Commit Graph

268 Commits

Author SHA1 Message Date
Stephen Gallagher
ece3519410 Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
2011-11-29 14:20:31 -05:00
Jakub Hrozek
95fec2a877 Rebuild for libldb 1.1.3 2011-11-24 14:18:54 +01:00
Stephen Gallagher
50d0fe5c94 Resolves: rhbz#752495 - Crash when apply settings 2011-11-10 12:03:57 -05:00
Stephen Gallagher
dd4aa148dd Rebuild for new libldb 2011-11-09 09:02:44 -05:00
Stephen Gallagher
46a6ee6147 New upstream release 1.6.3
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
Fixes a major cache performance issue introduced in 1.6.2
Fixes a potential infinite-loop with certain LDAP layouts
2011-11-04 12:29:04 -04:00
Dennis Gilmore
9ef1f397c1 - Rebuilt for glibc bug#747377 2011-10-26 19:24:26 -05:00
Stephen Gallagher
9a79ed0faa Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
2011-10-23 13:48:09 -07:00
Stephen Gallagher
14552a85ab Add explicit requirement on selinux-policy version to address new SBUS symlinks. 2011-10-21 08:03:20 -07:00
Stephen Gallagher
359707a48b Remove %%files reference to sss_debuglevel copied from wrong upstreeam spec file. 2011-10-19 07:32:09 -04:00
Stephen Gallagher
75138e2284 Improved handling of users and groups with multi-valued name attributes
(aliases)
Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
Improved process-hang detection and restarting
Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
Cleaned up the example configuration
New tool to change debug level on the fly
2011-10-18 17:24:31 -04:00
Stephen Gallagher
a6910c0007 New upstream release 1.6.1
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
Three HBAC regressions have been fixed.
Fix for an infinite loop in the deref code
2011-08-29 15:45:02 -04:00
Stephen Gallagher
04d8c969b5 Build with _hardened_build macro 2011-08-03 09:31:33 -04:00
Stephen Gallagher
679b5f7a1b New upstream release 1.6.0
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
Add host access control support for LDAP (similar to pam_host_attr)
Finer-grained control on principals used with Kerberos (such as for FAST or
validation)
Added a new tool sss_cache to allow selective expiring of cached entries
Added support for LDAP DEREF and ASQ controls
Added access control features for Novell Directory Server
FreeIPA dynamic DNS update now checks first to see if an update is needed
Complete rewrite of the HBAC library
New libraries: libipa_hbac and libipa_hbac-python
2011-08-03 08:08:26 -04:00
Stephen Gallagher
ce222bafe5 New upstream release 1.5.11
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
Fix a serious regression that prevented SSSD from working with ldaps:// URIs
IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
address being saved to the AAAA record
2011-07-05 15:03:55 -04:00
Stephen Gallagher
72bc2e1636 New upstream release 1.5.11
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
Fix a serious regression that prevented SSSD from working with ldaps:// URIs
IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
address being saved to the AAAA record
2011-07-05 15:00:32 -04:00
Stephen Gallagher
807b79d3dd New upstream release 1.5.10
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
Fixed a regression introduced in 1.5.9 that could result in blocking calls
to LDAP
2011-07-01 08:31:11 -04:00
Stephen Gallagher
4ef0c7f5e6 New upstream release 1.5.9
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
Support for overriding home directory, shell and primary GID locally
Properly honor TTL values from SRV record lookups
Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
servers)
Properly escape IPv6 addresses in the failover code
Do not crash if inotify fails (e.g. resource exhaustion)
Don't add multiple TGT renewal callbacks (too many log messages)
2011-06-30 14:57:29 -04:00
Stephen Gallagher
91fde1e873 New upstream release 1.5.8
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
Support for the LDAP paging control
Support for multiple DNS servers for name resolution
Fixes for several group membership bugs
Fixes for rare crash bugs
2011-05-27 16:41:02 -04:00
Stephen Gallagher
5796dc7438 Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
Make sure to properly convert to systemd if upgrading from newer
updates for Fedora 14
2011-05-23 14:51:01 -04:00
Stephen Gallagher
d4aff4665f Fix segfault in TGT renewal 2011-05-02 12:29:25 -04:00
Stephen Gallagher
e4bdfb2159 Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
cached password with predicatable filename
2011-04-29 14:36:34 -04:00
Stephen Gallagher
eedc5ecda8 Re-add manpage translations 2011-04-20 16:27:19 -04:00
Stephen Gallagher
8ada5dc2d5 New upstream release 1.5.6
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
Fixed a serious memory leak in the memberOf plugin
Fixed a regression with the negative cache that caused it to be essentially
nonfunctional
Fixed an issue where the user's full name would sometimes be removed from
the cache
Fixed an issue with password changes in the kerberos provider not working
with kpasswd
2011-04-20 15:26:05 -04:00
Stephen Gallagher
d9b22a78e6 Resolves: rhbz#697057 - kpasswd fails when using sssd and
kadmin server != kdc server
Upgrades from SysV should now maintain enabled/disabled status
2011-04-20 12:44:13 -04:00
Stephen Gallagher
d7effc61bd Fix %postun 2011-04-20 12:22:57 -04:00
Stephen Gallagher
d895a5f72c Fix systemd conversion. Upgrades from SysV to systemd weren't properly
enabling the systemd service.
Fix a serious memory leak in the memberOf plugin
Fix an issue where the user's full name would sometimes be removed
from the cache
2011-04-14 16:24:13 -04:00
Stephen Gallagher
7dcee20614 Install systemd unit file instead of sysv init script 2011-04-12 11:52:28 -04:00
Stephen Gallagher
c8fb340975 New upstream release 1.5.5
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
Fixes for several crash bugs
LDAP group lookups will no longer abort if there is a zero-length member
attribute
Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
2011-04-12 11:14:23 -04:00
Stephen Gallagher
3eed4c3557 Update to SSSD 1.5.4
Improve the way we detect the LDB plugin location

New upstream release 1.5.4
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
Fixes for Active Directory when not all users and groups have POSIX attributes
Fixes for handling users and groups that have name aliases (aliases are ignored)
Fix group memberships after initgroups in the IPA provider
2011-03-24 15:29:47 -04:00
Stephen Gallagher
f6c362454d Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication 2011-03-17 11:47:25 -04:00
Stephen Gallagher
53637a07d3 New upstream release 1.5.3
Support for libldb >= 1.0.0
2011-03-11 13:50:59 -05:00
Stephen Gallagher
1dadc663de Update sources file for sssd-1.5.2 2011-03-10 16:38:54 -05:00
Stephen Gallagher
3b364490a6 New upstream release 1.5.2
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
Fixes for support of FreeIPA v2
Fixes for failover if DNS entries change
Improved sss_obfuscate tool with better interactive mode
Fix several crash bugs
Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
Delete users from the local cache if initgroups calls return 'no such user'
(previously only worked for getpwnam/getpwuid)
Use new Transifex.net translations
Better support for automatic TGT renewal (now survives restart)
Netgroup fixes
2011-03-10 15:00:40 -05:00
Simo Sorce
b28cafe61b - Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
2011-02-27 21:54:52 -05:00
Stephen Gallagher
7a33e7710b - Resolves: rhbz#677768 - name service caches names, so id command shows
-                         recently deleted users
2011-02-21 15:42:00 -05:00
Stephen Gallagher
da2a04f651 - Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
2011-02-11 11:41:33 -05:00
Stephen Gallagher
0ad47aae65 - Fix memberOf install path 2011-02-11 11:22:33 -05:00
Stephen Gallagher
e8ab291d89 - Add support for libldb 1.0.0 2011-02-11 09:36:41 -05:00
Dennis Gilmore
8923e26c46 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild 2011-02-09 10:00:19 -06:00
Stephen Gallagher
d12cd5dd26 - Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
2011-02-01 09:20:57 -05:00
Stephen Gallagher
749bf2d662 Bump release number 2011-01-27 14:40:33 -05:00
Stephen Gallagher
7e3a2cd879 - Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
2011-01-27 14:38:13 -05:00
Stephen Gallagher
f151b0669b - New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
-   This guarantees that all group information is available to other
-   providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
-    389 Directory Server
-    FreeIPA
-    ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
2011-01-27 13:50:21 -05:00
Stephen Gallagher
3a15e92ce7 - CVE-2010-4341 - DoS in sssd PAM responder can prevent logins 2011-01-11 12:32:39 -05:00
Stephen Gallagher
5225c3262b - New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
2010-12-22 14:08:33 -05:00
Stephen Gallagher
9600ada0fd Fix release number 2010-11-18 08:44:23 -05:00
Stephen Gallagher
069ad4076b - Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
2010-11-18 08:41:39 -05:00
Stephen Gallagher
4e1de07cd8 - Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
2010-11-16 12:48:57 -05:00
Stephen Gallagher
9d5bcde0eb - New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
2010-11-01 09:02:47 -04:00
Stephen Gallagher
75efc48618 Fix incorrect tarball URL 2010-10-18 16:06:09 -04:00