github SSSD/sssd 2.13.2
sssd-2.13.2
on GitHub

3 hours ago

See full release notes here.

What's Changed

  • [autobackport: sssd-2-13] ci: update passkey TMT plan for native CentOS Stream 10 execution by @sssd-bot in #8787
  • [autobackport: sssd-2-13] sssd man-page: Add reference to FAILOVER section by @sssd-bot in #8795
  • [autobackport: sssd-2-13] tests: fixing mypy linting errors by @sssd-bot in #8772
  • [autobackport: sssd-2-13] Make: don't compile 'oidc_child_get_jwk.c' by @sssd-bot in #8810
  • [autobackport: sssd-2-13] Update/autoskip tests in image mode. by @sssd-bot in #8809
  • [autobackport: sssd-2-13] Tests: Switch tests using ldap adparameters ported to ldifde by @sssd-bot in #8818
  • Tests: LDAP+KRB5 krb_misc tests by @madhuriupadhye in #8655
  • [autobackport: sssd-2-13] ci: Clear cache before installing built rpms by @sssd-bot in #8828
  • [autobackport: sssd-2-13] ci: Remove dnf workaround during rpm install by @sssd-bot in #8834
  • [autobackport: sssd-2-13] tests: updating pysss_nss_idmap error with more detail by @sssd-bot in #8839
  • [autobackport: sssd-2-13] oidc_child: change default with no auth method by @sssd-bot in #8851
  • [autobackport: sssd-2-13] mh-tests: fix GSSAPI SSH test setup for krb5_confd_path by @sssd-bot in #8856
  • [autobackport: sssd-2-13] Tests: Adding flaky marker to retry GDM critical by @sssd-bot in #8860
  • [autobackport: sssd-2-13] PAM: fix use-after-free during p11_child processing by @sssd-bot in #8865
  • [autobackport: sssd-2-13] sssd man-page: Improve FILE FORMAT section by @sssd-bot in #8868
  • [autobackport: sssd-2-13] cfg_rules: allow ldap_sasl_authid/ldap_krb5_keytab/krb5_keytab by @sssd-bot in #8870
  • FreeBSD CI: Chase the Python 3.12 switch by @arrowd in #8890
  • [autobackport: sssd-2-13] ci: bump cross-platform-actions/action from 1.2.0 to 1.3.0 by @sssd-bot in #8882
  • [autobackport: sssd-2-13] ci: bump actions/checkout from 6 to 7 by @sssd-bot in #8887
  • [autobackport: sssd-2-13] Pkcs11 soft ocsp tests by @sssd-bot in #8757
  • [autobackport: sssd-2-13] gpo: reject path traversal in gPCFileSysPath by @sssd-bot in #8907
  • [autobackport: sssd-2-13] sudo: warn when ldap_sudo_search_base falls back to root DN by @sssd-bot in #8912
  • [autobackport: sssd-2-13] man: Replace ldap_opt_timout -> ldap_opt_timeout by @sssd-bot in #8918
  • [autobackport: sssd-2-13] man: Replace bool -> boolean across sssd man-pages by @sssd-bot in #8922
  • [autobackport: sssd-2-13] man: Add Default for vetoed_shells in sssd.conf(5) by @sssd-bot in #8920
  • [autobackport: sssd-2-13] tests: improving offline authentication tests by @sssd-bot in #8925
  • [autobackport: sssd-2-13] Tests: skip nonposix nested test for older sssd by @sssd-bot in #8938
  • [autobackport: sssd-2-13] man: Correct default for ldap_user_nds_login_expiration_time and ldap_host_object_class options by @sssd-bot in #8941
  • [autobackport: sssd-2-13] Tests: add ldap_sudo_search_base warning test by @sssd-bot in #8967
  • Tests: Fix formatting issues in test_ldap_krb5.py by @madhuriupadhye in #8977
  • [autobackport: sssd-2-13] CI: don't specify 'push:'/'pull_request:' branches by @sssd-bot in #8975
  • ci: drop 'analyze-target.yml' by @alexey-tikhonov in #8984
  • [autobackport: sssd-2-13] ci: serialize make distcheck by @sssd-bot in #9001
  • [autobackport: sssd-2-13] tests: Update ds tests to rely less on hostname by @sssd-bot in #9010
  • [autobackport: sssd-2-13] KCM: fix TGT renewal use-after-free and stabilize test by @sssd-bot in #9019
  • CI: sssd-2-13: limit 'systems' tests to f-43/c10s by @alexey-tikhonov in #9021
  • [autobackport: sssd-2-13] Multihost tests ldap fix by @sssd-bot in #9026
  • [autobackport: sssd-2-13] adding dynamic dns tests by @sssd-bot in #8995
  • [autobackport: sssd-2-13] tests: Fix regex warnings by @sssd-bot in #9061
  • [autobackport: sssd-2-13] Tests: use client IP instead of sys_hostname for SSH login by @sssd-bot in #9066
  • [autobackport: sssd-2-13] tests: remove multihost tests covered by system tests by @sssd-bot in #9070
  • [autobackport: sssd-2-13] ci: bump actions/setup-python from 6 to 7 by @sssd-bot in #9075
  • [autobackport: sssd-2-13] Ad stig 1 by @sssd-bot in #9123
  • [autobackport: sssd-2-13] tests: adding gpo test case for traversal bug by @sssd-bot in #9102
  • [autobackport: sssd-2-13] ci: Swap flake and isort for ruff and reorder jobs by @sssd-bot in #9133
  • [autobackport: sssd-2-13] tests: add GPO regression tests for local group collision and verbose Samba logging by @sssd-bot in #9127
  • [autobackport: sssd-2-13] pam: Forward environment variables from PAM client to p11_child by @sssd-bot in #9138
  • [autobackport: sssd-2-13] sudo: don't warn about search base when it was set by provider by @sssd-bot in #9098
  • [autobackport: sssd-2-13] tests: Fix test used in c-ares gating to be more resilient by @sssd-bot in #9150
  • [autobackport: sssd-2-13] pam_sss: cast to GdmPamExtensionMessage in binary prompt macro by @sssd-bot in #9164
  • [autobackport: sssd-2-13] FreeBSD CI: Explicitly pass --datadir and --sysconfdir to configure by @sssd-bot in #9167
  • [autobackport: sssd-2-13] test_kcm: use config_apply instead of start to avoid proxy domain auth issue by @sssd-bot in #9174
  • [autobackport: sssd-2-13] ci: Fix duplicated python-system-tests in static-code-analysis.yml by @sssd-bot in #9181
  • [autobackport: sssd-2-13] tests: add sudo search base warning suppression test by @sssd-bot in #9141
  • [autobackport: sssd-2-13] Fix FTBFS with GDM 51 PAM extension headers by @sssd-bot in #9199
  • CI 2-10/12/13: use 'centos-10' for 'make-distcheck' by @alexey-tikhonov in #9201
  • [autobackport: sssd-2-13] ci: workaround PR CI issues on ubuntu-24-04 by @sssd-bot in #9208
  • [autobackport: sssd-2-13] NSS: fix initgroups packet heap disclosure by @sssd-bot in #9217
  • [autobackport: sssd-2-13] pam: validate auth_token_length in extract_authtok_v1() by @sssd-bot in #9215
  • [autobackport: sssd-2-13] nss: validate addrlen in sss_nss_protocol_parse_addr() by @sssd-bot in #9216
  • [autobackport: sssd-2-13] Remove obsolete entry_cache_computer_timeout option by @sssd-bot in #9222
  • [autobackport: sssd-2-13] fix(docs): repair malformed quote tag in Spanish sssd-ifp.5 translation by @sssd-bot in #9223
  • [autobackport: sssd-2-13] Tests: add socket activation tests for all-responder and sudo scenarios by @sssd-bot in #9229
  • [autobackport: sssd-2-13] tests: migrates sss_override per-user home override test into the new test framework by @sssd-bot in #9234
  • [autobackport: sssd-2-13] tests: removes legacy test testing tevent C library by @sssd-bot in #9255
  • [autobackport: sssd-2-13] tests: convert multihost failover and connection timeout tests to sys… by @sssd-bot in #9244
  • [autobackport: sssd-2-13] Man: Remove note about obsolete option ipa_dyndns_iface by @sssd-bot in #9261
  • [autobackport: sssd-2-13] IDP: fix user matching in eval_access_token_buf() by @sssd-bot in #9258
  • [autobackport: sssd-2-13] Man page sssd_ad improvements by @sssd-bot in #9273
  • [autobackport: sssd-2-13] Test: add sssd conf backup to test_0002_1736796 by @sssd-bot in #9266
  • [autobackport: sssd-2-13] tests: remove tevent_loop.c by @sssd-bot in #9271
  • [autobackport: sssd-2-13] tests: convert cached_auth_timeout bash tests to system tests by @sssd-bot in #9239
  • [autobackport: sssd-2-13] Man: Improvement in max_ccache_size parameter by @sssd-bot in #9278
  • [autobackport: sssd-2-13] man: Fix filter_users_in_groups and pam_gssapi_check_upn options. by @sssd-bot in #9279
  • [autobackport: sssd-2-13] ci: bump vapier/coverity-scan-action from 1.8.0 to 1.9.0 by @sssd-bot in #9289
  • [autobackport: sssd-2-13] ci: bump cross-platform-actions/action from 1.3.0 to 1.5.0 by @sssd-bot in #9288
  • [autobackport: sssd-2-13] tests: migrate KCM to system tests by @sssd-bot in #9283
  • [autobackport: sssd-2-13] ci: Dont run system tests for man page only PRs by @sssd-bot in #9293
  • [autobackport: sssd-2-13] Man: Improve description for selinux_provider option by @sssd-bot in #9302
  • [autobackport: sssd-2-13] tests: test_ldap_password_policy.py migration: remove test_bz1146198_bz1144011 by @sssd-bot in #9300
  • [autobackport: sssd-2-13] tests: convert sudo offline and full_refresh bash tests to system tests by @sssd-bot in #9309
  • [autobackport: sssd-2-13] tests: convert offline auth bash tests to system tests by @sssd-bot in #9312
  • [autobackport: sssd-2-13] ipa: error out during issues reading IPA configuration by @sssd-bot in #9316
  • [autobackport: sssd-2-13] Tests: Convert ldap failover uri list bash tests to system tests by @sssd-bot in #9336
  • [autobackport: sssd-2-13] Man: Fix krb5_use_fast demand option description by @sssd-bot in #9344
  • [autobackport: sssd-2-13] Emit journal alert about ldap_sudo_search_base only if sudo provider is enabled by @sssd-bot in #9342
  • [autobackport: sssd-2-13] Servicemap by @sssd-bot in #9354
  • [autobackport: sssd-2-13] Tests: multihost change passwd setting for STIG by @sssd-bot in #9350
  • [autobackport: sssd-2-13] LDAP: fix fail-open in ppolicy access check on zero results by @sssd-bot in #9364
  • [autobackport: sssd-2-13] PAM: avoid NULL deref when service item is missing by @sssd-bot in #9366
  • [autobackport: sssd-2-13] tests: test_ldap_password_policy.py::test_bz748856 migration by @sssd-bot in #9360
  • [autobackport: sssd-2-13] NSS: reject empty request body before body[blen - 1] access by @sssd-bot in #9379
  • [autobackport: sssd-2-13] PAM: fix out-of-bounds read in v1 request parser by @sssd-bot in #9375
  • [autobackport: sssd-2-13] SYSDB: sanitize SID string in sysdb_search_entry_by_sid_str() by @sssd-bot in #9377
  • [autobackport: sssd-2-13] test rewrite: legacy intg test_pam_responder.py - BOTH BATCHES by @sssd-bot in #9155
  • [autobackport: sssd-2-13] tests: Add tests for AD Forest multidomain and gpo tests by @sssd-bot in #9398
  • [autobackport: sssd-2-13] Fixes missed microsoft graph hardcode url and switch to batching group id requests by @sssd-bot in #9387
  • [autobackport: sssd-2-13] SPEC: 'sssd-idp' requires 'libsss_idmap' by @sssd-bot in #9404
  • [autobackport: sssd-2-13] man: fix SEE ALSO punctuation after pam_sss by @sssd-bot in #9406
  • [autobackport: sssd-2-13] certmap: check that SID exists in certificate by @sssd-bot in #9410
  • [autobackport: sssd-2-13] sssd-ipa man: Improvement in sssd-ipa(5) man-page by @sssd-bot in #9413
  • [autobackport: sssd-2-13] man: fix doubled "are" in sssd-ldap(5) by @sssd-bot in #9416
  • [autobackport: sssd-2-13] man: fix TENNANT-ID typo in sssd-idp(5) example by @sssd-bot in #9417
  • [autobackport: sssd-2-13] man: fix YOUR-CLIENT-SCERET typo in sssd-idp(5) by @sssd-bot in #9422
  • [autobackport: sssd-2-13] FreeBSD CI: Switch to 15.1-RELEASE by @sssd-bot in #9424
  • [autobackport: sssd-2-13] tests: remove legacy intg test suite by @sssd-bot in #9430
  • [autobackport: sssd-2-13] tests: cover sssctl debug-level when SSSD is stopped and for PAC by @sssd-bot in #9392
  • [autobackport: sssd-2-13] PAM: clear state pointer before freeing state itself by @sssd-bot in #9440
  • [autobackport: sssd-2-13] man: Add note about description/debug* for [session_recording] by @sssd-bot in #9414
  • [autobackport: sssd-2-13] tests: collapse su/ssh parametrization in test_gpo.py by @sssd-bot in #9434
  • [autobackport: sssd-2-13] nfs idmap: error out if buffer is too small by @sssd-bot in #9438
  • [autobackport: sssd-2-13] ldap: pwd_expire_policy_warn does not overwrite errors by @sssd-bot in #9445
  • [autobackport: sssd-2-13] Tests: Convert remaining single-server ldap failover bash tests by @sssd-bot in #9456
  • [autobackport: sssd-2-13] tests: test_ldap_password_policy.py::test_bz954323 migration by @sssd-bot in #9455
  • [autobackport: sssd-2-13] Fix: Remove an orphaned include local.xml by @sssd-bot in #9457
  • [autobackport: sssd-2-13] cfg_rules: add pwfield to allowed_domain_options by @sssd-bot in #9458
  • [autobackport: sssd-2-13] fix potential memory leak by @sssd-bot in #9461
  • [autobackport: sssd-2-13] sssctl: Improve the 'sssctl analyze' help output by @sssd-bot in #9450
  • [autobackport: sssd-2-13] krb5: filter AD host principals during TGT validation by @sssd-bot in #9468
  • [autobackport: sssd-2-13] oidc_child: Fix logic error and URL-encode short_name in Keycloak lookup by @sssd-bot in #9472
  • [autobackport: sssd-2-13] krb5: Fix logic error in OAuth2 code verification by @sssd-bot in #9475
  • [autobackport: sssd-2-13] IPA: memory leak fixed by @sssd-bot in #9465
  • [autobackport: sssd-2-13] nss: fix potential memory leak if packet grow fails by @sssd-bot in #9466
  • [autobackport: sssd-2-13] ipa: fix memory leak in ipa_s2n_get_list iteration by @sssd-bot in #9480
  • Plug memory leak: add missing dbus_message_unref by @alexey-tikhonov in #9473
  • [autobackport: sssd-2-13] autofs: avoid leaked enumeration contexts after map by @sssd-bot in #9479
  • [autobackport: sssd-2-13] nss: guard against length underflow in packet by @sssd-bot in #9477
  • [autobackport: sssd-2-13] Treat shadowExpire=0 correctly by @sssd-bot in #9470
  • [autobackport: sssd-2-13] pam: keep preauth indicator for socket activation by @sssd-bot in #9488
  • [autobackport: sssd-2-13] Add AD certificate authentication test by @sssd-bot in #9485
  • [autobackport: sssd-2-13] 'autofs' CVE fixes by @sssd-bot in #9495
  • [autobackport: sssd-2-13] oidc_child: escape single quotes in Entra ID OData filters by @sssd-bot in #9492
  • [autobackport: sssd-2-13] autofs: add 'allowed_uids' option to the autofs responder by @sssd-bot in #9512
  • [autobackport: sssd-2-13] Tests: multihost ldap password policy fixes by @sssd-bot in #9500
  • [autobackport: sssd-2-13] tests: clear sssd cache in teardown of AD idmap range tests by @sssd-bot in #9505
  • [autobackport: sssd-2-13] IDP: Clean old items from open_request_table by @sssd-bot in #9510
  • [autobackport: sssd-2-13] PAM/Authtok vulnerability fixes by @sssd-bot in #9528
  • [autobackport: sssd-2-13] ci: move system tests from Github Actions to Testing Farm by @sssd-bot in #9525
  • [autobackport: sssd-2-13] Fix: Preserve explicitly set 'none' provider values by @sssd-bot in #9532
  • [autobackport: sssd-2-13] tests: wait for DNS resolve failure before checking logs by @sssd-bot in #9543
  • [autobackport: sssd-2-13] responder: back off accept() on fd exhaustion to stop busy-spin by @sssd-bot in #9536
  • [autobackport: sssd-2-13] man: krb5_ccachedir is no longer created by SSSD by @sssd-bot in #9552
  • [autobackport: sssd-2-13] kcm: prune per-connection credential cache on DESTROY by @sssd-bot in #9545
  • [autobackport: sssd-2-13] ipa: compare users with domain awareness against HBAC rules by @sssd-bot in #9538
  • [autobackport: sssd-2-13] tests: test_ldap_password_policy.py::test_maxage migration by @sssd-bot in #9559
  • [autobackport: sssd-2-13] kcm: do not hang on empty request message body by @sssd-bot in #9561
  • [autobackport: sssd-2-13] Add options to exclude UID and GID by @sssd-bot in #9564
  • [autobackport: sssd-2-13] Man: fix sss_obfuscate(8) domain option and synopsis by @sssd-bot in #9460
  • [autobackport: sssd-2-13] Fix ldap_use_ppolicy name in LDAP ppolicy test docstring by @sssd-bot in #9575
  • [autobackport: sssd-2-13] ci: remove sssd db prior restarting it on ipa container by @sssd-bot in #9572
  • [autobackport: sssd-2-13] Tests/remove converted multihost by @sssd-bot in #9582
  • [autobackport: sssd-2-13] pam: offer local Smartcard authentication to GDM switchable authentication by @sssd-bot in #9566
  • [autobackport: sssd-2-13] PAM: Stop treating gdm-password as a Smartcard-capable service by @sssd-bot in #9589
  • [autobackport: sssd-2-13] CVE-2026-104041: another take (2) by @sssd-bot in #9596
  • [autobackport: sssd-2-13] lock session when smartcard removed (when gdm-switchable-auth is used too) by @sssd-bot in #9595
  • [autobackport: sssd-2-13] krb5_timestamp related fixes by @sssd-bot in #9603
  • [autobackport: sssd-2-13] drop dyndns_refresh_interval from test_dyndns.py by @sssd-bot in #9601
  • [autobackport: sssd-2-13] SDAP: Parse each attribute of an entry in message order by @sssd-bot in #9608
  • [autobackport: sssd-2-13] ldap: retry TLS handshake on timeout by @sssd-bot in #9609

Full Changelog: 2.13.1...2.13.2

Check out latest releases or
releases around SSSD/sssd 2.13.2

Don't miss a new sssd release

NewReleases is sending notifications on new releases.

Get notifications