SSSD 2.4.0

Highlights

• libnss support was dropped, SSSD now supports only openssl cryptography

New features

• Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options)
• Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery

Packaging changes

• python2 bindings are disable by default, use --with-python2-bindings to build it

Documentation Changes

• Default value of client_idle_timeout changed from 60 to 300 seconds for KCM, this allows more time for user interaction (e.g. during kinit)
• Added exclude_users and exclude_groups option to session_recording section, this allows to exclude user or groups from session recording when scope is set to all
• Added ldap_library_debug_level option to enable debug messages from libldap
• Added dyndns_auth_ptr to set authentication mechanism for PTR DNS records update
• Added ad_allow_remote_domain_local_groups to be compatible with other solutions

See full release notes here.