-  All python bindings now have a Python3 and a Python2 version in the

     upstream RPM packaging scheme

  -  The OpenSSL development library such as ``openssl-devel`` on

  -  A new internal library ``libsss_cert.so`` is present in this release.

  -  The fast initgroups memcache is represented by a new file

     ``/var/lib/sss/mc/initgroups``

     <div>

      sssd should pass -d to nsupdate when running with high log level

      Make the LDAP bind operation timeout configurable

      [RFE] Expose listing calls over D-BUS

      nsupdate stderr is not captured

      The cleanup task has no DEBUG statements

      SBUS: Flush the UID cache when we receive NameOwnerChanged

      [RFE] Implement object caching on the bus

      IFP: support multiple interfaces for object

      SSSD does not update Dynamic DNS records if the IPA domain differs

      from machine hostname's domain

      In ipa-ad trust, with 'default\_domain\_suffix' set to AD domain,

      IPA user are not able to log unless use\_fully\_qualified\_names is

      set

      SSSD should be able to build python2 and python3 bindings in a one

      build

      [RFE] Homedir is always overwritten with subdomain\_homedir value in

      server mode

      Does sssd-ad use the most suitable attribute for group name?

      Add a way to lookup users based on CAC identity certificates

      Make SSSD's HBAC validation more permissive if deny rules are not

      used

      [bug] sssd always appends default\_domain\_suffix when checking for

      host keys

      Man sssd-ad(5) lists Group Policy Management Editor naming for some

      policies but not for all

      id\_provider=proxy with auth\_provider=ldap does not work reliably

      Sudo responder does not respect filter\_users and filter\_groups

      Disable the cleanup task by default

      RFE: Fetch keytabs for one-way trusts in IPA subdomain code

      RFE: Change ad\_id\_ctx instantiation in the IPA subdomain code to

      support one-way trusts

      [RFE] Support GPOs from different domain controllers

      RFE: Change AD GPO default to enforcing

      sssd with ldap backend throws error domain log

  .. raw:: html

     <div>

      [RFE] authenticate against cache in SSSD

      [RFE] Python 3 support

      [RFE] The fast memory cache should cache initgroups

      SSSD doesn't re-read resolv.conf if the file doesn't exist during

      boot

      Add a IS\_DEFAULT\_VIEW macro

      Kerberos-based providers other than krb5 do not queue requests

  .. raw:: html

  -  IFP: add org.freedesktop.sssd.infopipe.Users.User

  -  IFP: add org.freedesktop.sssd.infopipe.Groups

  -  IFP: add org.freedesktop.sssd.infopipe.Groups.Group

  -  IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object]

  -  SBUS: Add support for <node /> in introspection

  -  IFP: Export nodes

  -  sbus: add support for incoming signals

  Pavel Reichl (20):

  -  LDAP/IPA: add user lookup by certificate

  -  ncache: add calls for certificate based searches

  -  utils: add get\_last\_x\_chars()

     <div>

      [RFE] Support for smart cards

      sssd: incorrect checks on length values during packet decoding

      [RFE] Start the dynamic DNS update after the SSSD has been setup for

      the first time

      Complain loudly if backend doesn't start due to missing or invalid

      keytab

      nested netgroups do not work in IPA provider

      test dyndns failed.

      Investigate using the krb5 responder for driving the PAM

      conversation with OTPs

      Pass error messages via the extdom plugin

      [RFE]Allow sssd to add a new option that would specify which server

      to update DNS with

      RFE: Support multiple interfaces with the dyndns\_iface option

      RFE: Add support for wildcard-based cache updates

      Add dualstack and multihomed support

      Too much logging

      TRACKER: Support one-way trusts for IPA

      Re-check memcache after acquiring the lock in the client code

      RFE: Support client-side overrides

      Add index for 'objectSIDString' and maybe to other cache attributes

      RFE: Don't mark the main domain as offline if SSSD can't connect to

      a subdomain

      RFE: Detect re-established trusts in the IPA subdomain code

      KDC proxy not working with SSSD krb5\_use\_kdcinfo enabled

      Group members are not turned into ghost entries when the user is

      purged from the SSSD cache

      sudoOrder not honored as expected

      Default to config\_file\_version=2

      GPO: PAM system error returned for PAM\_ACCT\_MGMT and offline mode

      GPO: Access denied due to using wrong sam\_account\_name

      SSSDConfig: wrong return type returned on python3

      krb5\_child should always consider online state to allow use of

      MS-KKDC proxy

      Logging messages from user point of view

      [RFE] Provide interface for SSH to fetch user certificate

      Initgroups memory cache does not work with fq names

      Initgroups mmap cache needs update after db changes

      well-known SID check is broken for NetBIOS prefixes

      SSSD keytab validation check expects root ownership

      IPA: returned unknown dp error code with disabled migration mode

      Missing config options in gentoo init script

      Could not resolve AD user from root domain

      getgrgid for user's UID on a trust client prevents getpw\*

      If AD site detection fails, not even ad\_site override skipped

      Do not send SSS\_OTP if both factors were entered separately

      searching SID by ID always checks all domains

      Don't use deprecated libraries (libsystemd-\*)

      sss\_override: add import and export commands

      Cannot build rpms from upstream spec file on rawhide

      When certificate is added via user-add-cert, it cannot be looked up

      via org.freedesktop.sssd.infopipe.Users.FindByCertificate

      memory cache can work intermittently

      cleanup\_groups should sanitize dn of groups

      the PAM srv test often fails on RHEL-7

      test\_memory\_cache failed in invalidation cache before stop

      Fix crash in nss responder

      Clear environment and set restrictive umask in p11\_child

      sss\_override does not work correctly when

      'use\_fully\_qualified\_names = True'

      sss\_override contains an extra parameter --debug but is not listed

      in the man page or in the arguments help

      [RFE] sssd: better feedback form constraint password change

      Test 'test\_id\_cleanup\_exp\_group' failed

      sssd cannot resolve user names containing backslash with ldap

      provider

      Make p11\_child timeout configurable

      Fix memory leak in GPO

      sss\_override : The local override user is not found

      REGRESSION: Dyndns soes not update reverse DNS records

      sss\_override --name doesn't work with RFC2307 and ghost users

      unit tests do not link correctly on Debian

      Memory leak / possible DoS with krb auth.

      AD: Conditional jump or move depends on uninitialised value

  .. raw:: html

  -  SYSDB: Add function to expire entry

  -  cleanup task: Expire all memberof targets when removing user

  -  CI: Add regression test for

  -  intg: Fix some PEP 8 violations

  -  PAM: Make p11\_child timeout configurable

  -  tests: Set p11\_child\_timeout to 30 in tests

  -  DATA\_PROVIDER: BE\_REQ as string in log message

  -  IPA PROVIDER: Resolve nested netgroup membership

  -  man: List alternative schema defaults for LDAP AutoFS parameters

     <div>

      warn if memcache\_timeout is greater than entry\_cache\_timeout

      Check chown\_debug\_file() usage

      Consider also disabled domains when link\_forest\_roots() is called

      extend PAM responder unit test

      Contribute and DevelTips are duplicate

      Long living applicantion can use removed memory cache.

      responder\_cache\_req-tests failed

      sss\_override: add find and show commands

      sbus\_codegen\_tests leaves a process running

      Review and update wiki pages for 1.13.2

      Create a wiki page that lists security-sensitive options

      SSSD is not closing sockets properly

      Relax POSIX check

      sss\_override segfaults when accidentally adding --help flag to some

      commands

      Size limit exceeded too loud during POSIX check

      CI: configure script failed on CentOS {6,7}

      sssd\_be crashed

      PAM responder crashed if user was not set

      avoid symlinks witih python modules

      CI: test\_ipa\_subdomains\_server failed on rhel6 + --coverage

      (FAIL: test\_ipa\_subdom\_server)

      sss\_override: memory violation

      bug in UPN lookups for subdomain users

      local overrides: don't contact server with overriden name/id

      REGRESSION: ipa-client-automout failed

      sssd crashes if non-UTF-8 locale is used

      IFP: ifp\_users\_user\_get\_groups doesn't handle non-POSIX groups

  .. raw:: html

     <div>

      [RFE] Unable to use AD provider for automount lookups

      convert sudo timer to be\_ptask

      sudo: reload hostinfo when going online

      Add Integration tests for local views feature

      get\_object\_from\_cache() does not handle services

      Review p11\_child hardening

      We should mention SSS\_NSS\_USE\_MEMCACHE in man sssd.conf(5) as

      well

      fix man page for sssd-ldap

      Check next certificate on smart card if first is not valid

      Smartcard login when certificate on the card is revoked and ocsp

      check enabled is not supported

      Try to suppress "Could not parse domain SID from [(null)]" for IPA

      users

      Inform about SSSD PAC timeout better

      AD provider and ignore\_group\_members=True might cause flaky group

      memberships

      sssd: [sysdb\_add\_user] (0x0400): Error: 17 (File exists)

  .. raw:: html

     <div>

      [RFE] Support Automatic Renewing of Kerberos Host Keytabs

      [RFE] SUDO: Support the IPA schema

      automatically assign new slices for any AD domain

      [RFE] IPA: resolve external group memberships of IPA groups during

      getgrnam and getgrgid

      Retry EPIPE from clients

      the colondb intreface has no unit tests

      ad\_site parameter does not work

      incompatibility between sparkleshare and sss\_ssh\_knownhostsproxy

      due to setlocale()

      sssd dereference processing failed : Input/output error

      collapse\_srv\_lookups frees fo\_server structure that is returned

      by fail over API

      Allow SSSD to notify user of denial due to AD account lockout

      cache\_req: don't search override values in LDAP when using LOCAL

      view

      sssd\_nss memory usage keeps growing on sssd-1.12.4-47.el6.x86\_64

      (RHEL6.7) when trying to retrieve non-existing netgroups

      MAN: Clarify that subdomains always use service discovery

      SRV lookups with id\_provider=proxy and auth\_provider=krb5

      [sssd] Trusted (AD) user's info stays in sssd cache for much more

      than expected.

      Review and update wiki pages for 1.13.4

      sssd\_be AD segfaults on missing A record

      Cannot retrieve users after upgrade from 1.12 to 1.13

      extreme memory usage in libnfsidmap sss.so plug-in when resolving

      groups with many members

      sssd mixup nested group from AD trusted domains

      refresh\_expired\_interval stops sss\_cache from working

      Properly remove OriginalMemberOf attribute in SSSD cache if user has

      no secondary groups anymore

      ID mapping - bug in computing max id for slice range

      Add gnome-screensaver to the list of PAM services considered for

      Smartcard authentication

      Warn if user cannot read krb5.conf

      After removing certificate from user in IPA and even after

      sss\_cache, FindByCertificate still finds the user

      sss\_obfuscate: SyntaxError: Missing parentheses in call to 'print'

      Cannot start sssd after switching to non-root

      The delete operation of the memberof plugin allocates memory on NULL

      context

      IPA view: view name not stored properly with default FreeIPA

      installation

      Initgroups in AD provider might fail if user is stored in a

      non-default ou

      GPO: Access denied in non-root mode

      GPO: Access denied after blocking connection to AD.

      sudorule not working with ipa sudo\_provider on older freeipa

      sudo smart refresh does not work correctly on openldap

      SSSD PAM module does not support multiple password prompts (e.g.

      Password + Token) with sudo

      IPA sudo: support the externalUser attribute

      sssd\_be[11010]: segfault at 0 ip 00007ff889ff61bb sp

      00007ffc7d66a3b0 error 4 in libsss\_ipa.so[7ff889fcf000+5d000]

      local overrides: issues with sub-domain users and mixed case names

  .. raw:: html