What's Changed
- tests: cover sssctl debug-level when SSSD is stopped and for PAC by @madhuriupadhye in #9362
- tests: Add tests for AD Forest multidomain and gpo tests by @jakub-vavra-cz in #9045
- SPEC: 'sssd-idp' requires 'libsss_idmap' by @alexey-tikhonov in #9403
- man: fix SEE ALSO punctuation after pam_sss by @asundark-tech in #9355
- certmap: check that SID exists in certificate by @thalman in #9408
- FreeBSD CI: Switch to 15.1-RELEASE by @arrowd in #9421
- tests: remove legacy intg test suite by @danlavu in #9078
- tests: collapse su/ssh parametrization in test_gpo.py by @danlavu in #9401
- tests: add autofs test for default autofs_provider behavior by @krishnavema in #9407
- nfs idmap: error out if buffer is too small by @sumit-bose in #9400
- PAM: clear state pointer before freeing state itself by @thalman in #9411
- test: fix missing cmocka prerequisite includes in test_nfsidmap.c by @pbrezina in #9441
- ldap: pwd_expire_policy_warn does not overwrite errors by @sumit-bose in #9393
- Tests: Convert remaining single-server ldap failover bash tests by @aborah-sudo in #9337
- sssctl: Improve the 'sssctl analyze' help output by @asakure in #9386
- tests:
test_ldap_password_policy.py::test_bz954323migration by @PetoSisan in #9402 - Man: fix sss_obfuscate(8) domain option and synopsis by @apeddire-wq in #9380
- krb5: filter AD host principals during TGT validation by @sumit-bose in #9381
- Treat shadowExpire=0 correctly by @thalman in #9442
- nss: guard against length underflow in packet by @justin-stephenson in #9463
- autofs: avoid leaked enumeration contexts after map by @justin-stephenson in #9464
- Add AD certificate authentication test by @krishnavema in #8453
- pam: keep preauth indicator for socket activation by @Apollo3zehn in #9399
- oidc_child: escape single quotes in Entra ID OData filters by @pbrezina in #9471
- 'autofs' CVE fixes by @alexey-tikhonov in #9486
- Tests: multihost ldap password policy fixes by @spoore1 in #9419
- tests: clear sssd cache in teardown of AD idmap range tests by @spoore1 in #9412
- IDP: Clean old items from open_request_table by @thalman in #9481
- autofs: add 'allowed_uids' option to the autofs responder by @alexey-tikhonov in #9489
- New
SSS_NSS_GETORIGBYUSERNAME_WITH_GROUPS'sss_client' command by @alexey-tikhonov in #8800 - ci: move system tests from Github Actions to Testing Farm by @pbrezina in #9304
- PAM/Authtok vulnerability fixes by @justin-stephenson in #9446
- Fix: Preserve explicitly set 'none' provider values by @rakkumar607 in #9420
- responder: back off accept() on fd exhaustion to stop busy-spin by @pbrezina in #9507
- ipa: compare users with domain awareness against HBAC rules by @pbrezina in #9508
- tests: wait for DNS resolve failure before checking logs by @madhuriupadhye in #9529
- kcm: prune per-connection credential cache on DESTROY by @pbrezina in #9514
- man: krb5_ccachedir is no longer created by SSSD by @kaushikub in #9539
- tests:
test_ldap_password_policy.py::test_maxagemigration by @PetoSisan in #9513 - kcm: do not hang on empty request message body by @pbrezina in #9530
- Add options to exclude UID and GID by @aplopez in #9515
- pam: offer local Smartcard authentication to GDM switchable authentication by @divinehawk in #9368
- ci: remove sssd db prior restarting it on ipa container by @pbrezina in #9562
- Fix ldap_use_ppolicy name in LDAP ppolicy test docstring by @rakkumar607 in #9568
- Tests/remove converted multihost by @madhuriupadhye in #9576
- PAM: Stop treating gdm-password as a Smartcard-capable service by @joantolo in #9493
- tests: fix false positive journal check for ldap_sudo_search_base war… by @madhuriupadhye in #9519
- lock session when smartcard removed (when gdm-switchable-auth is used too) by @joantolo in #9516
- CVE-2026-104041: another take (2) by @alexey-tikhonov in #9585
- po: update translations by @alexey-tikhonov in #9598
New Contributors
- @asundark-tech made their first contribution in #9355
- @apeddire-wq made their first contribution in #9380
- @Apollo3zehn made their first contribution in #9399
- @kaushikub made their first contribution in #9539
- @divinehawk made their first contribution in #9368
Full Changelog: 2.14.0-beta1...2.14.0-beta2