos access provider to honor .k5login
2132- Addressed several thread-safety issues in the sss_client code
2133- Improved support for delayed online Kerberos auth
2134- Significantly reduced time between connecting to the network/VPN and
2135- acquiring a TGT
2136- Added feature for automatic Kerberos ticket renewal
2137- Provides the kerberos ticket for long-lived processes or cron jobs
2138- even when the user logs out
2139- Added several new features to the LDAP access provider
2140- Support for 'shadow' access control
2141- Support for authorizedService access control
2142- Ability to mix-and-match LDAP access control features
2143- Added an option for a separate password-change LDAP server for those
2144- platforms where LDAP referrals are not supported
2145- Added support for manpage translations
2146
2147* Tue Dec 07 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.4
2148- Resolves: rhbz#660592 - SSSD shutdown sometimes hangs
2149- Resolves: rhbz#660585 - getent passwd <username>' returns nothing if its
2150- uidNumber gt 2147483647
2151
2152* Thu Dec 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-36
2153- Resolves: rhbz#659401 - SSSD shutdown sometimes hangs
2154
2155* Thu Dec 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-35
2156- Resolves: rhbz#645449 - 'getent passwd <username>' returns nothing if its
2157- uidNumber gt 2147483647
2158
2159* Tue Nov 30 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.3
2160- Resolves: rhbz#658374 - sssd stops on upgrade
2161
2162* Wed Nov 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-34
2163- Resolves: rhbz#658158 - sssd stops on upgrade
2164
2165* Wed Nov 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.2
2166- Resolves: rhbz#649312 - SSSD will sometimes lose groups from the cache
2167
2168* Wed Nov 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-33
2169- Resolves: rhbz#649286 - SSSD will sometimes lose groups from the cache
2170
2171* Mon Oct 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.1
2172- Resolves: rhbz#637070 - the krb5 locator plugin isn't packaged for multilib
2173- Resolves: rhbz#642412 - SSSD initgroups does not behave as expected
2174
2175* Mon Oct 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-32
2176- Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
2177- Resolves: rhbz#633487 - SSSD initgroups does not behave as expected
2178
2179* Thu Sep 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-29
2180- Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
2181
2182* Fri Sep 03 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28
2183- Resolves: rhbz#629949 - sssd stops on upgrade
2184
2185* Wed Aug 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-27
2186- Resolves: rhbz#625122 - GNOME Lock Screen unocks without a password
2187
2188* Wed Aug 04 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-26
2189- Resolves: rhbz#621307 - Password changes are broken on LDAP
2190
2191* Fri Jul 30 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-23
2192- Resolves: rhbz#617623 - SSSD suffers from serious performance issues on
2193- initgroups calls
2194
2195* Fri Jul 23 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-21
2196- Resolves: rhbz#607233 - SSSD users cannot log in through GDM
2197- - Real issue was that long-running services
2198- - do not reconnect if sssd is restarted
2199
2200* Fri Jul 09 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-20
2201- Resolves: rhbz#591715 - sssd should emit warnings if there are problems with
2202- /etc/krb5.keytab file
2203
2204* Mon Jun 28 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
2205- Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
2206- final
2207- Resolves: rhbz#608661 - SASL with OpenLDAP server fails
2208- Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes
2209
2210* Fri Jun 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
2211- New upstream bugfix release 1.2.1
2212- Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
2213- bugs.
2214- Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
2215- Resolves: rhbz#604704 - authconfig should provide error with no trace back
2216- if disabling sssd when sssd is not enabled
2217- Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
2218- auth logs continuous error messages to sssd_ldap.log
2219- Resolves: rhbz#596295 - Authentication fails for user from the second domain
2220- when the same user name is filtered out from the
2221- first domain
2222- Related: rhbz#598559 - Update translation files for SSSD before RHEL 6
2223- final
2224
2225* Thu Jun 10 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-14
2226- Resolves: rhbz#593696 - Empty list of simple_allow_users causes sssd service
2227- to fail while restart
2228- Resolves: rhbz#600352 - Wrapping the value for "ldap_access_filter" in
2229- parentheses causes ldap_search_ext to fail
2230- Resolves: rhbz#600468 - Segfault in krb5_child
2231- Related: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
2232- bugs.
2233
2234* Wed Jun 02 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-13
2235- Resolves: rhbz#598670 - Ccache file of a user is removed too early
2236- Resolves: rhbz#599057 - Incomplete comparison of a service name in
2237- IPA access provider
2238- Resolves: rhbz#598496 - Failure with IPA access provider
2239- Resolves: rhbz#599027 - Makefile typo causes SSSD not to use the
2240- kernel keyring
2241
2242* Mon May 24 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
2243- New stable upstream version 1.2.0
2244- Support ServiceGroups for FreeIPA v2 HBAC rules
2245- Fix long-standing issue with auth_provider = proxy
2246- Better logging for TLS issues in LDAP
2247- Resolves: rhbz#584001 - Rebase sssd to 1.2
2248- Resolves: rhbz#584017 - Unconfiguring sssd leaves KDC locator file
2249- Resolves: rhbz#587384 - authconfig fails if krb5_kpasswd in sssd.conf
2250- Resolves: rhbz#587743 - Need to replicate pam_ldap's pam_filter in sssd.conf
2251- Resolves: rhbz#590134 - sssd: auth_provider = proxy regression
2252- Resolves: rhbz#591131 - Kerberos provider needs to rewrite kdcinfo file when
2253- going online
2254- Resolves: rhbz#591136 - Change SSSD ipa BE to handle new structure of the
2255- HBAC rule
2256
2257* Wed May 19 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11.1
2258- Improve DEBUG logs for STARTTLS failures
2259
2260* Tue May 18 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
2261- New LDAP access provider allows for filtering user access by LDAP attribute
2262- Reduced default timeout for detecting offline status with LDAP
2263- GSSAPI ticket lifetime made configurable
2264- Better offline->online transition support in Kerberos
2265
2266* Fri May 07 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
2267- Release new upstream version 1.1.91
2268- Enhancements when using SSSD with FreeIPA v2
2269- Support for deferred kinit
2270- Support for DNS SRV records for failover
2271
2272* Fri Apr 02 2010 Simo Sorce <ssorce@redhat.com> - 1.1.1-3
2273- Bump up release number to avoid library sub-packages version issues with
2274 previous releases.
2275
2276* Thu Apr 01 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
2277- New upstream release 1.1.1
2278- Fixed the IPA provider (which was segfaulting at start)
2279- Fixed a bug in the SSSDConfig API causing some options to revert to
2280- their defaults
2281- This impacted the Authconfig UI
2282- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
2283
2284* Tue Mar 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
2285- Release SSSD 1.1.0 final
2286- Fix two potential segfaults
2287- Fix memory leak in monitor
2288- Better error message for unusable confdb
2289
2290* Wed Mar 17 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
2291- Release candidate for SSSD 1.1
2292- Add simple access provider
2293- Create subpackages for libcollection, libini_config, libdhash and librefarray
2294- Support IPv6
2295- Support LDAP referrals
2296- Fix cache issues
2297- Better feedback from PAM when offline
2298
2299* Wed Feb 24 2010 Stephen Gallagehr <sgallagh@redhat.com> - 1.0.5-2
2300- Rebuild against new libtevent
2301
2302* Fri Feb 19 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.5-1
2303- Fix licenses in sources and on RPMs
2304
2305* Mon Jan 25 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.4-1
2306- Fix regression on 64-bit platforms
2307
2308* Fri Jan 22 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
2309- Fixes link error on platforms that do not do implicit linking
2310- Fixes double-free segfault in PAM
2311- Fixes double-free error in async resolver
2312- Fixes support for TCP-based DNS lookups in async resolver
2313- Fixes memory alignment issues on ARM processors
2314- Manpage fixes
2315
2316* Thu Jan 14 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
2317- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
2318- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
2319- Several segfault bugfixes
2320
2321* Mon Jan 11 2010 Stephen Gallagher <sgallagh@redhat.com> - 1.0.1-1
2322- Fix CVE-2010-0014
2323
2324* Mon Dec 21 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-2
2325- Patch SSSDConfig API to address
2326- https://bugzilla.redhat.com/show_bug.cgi?id=549482
2327
2328* Fri Dec 18 2009 Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-1
2329- New upstream stable release 1.0.0
2330
2331* Fri Dec 11 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.1-1
2332- New upstream bugfix release 0.99.1
2333
2334* Mon Nov 30 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.99.0-1
2335- New upstream release 0.99.0
2336
2337* Tue Oct 27 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
2338- Fix segfault in sssd_pam when cache_credentials was enabled
2339- Update the sample configuration
2340- Fix upgrade issues caused by data provider service removal
2341
2342* Mon Oct 26 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-2
2343- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
2344
2345* Fri Oct 23 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.7.0-1
2346- New upstream release 0.7.0
2347
2348* Thu Oct 15 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-2
2349- Fix missing file permissions for sssd-clients
2350
2351* Tue Oct 13 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
2352- Add SSSDConfig API
2353- Update polish translation for 0.6.0
2354- Fix long timeout on ldap operation
2355- Make dp requests more robust
2356
2357* Tue Sep 29 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
2358- Ensure that the configuration upgrade script always writes the config
2359 file with 0600 permissions
2360- Eliminate an infinite loop in group enumerations
2361
2362* Mon Sep 28 2009 Sumit Bose <sbose@redhat.com> - 0.6.0-0
2363- New upstream release 0.6.0
2364
2365* Mon Aug 24 2009 Simo Sorce <ssorce@redhat.com> - 0.5.0-0
2366- New upstream release 0.5.0
2367
2368* Wed Jul 29 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
2369- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
2370 without a password. (Patch by Stephen Gallagher)
2371
2372* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.1-3
2373- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
2374
2375* Mon Jun 22 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-2
2376- Fix a couple of segfaults that may happen on reload
2377
2378* Thu Jun 11 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-1
2379- add missing configure check that broke stopping the daemon
2380- also fix default config to add a missing required option
2381
2382* Mon Jun 8 2009 Simo Sorce <ssorce@redhat.com> - 0.4.1-0
2383- latest upstream release.
2384- also add a patch that fixes debugging output (potential segfault)
2385
2386* Mon Apr 20 2009 Simo Sorce <ssorce@redhat.com> - 0.3.2-2
2387- release out of the official 0.3.2 tarball
2388
2389* Mon Apr 20 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
2390- bugfix release 0.3.2
2391- includes previous release patches
2392- change permissions of the /etc/sssd/sssd.conf to 0600
2393
2394* Tue Apr 14 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-2
2395- Add last minute bug fixes, found in testing the package
2396
2397* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-1
2398- Version 0.3.1
2399- includes previous release patches
2400
2401* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-2
2402- Try to fix build adding automake as an explicit BuildRequire
2403- Add also a couple of last minute patches from upstream
2404
2405* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.0-1
2406- Version 0.3.0
2407- Provides file based configuration and lots of improvements
2408
2409* Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.1-1
2410- Version 0.2.1
2411
2412* Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.0-1
2413- Version 0.2.0
2414
2415* Sun Mar 08 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-5.20090309git691c9b3
2416- package git snapshot
2417
2418* Fri Mar 06 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-4
2419- fixed items found during review
2420- added initscript
2421
2422* Thu Mar 05 2009 Sumit Bose <sbose@redhat.com> - 0.1.0-3
2423- added sss_client
2424
2425* Mon Feb 23 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-2
2426- Small cleanup and fixes in the spec file
2427
2428* Thu Feb 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.1.0-1
2429- Initial release (based on version 0.1.0 upstream code)
2430
2431[root@ldapklient rpmbuild]#