[Pkg-sssd-devel] [Git][sssd-team/sssd][upstream] 213 commits: removing netgroup intg test
Timo Aaltonen (@tjaalton)
gitlab at salsa.debian.org
Mon Aug 3 08:09:49 BST 2026
Timo Aaltonen pushed to branch upstream at Debian SSSD packaging / sssd
Commits:
ab7a7f43 by Dan Lavu at 2026-01-15T12:02:38-06:00
removing netgroup intg test
Reviewed-by: Scott Poore <spoore at redhat.com>
- - - - -
6afffacf by Pavel Březina at 2026-01-16T10:00:24+00:00
Update version in version.m4 to track the next release
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
- - - - -
8b0071c6 by aborah-sudo at 2026-01-16T14:03:50+01:00
Tests: Handle SELinux in proxy provider tests
Tests using nslcd fail under SELinux enforcing due to missing
policies for test-only nss-pam-ldapd configuration. Add context
manager to temporarily set permissive mode for affected tests.
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
- - - - -
e73250b1 by Alexey Tikhonov at 2026-01-19T12:17:58+00:00
SPEC: since Fedora 44 Samba provides dedicated 'samba-ndr-libs' package
with libraries needed by 'sssd-ipa'.
Note that 'sssd-ad' still needs 'samba-client-libs'
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
ee081e11 by Alexey Tikhonov at 2026-01-19T15:51:48+00:00
SBUS: increase SBUS_MESSAGE_TIMEOUT to 5 mins
Handling BE_REQ_INITGROUPS for LDAP user with 10k groups takes longer
than 2 mins.
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
7762901c by Alexey Tikhonov at 2026-01-19T15:51:48+00:00
RESPONDER: fixed an issue with 'client_idle_timer'
As it was implemented previously, effective period was 1.5*client_idle_timeout
instead of `client_idle_timeout` as documented.
Log with default value - 60 - before a fix:
```
(:49:12): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x557af16f31b0][22]
(:49:42): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x557af16f31b0][22]
(:50:12): [nss] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x557af16f31b0][22]
(:50:42): [nss] [client_idle_handler] (0x2000): Terminating idle client [0x557af16f31b0][22]
```
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
96829a00 by Justin Stephenson at 2026-01-19T10:15:23-06:00
tests: python black 26.1.0 style changes
Adapt to changes from https://github.com/psf/black/releases/tag/26.1.0
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Scott Poore <spoore at redhat.com>
- - - - -
f8c281cf by Scott Poore at 2026-01-19T11:03:15-06:00
Tests: Add GDM Smartcard tests
- - - - -
d78e3267 by Scott Poore at 2026-01-19T11:03:15-06:00
Tests: gdm passkey fixes for timing issues in c10s
Also removing unused GenericProvider references and update some
docstrings.
- - - - -
7f78c93f by Scott Poore at 2026-01-19T11:03:15-06:00
Tests: rename and update test_gdm to xidp
Renaming test_gdm.py to test_gdm_xidp.py to align with the other
test_gdm_* test modules.
Also adding authselect for with-switchable-auth which is needed to
configure the system for GDM to use the new switchable authentication
mechanisms.
- - - - -
35e32b77 by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
UTILS: comment fixed
'child_common.c' was renamed to 'child_handlers.c' in 8bddb6a510c3c1a88e31d43c6b1c66709be53193
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
743b8d33 by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
Makefile: 'libsss_child' doesn't need to be part of 'libsss_util'
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
704f3633 by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
Makefile: don't link against 'KEYUTILS_LIBS'
where it's not needed
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
25dcf242 by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
UTILS: get rid of 'selinux.c'
It's not used since 15a22136e19f192c03758c21fa8e48697fa16857
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
2112b6eb by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
Makefile: removed some duplicates
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
8d376e8c by Alexey Tikhonov at 2026-01-20T11:01:44+00:00
Makefile: `libsss_crypt` doesn't need `libdhash`
`SSS_CRYPT_*` vars also do not make much sense.
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
f2a4ce27 by Gleb Popov at 2026-01-20T17:54:11+00:00
FreeBSD CI: Switch to FreeBSD 15
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
46fb30ab by Gleb Popov at 2026-01-20T17:54:11+00:00
FreeBSD CI: Enable testing and run the build with -j
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
165f5112 by Gleb Popov at 2026-01-20T17:54:11+00:00
FreeBSD CI: Remove the timezone patch for FreeBSD 14 and add another one
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
af8ef967 by Gleb Popov at 2026-01-20T17:54:11+00:00
Use portable shebangs in tests scripts
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
308bacbd by Gleb Popov at 2026-01-20T17:54:11+00:00
Skip whitespace and double semicolon tests on FreeBSD
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
26350606 by Gleb Popov at 2026-01-20T17:54:11+00:00
FreeBSD CI: Add some more deps and make configure flags match what our port does
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
d78f89cd by Gleb Popov at 2026-01-20T17:54:11+00:00
test_responder_common.c: Use correct value to check against
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
e4eb8bdc by Gleb Popov at 2026-01-20T17:54:11+00:00
test_pam_srv: Use more random UIDs/GIDs for the test
On FreeBSD the UID 123 corresponds to the built-in ntpd user and the machine
that runs this test may be running the ntpd daemon.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
7d8e3c33 by Pavel Březina at 2026-01-21T14:44:52+01:00
scripts: fetch branch before checkout in release script
actions/checkout does a sparse clone by default so the branch may not
be yet available.
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
0fc52802 by Timo Eisenmann at 2026-01-22T10:56:59+01:00
Add OAuth2 prompting config
:config: New options to customize the OAuth2 prompting behavior:
`interactive` and `interactive_prompt`.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
870619c4 by Timo Eisenmann at 2026-01-22T10:56:59+01:00
sss_client: deduplicate string copying in pc_list_from_response
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
a50a9529 by Timo Eisenmann at 2026-01-22T10:56:59+01:00
Add test for OAuth2 prompting config
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
dd3cd958 by Iker Pedrosa at 2026-01-24T10:39:59+00:00
krb5_child: fix enterprise principal parsing in keep-alive sessions
When keep-alive sessions transition between command types (e.g., from
SSS_PAM_PREAUTH to SSS_PAM_AUTHENTICATE), enterprise principal settings
were not being updated, causing parsing inconsistencies in complex AD
environments.
This change ensures that when the backend sends updated enterprise
principal settings for different command types, the principals are
correctly re-parsed with the appropriate flags, fixing UPN handling in
multi-domain AD environments.
Signed-off-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
f95f64f5 by Alexey Tikhonov at 2026-01-27T16:08:16+00:00
CONFIG: allow 'ldap_subuid_*' attrs
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
4ca8bb65 by Sumit Bose at 2026-01-29T15:27:38+00:00
pam_sss: change PAM message type for PIN locked
To make sure GDM can display this message together with an
authentication failed error message the PAM message type has to be the
same.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
bc3ad168 by Sumit Bose at 2026-01-29T15:27:38+00:00
krb5: check for PIN locked in error message
Currently the PIN locked message is only displays if the Smartcard
authentication is done locally, e.g. if the system is offline. During
pkinit libkrb5 does not send a dedicated error code but the error
message generated by the library contains a hint.
This patch checks the libkrb5 error message in case the authentication
fails with the pre-authentication failed error code. This is a bit
tricky because 'krb5_get_error_message()' currently only returns a
defined result at the first call after a failed library call.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
498974b8 by Alexey Tikhonov at 2026-01-30T09:30:09+00:00
RESPONDER: fix `responder_set_fd_limit()`
to not even try setting hard limit as SSSD never has CAP_SYS_RESOURCE
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
308af8f2 by Gleb Popov at 2026-01-31T10:02:03+00:00
platform.m4: Fix case when we have to source /etc/os-release
When sourcing this file it may overwrite the VERSION shell variable, which
in turn end up being used for @VERSION@ substitutions in various .in files.
While here, make sure we always set $osname to something sensible too.
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
a7fb8437 by Alexey Tikhonov at 2026-02-03T11:12:52+00:00
PO: remove stray </arg> from translation
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
af5fbd52 by Alexey Tikhonov at 2026-02-03T11:12:52+00:00
PO: add missing <placeholder ...> tag
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
29a8731d by Alexey Tikhonov at 2026-02-03T12:34:38+00:00
Fix libini_config related includes.
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
ee42c35d by Alexey Tikhonov at 2026-02-03T12:34:38+00:00
INI: get rid of useless macros
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
ade61ef1 by Alexey Tikhonov at 2026-02-03T12:34:38+00:00
INI: use proper deallocators
This also allows to avoid inclusion of 'ini_config.h'
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
4e89caeb by Pavel Březina at 2026-02-03T18:33:38+01:00
errors: add ERR_SERVER_FAILURE
To indicate server communication error.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
cc42932a by Pavel Březina at 2026-02-03T18:33:38+01:00
sdap: remove be context from sdap_cli_connect code
This is a steps towards new implementation of new failover mechanism.
The new code will reuse sdap_cli_connect to connect to the LDAP server
but it will not use any be resolver stuff. This patch moves be resolver
usage one level up so the connection code can be easily reused.
It also moves kinit before connecting to LDAP into a separate,
standalone step (previously it was connect -> kinit -> sasl bind,
now it is kinit -> connect -> sasl bind).
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
07401d62 by Jakub Vávra at 2026-02-05T20:51:50+01:00
Test: Update misc ipa tests to work correctly on stig
The custom ssh library previously used in the tests does not work
correctly on stig as the test are testing sudo, replacing ssh
with su to switch user.
- - - - -
003c591a by Alexey Tikhonov at 2026-02-06T08:36:50+00:00
CHILD HELPERS: use less severe debug level
if `child_sig_handler()` is called for unknown pid.
If there are N handlers registered and 1 child process exists,
all N handlers will be invoked, and N-1 of them will get
`waitpid() == 0`.
It would be possible to have a single handler registed that would
manage a list (or hash table) of `sss_child_ctx`, but it still
would have to perform N `waitpid()` calls (`waitpid(-1)` can't
be used to avoid handling "foreign" process) so complexity overhead
doesn't worth it.
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
bcd9998f by Sumit Bose at 2026-02-06T11:56:18+00:00
man: add details about 'an2ln'
With a recent security fix the 'an2ln' module was disabled in SSSD's
configuration snippet for the localauth configuration of libkrb5. With
this patch the related man page is update accordingly.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
0458e655 by Dan Lavu at 2026-02-06T14:19:43+00:00
updating subid test case to test provider_ldap config
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
- - - - -
ad173e05 by Sumit Bose at 2026-02-17T08:46:21+00:00
sdap: do not require GID for non-POSIX group
In 85b632d130d126861bda7472f7a7ae301e70c098 the attribute for the GID
was removed from non-POSIX groups. Currently sdap_save_group() still
requires the attribute and this patch removes this.
sdap_save_group() is currently only used in the code path handling
nested groups. To verify the change a test was added were indirect
group-members are coming from a nested non-POSIX group.
Resolves: https://github.com/SSSD/sssd/issues/8441
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
09e283e2 by Alexey Tikhonov at 2026-02-17T15:56:17+00:00
SDAP: use `DEBUG_CONDITIONAL` in hot path
Both `perf` and manual measurement confirms ~6..8% perf gain
in the test case:
- INITGROUPS lookup for a user that is a member of 5k groups,
no groups were cached;
- debug_level = 3
- debug_microseconds = true
Note `debug_microseconds = true` - without this setting impact isn't
that dramatic.
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
9a2cf212 by Alexey Tikhonov at 2026-02-17T15:56:17+00:00
UTIL: `sss_tc_utf8_str_tolower()` optimization
In vast majority of cases strings are ascii and lowercase.
In other cases overhead added should be negligible.
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
a5b77e42 by Alexey Tikhonov at 2026-02-17T15:56:17+00:00
UTIL: `sss_create_internal_fqname()` optimization (caching)
This helper is heavily used, including in hot paths.
Since number of domains used is very limited, hash table used for caching
should be very small and lookup much more efficient as compared with
`sss_tc_utf8_str_tolower()`
Assisted-by: Claude Code (Opus 4.6)
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
15719461 by aborah-sudo at 2026-02-18T08:32:22+00:00
tests: reorganize infopipe tests by interface
Group the infopipe tests into logical sections based on the D-Bus
interface they exercise:
- Infopipe (root object)
- Domains
- Users
- Groups
- Mixed/Combined interfaces
This is a pure reorganization with no logic changes to improve test
maintainability and readability.
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar at redhat.com>
- - - - -
b4336056 by squiddim at 2026-02-19T14:42:08+00:00
systemd: relaunch sssd after unclean exit
Resolves: #6219
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
- - - - -
d87b96f1 by Justin Stephenson at 2026-02-19T14:53:11+00:00
ci: Skip GPG checks when installing rawhide sssd rpms
At this time, workaround rawhide dnf issue causing failed install
Total size of inbound packages is 11 MiB. Need to download 0 B.
After this operation, 30 MiB extra will be used (install 40 MiB, remove 10 MiB).
Running transaction
Transaction failed: Rpm transaction failed.
Warning: skipped OpenPGP checks for 60 packages from repository: @commandline
- package sssd-2.13.0-0.fc45.x86_64 does not verify: no signature
- package sssd-common-2.13.0-0.fc45.x86_64 does not verify: no signature
...
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
- - - - -
2de37515 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
UTIL: fix discarded-qualifiers warning in domain_to_basedn()
Use a separate `const char *dot` variable for the strchr() result
on the const input string, keeping the mutable `char *p` for the
later iteration over the output buffer.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
5548493c by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
SDAP: fix discarded-qualifiers warning in are_sids_from_same_dom()
Make rid1 and rid2 `const char *` since they only hold strrchr()
results from const input strings and are used for pointer arithmetic.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
ef104b78 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
SDAP: fix discarded-qualifiers warnings in sdap_parse_range()
Make endptr and end_range `const char *` since they only hold
strchr()/strrchr() results from const input strings. Introduce a
separate `numendptr` variable for the strtouint32() output parameter.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
086a52e5 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
SDAP: fix discarded-qualifiers warning in split_extra_attr()
Make sep `const char *` since it only holds a strchr() result
from a const input string and is used for pointer arithmetic.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
0f21660d by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
AD: fix discarded-qualifiers warnings in ad_access filter parsing
Make specdelim and kwdelim `const char *` in parse_sub_filter() and
parse_filter() since they only hold strchr() results from const
input strings and are used for pointer arithmetic.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
24de2bc0 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
CERTMAP: fix discarded-qualifiers warnings in sss_certmap.c
Make delim in get_type_prefix() and sep in expand_sid() `const char *`
since they only hold strchr()/strrchr() results from const input
strings and are used for pointer arithmetic and reading.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
68edad94 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
KRB5: fix discarded-qualifiers warning in compare_principal_realm()
Make at_sign `const char *` since it only holds a strchr() result
from a const input string and is used for reading.
Implementation-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
9e517f84 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
Makefile: add missing 'CMOCKA_CFLAGS'
Assisted-By: Claude Code (Opus 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
39db12dc by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
BUILD: supress 'deprecated-declarations' error for cmocka tests
Older Fedora versions still have cmocka < 2.0.0 making it
inconvinient to support two interfaces.
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
54c63403 by Alexey Tikhonov at 2026-02-23T15:19:50+00:00
BUILD: fix _POSIX_C_SOURCE redefinition with Python 3.14 and glibc 2.41+
Python 3.14's pyconfig-64.h defines _POSIX_C_SOURCE=200809L and
_XOPEN_SOURCE=700, but glibc 2.41+ headers (pulled in earlier via
sss_nss_idmap.h) already define them to higher values (202405L and
800). This causes -Werror redefinition errors when building the Python
extension modules.
Assisted-By: Claude Code (Sonnet 4.6)
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
f91c7bbc by Alexey Tikhonov at 2026-02-24T10:21:16+00:00
sdap: eliminate O(N^2) loop in `sdap_add_incomplete_groups()`
`sdap_add_incomplete_groups()` had two separate steps: first it
iterated the group name list checking each against sysdb to build
a 'missing' list, then for each missing group it scanned the entire
'ldap_groups' array calling to find matching LDAP attributes.
This resulted in O(N^2) behavior when all groups were missing (i.e.
empty cache).
Replace this with a single O(N) loop that iterates 'ldap_groups'
directly: check sysdb, and if missing create the incomplete entry
immediately.
The 'sysdb_groupnames' parameter is removed as it is not used
anymore.
This patch also has an interesting side effect: it also makes
`sysdb_update_members()` executed in the `sdap_initgr_common_store()`
after `sdap_add_incomplete_groups()` faster. Most probably this
is because previosuly O(N^2) allocations of `groupname` (by
`sdap_get_group_primary_name()`) trashed memory, purging ldb/tdb
data from the cache.
Implementation assisted-by: Claude Code (Opus 4.6)
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
2cdaaa47 by Madhuri Upadhye at 2026-02-24T12:30:53+00:00
Fix test_sudo__case_sensitive_false: use /bin/ls and /bin/cat instead of less/more
test_sudo__case_sensitive_false runs sudo via su -c (no TTY). less and more exit
non-zero without a terminal, so the test failed. Switched to /bin/ls and /bin/cat
so the run is non-interactive; the test still checks case-insensitive sudo rule
merging for user-1 and USER-1.
Assisted-by: Cursor (Composer-1.5)
Signed-off-by: Madhuri Upadhye <mupadhye at redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Shridhar Gadekar <sgadekar at redhat.com>
- - - - -
c6dc4d7a by Gleb Popov at 2026-02-24T18:21:52+00:00
FreeBSD CI: Pass correct paths to adcli and realm programs
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
- - - - -
404d166a by Gleb Popov at 2026-02-26T10:16:26+00:00
sdap_select_principal_from_keytab_sync: waitpid() synchronously
Without this change the ldap_child process started by this function ends up
in the <defunct> state. kernel trace hints that the process isn't fully
finished by the time waitpid is called:
13126 sssd_be CALL wait4(13127,0,0x1<WNOHANG>,0)
13126 sssd_be RET wait4 0
waitpid(ldap_child) failed, process might be leaking
According to man waitpid(3), the function returns 0 when passed WNOHANG and
there is no child process that can be reported as exited. Omitting WNOHANG
fixes the issue.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
b970e7fa by Gleb Popov at 2026-02-27T09:11:58+01:00
Print a bit more information in the debugging output of resolv_is_address() and get_client_cred()
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
64ee91fa by Gleb Popov at 2026-02-27T09:11:58+01:00
getsockopt: Pass correct option level value on FreeBSD
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
8c1e20b2 by Alexey Tikhonov at 2026-03-02T10:34:50+00:00
LDAP: free tmp var within the loop
inside `sdap_add_incomplete_groups()` to avoid memory pressure
/ cache trashing if handling large groups set.
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
b4e88e83 by Dan Lavu at 2026-03-04T09:10:51-05:00
adding sss_ssh_knownhosts test case
Reviewed-by: Anuj Borah <aborah at redhat.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
- - - - -
03b74410 by Iker Pedrosa at 2026-03-06T09:16:36+01:00
ci: install and load kernel module for passkey testing
virtual-fido requires `vhci-hcd` kernel module to be loaded to work
Signed-off-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Scott Poore <spoore at redhat.com>
- - - - -
dc6970c2 by Christopher Byrne at 2026-03-06T12:40:31+00:00
src/sss_client/common.c: Use getpwnam_r to avoid clobbering struct passwd
If something else uses PAM (like openrc, see
https://github.com/OpenRC/openrc/pull/984) and getpwnam, and calls
something like pam_open_session, sssd's call to getpwnam in
init_sssd_ids clobbers the cached value by the other program.
Signed-off-by: Christopher Byrne <salah.coronya at gmail.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
7328fbdb by dependabot[bot] at 2026-03-06T16:56:38+01:00
ci: bump actions/upload-artifact from 6 to 7
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support at github.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
c1eced62 by Alexey Tikhonov at 2026-03-09T19:00:52+00:00
memberOf plugin: redundant comparison removed
'msg->dn' (== 'addop->entry_dn') is already filtered out from 'parents->dns[i]'
at the beginning of `mbof_add_operation()`
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
7a7480e8 by Alexey Tikhonov at 2026-03-09T19:00:52+00:00
memberOf plugin: swap instead of a shift
when removing a duplicate. DNs order doesn't matter.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
704c31db by Alexey Tikhonov at 2026-03-09T19:00:52+00:00
memberOf plugin: avoid `ldb_dn_compare()` in `mbof_add_operation()`
`ldb_dn_compare()` here is heavy because when DNs are not equal (vast majority of cases),
it performs `ldb_dn_casefold_internal()` to return -1 or 1, but it's not important in
this context.
Note that in general using `str*cmp()` instead of `ldb_dn_get_linearized()` might yield
incorrect results due to different DN representations.
But since all 'memberof' DNs originate from sysdb cache / memberof plugin itself, it
should be safe replacement in this context.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
5df3bfff by Neal Gompa at 2026-03-10T11:05:31+00:00
Add support for Plasma Login Manager as a supported PAM service
Plasma Login Manager is the new recommended login manager for KDE Plasma,
and is used as the login manager for Fedora Linux 44 and higher for KDE
Plasma.
Reference: https://fedoraproject.org/wiki/Changes/PlasmaLoginManager
Resolves: https://github.com/SSSD/sssd/issues/8490
Signed-off-by: Neal Gompa <ngompa at velocitylimitless.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
77fc6ff1 by Dan Lavu at 2026-03-13T10:23:38+00:00
updated kcm flaky test
Reviewed-by: Scott Poore <spoore at redhat.com>
- - - - -
f9697d4f by Nikola Forró at 2026-03-16T10:20:07+00:00
Use macro rather than shell expansion for string processing in spec file
Signed-off-by: Nikola Forró <nforro at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
caa0ec22 by Nikola Forró at 2026-03-16T10:20:07+00:00
Add a default for %samba_package_version
Signed-off-by: Nikola Forró <nforro at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
3766e518 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: add sdap_get_and_multi_parse_generic_send()
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
d7709643 by Ondrej Valousek at 2026-03-17T13:10:05+00:00
Simplify direct nested group processing
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
b3a9b819 by Ondrej Valousek at 2026-03-17T13:10:05+00:00
Parser update, cleanup
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
f13a88ca by Ondrej Valousek at 2026-03-17T13:10:05+00:00
Tests fix: mock users/groups with objectclasses and expected RFC2307 attrs
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
461722a3 by Ondrej Valousek at 2026-03-17T13:10:05+00:00
Bugfix (handle unreadable references) that intg check discovered
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
d028661e by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: use sdap_get_and_multi_parse_generic_send
When processing nested group-memberships the
sdap_get_and_multi_parse_generic request is used to better handle the
different types of members, especially in Active Directory.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
c6f941d6 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: remove extra parsing
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
e27b791b by Sumit Bose at 2026-03-17T13:10:05+00:00
ad: add basic foreign security principal sdap map
Add objectclass and other basic attributes to identify a foreign
security principal.
:relnote: Active Directory's Foreign Security Principals (FSP) are now
properly detected and ignored when reading nested group members. The
'ldap_ignore_unreadable_references' option is not needed anymore to
ignore FSPs only in cases where members objects are really not
accessible.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
b97dbe53 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: avoid second parsing of objectclasses
To make it easy for the caller of the sdap_get_and_multi_parse_generic
request to identify the type of the objects returned a new integer array
will be returned with a type identifier which can be set by the caller
together with the attribute maps.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
d8b53a88 by Sumit Bose at 2026-03-17T13:10:05+00:00
tests: add a test with a FSP group member
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
92ffd72c by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: new type SDAP_NESTED_GROUP_DN_IGNORE
The new type SDAP_NESTED_GROUP_DN_IGNORE will be used for nested group
members which have an expected type but a required attribute, e.g. the
name, is missing.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
ccfc33a9 by Ondrej Valousek at 2026-03-17T13:10:05+00:00
sdap: restrict list of requested attributes
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
251aca94 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: add struct sdap_reply_with_type
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
59bc5d62 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: add struct sdap_attr_map_info_ex
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
6e87db11 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: re-add IPA shortcut for nested members
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
3a33ae01 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: initialize attribute list only once
To avoid that the list of requested attributes is initialize for each
nested member lookup it is initialized at the first use and saved on the
nested group context.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
527d6707 by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: initialize base filter only once
To avoid that the base filter is initialize for each nested member
lookup it is initialized at the first use and saved on the nested group
context.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
fc779c4d by Sumit Bose at 2026-03-17T13:10:05+00:00
sdap: change increment style for reply array
Instead of increasing the reply array with a constant number of new
entries the array size is now doubled.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
639814e6 by Sumit Bose at 2026-03-17T13:10:05+00:00
tests: remove wrong and misleading assigment
In nested_group_external_member_test() the assignment
test_ctx->sdap_opts->group_map[SDAP_AT_GROUP_MEMBER].name = \
discard_const(TEST_EXT_MEMBER);
is wrong and not needed.
Since the external groups are a concept for the IPA provider the LDAP
provider does not use SDAP_AT_GROUP_EXT_MEMBER. The original purpose of
the assignment above was most probably to set the 'name' member for
SDAP_AT_GROUP_EXT_MEMBER since it is NULL by default and
SDAP_AT_GROUP_MEMBER is just a typo. Nevertheless the 'name' member is
only used when sending searches to the LDAP server or evaluate replies
from the server. But during this test there is no interaction with the
LDAP server not even a mocked one. So this option does not have any
effect on the test.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
a6d0f0cf by aborah-sudo at 2026-03-17T14:24:39+01:00
Tests: Fix ipa multihost test_authentication_indicators
Provide sleep time to test
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
- - - - -
74e7bc65 by Alexey Tikhonov at 2026-03-19T16:50:47-04:00
KRB5: fix mem leak in `authenticate_stored_users()`
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
5b85b647 by Alexey Tikhonov at 2026-03-19T16:50:47-04:00
UTIL: fix mem leak if `get_active_uid()` fails
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
feca0283 by Alexey Tikhonov at 2026-03-25T10:41:38+00:00
SDAP: reduce logger load in the hot path
This patch reduced number of *sprintf() keeping the same level
of details in the resulting log.
Besides, list of attrs being requested was excluded from the backtrace.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
87c7bce1 by Alexey Tikhonov at 2026-03-25T10:41:38+00:00
SDAP: use DEBUG_CONDITIONAL in the hot paths
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
8631c02e by Alexey Tikhonov at 2026-03-25T14:40:33+00:00
KRB5: log level adjusted
Resolves: https://github.com/SSSD/sssd/issues/8531
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
17390fd2 by Scott Poore at 2026-03-25T16:19:46-04:00
Test: combine gdm tests into one file
Combining all the GDM tests into a single test module to simplify
management of these specific tests.
Refactoring setup helper functions and adding xidp one.
Marking critical tests as well.
Removing some unnecessary comments and adding blank lines to make setup
steps match code.
Renaming some test cases to make purpose more clear.
- - - - -
96d38232 by Ondrej Valousek at 2026-03-26T18:34:55+00:00
Honor ldap filters
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
3d275267 by Paymon MARANDI at 2026-03-27T15:44:58+01:00
krb5: improve reporting failure on reading keytab
also, s/has not entries/has no entries/ when keytab_file has actually
no entries.
Signed-off-by: Paymon MARANDI <paymon at encs.concordia.ca>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
b89f9b62 by Alejandro López at 2026-03-27T19:51:38+01:00
SYSDB: Remove unused function
Function sysdb_enumpwent() is not used.
It was replaced by sysdb_enumpwent_filter().
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
5b5d1ffd by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Reduce a possibly extremely long log message
When there are too many users (17,000+) this message can be too long.
Limit it to the first 50 characters.
Resolves: https://github.com/SSSD/sssd/issues/6951
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
e91c10a6 by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Fix wrong condition invalidating an optimization
We must look into the TS cache only when a name is provided.
Using the TS cache on an unfiltered enumeration is useless.
Resolves: https://github.com/SSSD/sssd/issues/6951
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
70e78f10 by Alejandro López at 2026-03-27T19:51:38+01:00
TESTS: Improve test_sysdb_enumpwent_filter
Added a case that was not checked before. It is the case
when `attr`, `attr_name` and `addtl_filter` are all `NULL`.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
5284ea6c by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Some optimizations.
Create the filter to retrieve only the requested entries.
Do not create a new filter and search for matches if there is
no results from the previous search. The called functions
handle this case correctly but why wasting time calling them?
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
670db53b by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Be coherent when using a lastUpdate filter
Function cache_req_user_by_filter_lookup() will set or not the recent
filter depending on whether data->name.attr is set or not. As mentioned
in the comment, it should be done base on whether the refernced
attribute is name or not.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
55e3a308 by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Fix the logged function name
The message said that sysdb_enumpwent() had failed, but it was
actually sysdb_enumpwent_filter() which failed.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
11a15c25 by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Fix sysdb_enumpwent_filter()
The "name" attribute was not being added to the TS cache, even though
that it is part of the DN (ldb doesn't enforce it). Adding this
attribute requires that the DB version is incremented for the TS cache
to be regenerated with the missing attribute.
This made the if-block in sysdb_enumpwent_filter() rather useless.
In addition, once this if-block is executed, the fuction leaves without
further processing.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
0a739f85 by Alejandro López at 2026-03-27T19:51:38+01:00
NSS: Better handle ERR_NO_TS in sysdb_enumpwent_filter()
Although ts_res.count is set to 0 when sysdb_search_ts_users()
return ERR_NO_TS, before using it we make an extra check to verify
that the returned code is EOK.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
2dcdca2f by Alexey Tikhonov at 2026-03-27T20:51:12+01:00
memberOf plugin: avoid `ldb_dn_compare()` in `mbof_append_addop()`
Justification is the same as in 704c31dbcb86266a9ad5cb02c96fc73ca6a2fb95
In certain scenarios this function is a hot path and using heavy
`ldb_dn_compare()` adds unnecessary overhead.
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
05706145 by Alexey Tikhonov at 2026-03-30T09:52:42+02:00
memberOf plugin: avoid `ldb_dn_compare()` in `mbof_append_muop`
Justification is the same as in 704c31dbcb86266a9ad5cb02c96fc73ca6a2fb95
In certain scenarios this function is a hot path and using heavy
`ldb_dn_compare()` adds unnecessary overhead.
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
06692d50 by Alexey Tikhonov at 2026-03-30T09:52:42+02:00
memberOf plugin: use hash table for value dedup in `mbof_append_muop()`
Replace O(N) linear `strcmp` scan over `op->el->values[]` with O(1)
hash table lookup for duplicate name detection.
Implementation assisted-by: Claude Code (Opus 4.6)
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
abee6e7c by aborah-sudo at 2026-03-30T16:12:37+02:00
Tests: Add integration tests validating SSSD socket
Add integration tests validating SSSD socket activation behavior
for individual responders and mixed socket/traditional configurations.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
- - - - -
3bd74d9b by Ezri Zhu at 2026-04-02T16:16:44+02:00
oidc_child: parameterize entra_idp url
Creates a function to extract the idp url from idp_type instead of using
hardcoded entra url due to GCC High Entra instances using a different
url.
Resolves: https://github.com/SSSD/sssd/issues/8446
idp_type
:feature: `idp_type` option allows entra_idp url to be specified if user is using a
different microsoft entra endpoint.
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
23a23cd2 by dependabot[bot] at 2026-04-06T08:32:57-04:00
ci: bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0
Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases)
- [Commits](https://github.com/crazy-max/ghaction-import-gpg/compare/e89d40939c28e39f97cf32126055eeae86ba74ec...2dc316deee8e90f13e1a351ab510b4d5bc0c82cd)
---
updated-dependencies:
- dependency-name: crazy-max/ghaction-import-gpg
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support at github.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
0c956d95 by Jakub Vávra at 2026-04-07T11:28:00-04:00
Tests: Housekeeping and Clean Sweep of Sevice/Logging suite
Merged tests for sssd offline message in logs and syslog.
Split backend offline(unreachable) and dns resolution error scenario.
Check that user login does not generate logs on default debug level
extended to all providers. Added link to debug level documentation.
Dropped references to (now-irrelevant) bugzillas in rewritten tests.
Skipping test_logging__user_logins_are_not_written_to_logs
as updating log level of the messages is low priority.
- - - - -
428e6130 by Dan Lavu at 2026-04-08T08:37:44-04:00
Reworked memcache tests
* parametrized test cases
* added colliding hash test case
* remove poor test scenarios
- - - - -
7d9bdd50 by Dan Lavu at 2026-04-08T08:37:44-04:00
removing intg memcache tests
- - - - -
58cc4d22 by Striker Leggette at 2026-04-10T11:51:40-04:00
Fix spelling in AD provider code comments
Reviewed-by: Dan Lavu <dlavu at redhat.com>
- - - - -
3b7dc8c7 by Pavel Březina at 2026-04-13T12:07:25+02:00
contrib: removed unused test-suite
This was used by sssd-test-suite virtual machines based CI that we no
longer use.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
f260623f by Pavel Březina at 2026-04-13T12:07:25+02:00
dist: clean up and fix ditribution tarball
The tarball contained malformed src/tests/tests folder due to including
full src/tests in noinst_DATA (because $distdir/src/tests was already
created by check unit tests).
It also clean up the tarball to avoid various build time artifacts and
including missing files.
Resolves: https://github.com/SSSD/sssd/issues/8514
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
- - - - -
0100b1c3 by Alexey Tikhonov at 2026-04-13T12:08:37+02:00
KCM: fix use-after-free in `kcm_read_options()`
The `renew_intv` string was allocated under tmp_ctx but not re-linked
to mem_ctx before tmp_ctx was freed.
Assisted-By: Claude Code (Opus 4.6)
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
95d84767 by Paymon MARANDI at 2026-04-13T12:51:33+02:00
krb5: make sure keytab is a FILE before checking for access
KCM: and API: are other cases besides MEMORY:
Resolves: https://github.com/SSSD/sssd/issues/8555
Signed-off-by: Paymon MARANDI <paymon at encs.concordia.ca>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
10d509a8 by Sumit Bose at 2026-04-13T14:29:51+02:00
conf: add avoid_by_id_lookups domain option
If this new option is set to 'true' SSSD will try to avoid sending
lookups by ID to the backend and will switch to a lookup by name if a
cached object with a matching ID can be found. This option can e.g. be
used in cases where searches by ID are expensive on the server side
because of missing indexes or are not even possible.
:config: New option 'avoid_by_id_lookups' to tell the SSSD responders to
use a lookup by name instead of by id where possible
Resolves: https://github.com/SSSD/sssd/issues/7668
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
c767b8ea by Sumit Bose at 2026-04-13T14:29:51+02:00
cache_req: switch from ID to name lookup
If 'avoid_by_id_lookups' is set to 'True' switch to a lookup by name if
a user or a group is searched by ID.
Resolves: https://github.com/SSSD/sssd/issues/7668
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
a3b2b4f1 by Sumit Bose at 2026-04-13T14:29:51+02:00
idp: do not update cache timeout if member is added
If only a single member is added to a group, e.g. during an initgroups
request, do not increment the cache timeout because it is not clear if
the list of members is complete or not.
Resolves: https://github.com/SSSD/sssd/issues/8330
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
cb1ef376 by Pavel Březina at 2026-04-14T12:43:43+02:00
scripts: add fixed-issues.sh script
Add a bash script to extract and list resolved GitHub issues from git commit
history. The script searches for "Resolves:" references in commit messages
between two git refs and outputs a formatted list of closed issues.
Features:
- Accepts --from <ref> (required) and --to <ref> (defaults to HEAD)
- Supports multiple output formats via --format: plain, rst, md
- Uses gh CLI to fetch issue details (number, title, state)
- Filters to only include closed issues
- Outputs formatted list with issue number, URL, and title
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply at anthropic.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
27aac3a2 by Pavel Březina at 2026-04-14T12:43:43+02:00
scripts: add generate-release-notes.py script
Generate release notes from commit messages:
./scripts/generate-release-notes.py --from FROM --to TO --version VERSION --format md|rst
Co-Authored-By: Claude <noreply at anthropic.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
033a81be by Pavel Březina at 2026-04-14T12:43:43+02:00
scripts: add generate-full-release-notes.sh script
This scripts prepares a release notes for sssd.io.
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
c8257a3e by Pavel Březina at 2026-04-14T12:43:43+02:00
ci: automatically generate release notes
The release workflow is extended to automatically generate release
notes and open a draft pull request against sssd.io.
Reviewed-by: Alejandro López <allopez at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
35019632 by Striker Leggette at 2026-04-14T09:17:25-04:00
More trivial spelling/grammatical fixes. No functional code was harmed in the changing of these files.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
- - - - -
1233fc7d by Timo Eisenmann at 2026-04-14T21:33:31+02:00
config: add missing rules for idp options
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
6a329528 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: get refresh_token for later
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
371148d7 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: store tokens in cache
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
ede49c2c by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: add --refresh-access-token flag
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
9525cccb by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: automatically refresh tokens
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
2e887f12 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: add option to automatically refresh tokens
:feature: Tokens acquired from the IdP are now stored in the domain
cache, and are automatically refreshed if the new option
`idp_auto_refresh` is enabled.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
1f57c2b1 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: delete non-replaced tokens from cache
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
aadae62d by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: construct pam_data with timer
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
a3c506dd by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: url-encode post data items
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
0f08795f by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: free json objects properly
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
c9ca1900 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: add macros for token names
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
fe5d548d by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: pass sss_domain_info to create_refresh_token_timer
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
c3f6388f by Timo Eisenmann at 2026-04-14T21:33:31+02:00
idp: fix idp_id_scope Entra example
Because scope is URL-encoded by oidc_child, the `idp_id_scope` option
must not be encoded already.
This also checks for and automatically corrects the old example value.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
3f65f58b by Timo Eisenmann at 2026-04-14T21:33:31+02:00
oidc_child: initialize curl only once
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
f9ee090e by Timo Eisenmann at 2026-04-14T21:33:31+02:00
fix typos
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
ec440c04 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
fix gcc warning
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
a32aab40 by Timo Eisenmann at 2026-04-14T21:33:31+02:00
add config option to enable logging sensitive data
Sensitive data is logged by the new macro `DEBUG_SENSITIVE`, which is an
alias to `DEBUG` if configured with `--enable-sensitive-logs`.
Otherwise, it is simply a no-op.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
a809b923 by Alexey Tikhonov at 2026-04-15T10:34:22+02:00
Add missing include
Original patch f3af8c89af656767333410b0e94da9288dd8ade8 didn't include
"config.h" that provides `HAVE_PTHREAD_EXT`
It works in some branches accidentally because of transitive include
via "sss_cli.h" but that's fragile (and in some branches "sss_cli.h"
doesn't include "config.h")
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
80e64825 by Madhuri Upadhye at 2026-04-15T12:30:10+02:00
tests: port LDAP+Kerberos tests to pytest
- Port three downstream krb_misc_bugzilla bash tests to upstream pytest
- BZ 773660: Clock skew errors logged to syslog
- BZ 869150: ldap_child handles missing keytab without segfault
- BZ 805281: Correct principal selected from multi-realm keytab
Signed-off-by: Madhuri Upadhye <mupadhye at redhat.com>
Reviewed-by: Dan Lavu <dlavu at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
3f9c415a by Sumit Bose at 2026-04-20T13:06:11+02:00
ad: move ad_get_sids_from_pac() to ad_pac_common.c
To make ad_get_sids_from_pac() better reusable it is moved with its
dependencies into ad_pac_common.c
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
22de4fd2 by Sumit Bose at 2026-04-20T13:06:11+02:00
pam: add pam_gssapi_indicators_apply option
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
1f680eda by Sumit Bose at 2026-04-20T13:06:11+02:00
pam: apply SIDs from PAC to authentication indicators
This patch reads the PAC of a Kerberos ticket while evaluating the
authentication indicators of the Kerberos ticket during a pam_sss_gss
request. Based on the value of the pam_gssapi_indicators_apply option
the found SIDs might add additional authentication indicators to the
evaluation.
The primary use case is to handle SIDs added by Active Directory's
Authentication Mechanism Assurance (AMA).
:relnote: During the processing of the pam_sss_gss request SSSD will
read the SID from the PAC of the Kerberos ticket and might add
authentication indicators based on the value of the new option
pam_gssapi_indicators_apply. The primary use case is to handle SIDs
added by Active Directory's Authentication Mechanism Assurance (AMA).
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
550b08ca by Xu Raoqing at 2026-04-21T21:15:01+02:00
pam: fix out-of-bounds read in pam_passkey_child_read_data
The pam_passkey_child_read_data() function failed to properly handle
raw bytes received from a pipe. The data was treated as a NUL-terminated
C string without explicit termination, resulting in an out-of-bounds read
when processed by snprintf() with %s format.
Fix by using memcpy instead of snprintf and explicitly NUL-terminating
the buffer. Add checks for buf_len == 0 or buf == NULL to avoid undefined
behavior. Check the return value of sss_authtok_set_passkey_reply and
propagate errors properly.
Fixes: CVE-2026-6245
:relnote: Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey responder
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
6726f5a8 by Dan Lavu at 2026-04-22T00:19:12-04:00
removing unstable topologies from memecache tests
Reviewed-by: Scott Poore <spoore at redhat.com>
- - - - -
9926e7ef by Sumit Bose at 2026-04-22T09:33:23+02:00
oidc_child: add new option return-tokens
oidc_child should only return access and refresh tokens during
authentication if the new option '--return-tokens' is given.
Resolves: https://github.com/SSSD/sssd/issues/8616
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
ba4353fd by Gleb Popov at 2026-04-22T10:43:22+02:00
dp_target_id.c: Fix typo "lenght" -> "length"
Resolves #8590
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
- - - - -
d0beceaa by Paul Adelsbach at 2026-04-22T11:25:21+02:00
pam: gate PAC indicator code on BUILD_SAMBA
Commit 1f680edad023c8c57343447b156f6b34696e8221 added ad_pac_common.c and
$(NDR_KRB5PAC_LIBS) to sssd_pam unconditionally. So when building --without-samba, sssd_pam fails to link with undefined references to ndr_pull_init_blob and ndr_pull_PAC_DATA.
This change qualifies those additions with `BUILD_SAMBA` so the PAC
indicator feature is compiled in only when samba support is enabled.
Reviewed-by: Sumit Bose <sbose at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
- - - - -
3b0b16e9 by Alexey Tikhonov at 2026-04-22T16:40:43+02:00
PAM/PASSKEY: avoid unnecessary memcpy
`sss_authtok_set_passkey_reply()` -> `sss_authtok_set_string()` handles
non NULL-terminated buffer correctly.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
- - - - -
9c836671 by Hosted Weblate at 2026-04-23T12:49:49+02:00
po: update translations
(Italian) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 99.9% (2836 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 99.9% (2836 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 99.9% (2836 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 79.5% (2257 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 79.5% (2257 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 69.1% (1962 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 69.1% (1962 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 69.1% (1962 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 55.8% (1584 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 55.8% (1584 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 35.2% (1001 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 35.2% (1001 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 22.7% (646 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 6.7% (192 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 6.7% (192 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 6.7% (192 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 6.7% (192 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 6.7% (192 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
po: update translations
(Italian) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
po: update translations
(Italian) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
po: update translations
(Italian) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
po: update translations
(Polish) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/pl/
po: update translations
(Italian) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
po: update translations
(Portuguese) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/pt/
po: update translations
(Finnish) currently translated at 10.4% (77 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fi/
po: update translations
(Swedish) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 68.1% (1681 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Czech) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
po: update translations
(Turkish) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/tr/
po: update translations
(Korean) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ko/
po: update translations
(Spanish) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/es/
po: update translations
(Spanish) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/es/
po: update translations
(Russian) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ru/
po: update translations
(French) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fr/
po: update translations
(Russian) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/
po: update translations
(Korean) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ko/
po: update translations
(Korean) currently translated at 67.8% (1672 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Korean) currently translated at 67.8% (1672 of 2465 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
po: update translations
(Swedish) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/sv/
po: update translations
(Portuguese) currently translated at 100.0% (735 of 735 strings)
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/pt/
po: update translations
(Portuguese) currently translated at 100.0% (2838 of 2838 strings)
Translation: SSSD/sssd-manpage
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/pt/
Update translation files
Updated by "Update LINGUAS file" hook in Weblate.
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/
Added translation using Weblate (Turkish)
Added translation using Weblate (Norwegian Bokmål)
Added translation using Weblate (Italian)
Added translation using Weblate (Indonesian)
Added translation using Weblate (Hungarian)
Added translation using Weblate (Bulgarian)
Added translation using Weblate (Latvian)
Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.
Translation: SSSD/sssd
Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/
Added translation using Weblate (Breton)
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
- - - - -
9faae339 by sssd-bot at 2026-04-24T11:52:44+00:00
pot: update pot files
- - - - -
d1329f90 by sssd-bot at 2026-04-24T11:52:44+00:00
Release sssd-2.13.0
- - - - -
d77df8e5 by Madhuri Upadhye at 2026-04-28T15:21:15+02:00
tests: poll for KCM TGT renewal instead of fixed sleep
test_kcm__tgt_renewal_updates_ticket_as_configured
no longer uses a fixed sleep(5) and flaky retries.
The test now polls klist every 0.5s and asserts renewal
by checking that TGT start or end time advances,
with a detailed failure message that prints both
initial and last timestamps.
To match KCM renewal behavior (renewal only starts
after roughly half the ticket lifetime),
the test uses a short renewable ticket (-r 5s -l 5s) and
a bounded polling window (9s) so it stays fast while still
waiting long enough for renewal to be attempted.
Also removed the temporary CI comment and the flaky marker from this test.
Assited by: Cursor(Claude Opus 4.6)
Signed-off-by: Madhuri Upadhye <mupadhye at redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Scott Poore <spoore at redhat.com>
(cherry picked from commit 233db39fc84dc2a0b3bfb86000080b66d5d46713)
- - - - -
feef7617 by krishnavema at 2026-05-06T15:15:22-05:00
tests: implement multi-token support for smart card authentication
Reviewed-by: Scott Poore <spoore at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit e5b65979f11e10ffafa398fe38e4d1cf63cd99bf)
- - - - -
87b819c7 by dependabot[bot] at 2026-05-07T09:24:16-04:00
ci: bump cross-platform-actions/action from 0.32.0 to 1.0.0
Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.32.0 to 1.0.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v0.32.0...v1.0.0)
---
updated-dependencies:
- dependency-name: cross-platform-actions/action
dependency-version: 1.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support at github.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit fa413a9694a5dfbb17171e4b26cfce4d75881a5c)
- - - - -
d19f6860 by Dan Lavu at 2026-05-08T20:12:09+05:30
refactoring ipa tests for hostname framework changes.
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
Reviewed-by: Madhuri Upadhye <mupadhye at redhat.com>
(cherry picked from commit 8f170d08a0ca0a9573fc173ae5e7e6a1cd8ffc26)
- - - - -
6e2b87aa by Alexey Tikhonov at 2026-05-11T10:29:03+02:00
KRB5: read keytab copy in offline mode too
The process can transition from offline pre-auth to online auth within
the same invocation.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit b070171e8371ce9be20c0554617b35d13a2ef17c)
- - - - -
9826dca0 by Samuel Cabrero at 2026-05-11T22:05:16+02:00
sdap: Reduce log level when get_naming_context() fails
Signed-off-by: Samuel Cabrero <scabrero at suse.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit edf4a0f9b683a96526a205ab8cd2148012da63b9)
- - - - -
67444c41 by Sumit Bose at 2026-05-11T22:09:48+02:00
p11_child: ignore failure of C_GetTokenInfo
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit d6483bb5c5639e3045092170cd5ee5cdcd5b5867)
- - - - -
cd184920 by Sumit Bose at 2026-05-11T22:09:48+02:00
pam: handle protected authentication path
If a Smartcard reader has a built-in keypad or keyboard the flag
CKF_PROTECTED_AUTHENTICATION_PATH is set in the token info data. To
properly tell the user that the pin must be given at the reader directly
and not at the computer this information must be propagated to the
pam_sss module.
Resolves: https://github.com/SSSD/sssd/issues/5371
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 016bc7a2a389900907579631c0016986e5eb0678)
- - - - -
89accfc1 by Sumit Bose at 2026-05-11T22:09:48+02:00
authtok: remove sss_authtok_set_sc_keypad()
sss_authtok_set_sc_keypad() does not set which token and certificate
should be used for authentication, just using sss_authtok_set_sc() with
SSS_AUTHTOK_TYPE_SC_KEYPAD as type is sufficient.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit f3aea6728f2ccfc52fc2f8211828094dd5edf609)
- - - - -
072f8ec1 by Sumit Bose at 2026-05-11T22:09:48+02:00
pam_sss: fix potential memory leak
In case the conversation callback allocates memory for a reply we have
to free it.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 084268fc284b35514ac7e4cd9e9410d344817d37)
- - - - -
8c59fa3e by Sumit Bose at 2026-05-11T22:09:48+02:00
pam: refactor pack_cert_data
Use safealign_memcpy() instead of plain memcpy() and add a consistency
check.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 50a38380e2cb19f17dd2e0abf523091ddc45476b)
- - - - -
a4bbfb40 by Jakub Vávra at 2026-05-12T11:11:31+02:00
Tests: Fix test_refresh_contain_timestamp
Reviewed-by: Madhuri Upadhye <mupadhye at redhat.com>
(cherry picked from commit 1b802f4cbcf04ddd4cb43942701311a4e3a661c0)
- - - - -
22ee1841 by Sumit Bose at 2026-05-12T18:09:23+02:00
krb5: restart krb5_child for Smartcard authentication
In contrast to other authentication methods for PKINIT some information
about the used Smartcard and certificate are already needed for the
pre-authentication step to trigger the MIT Kerberos PKINIT module to get
back the information if PKINIT is possible or not and if the Smartcard
can be used for authentication. If krb5_child is kept running between
the pre-authentication and the authentication step the information given
during pre-authentication is used if Smartcard authentication was
selected.
As long as only a single certificate is available there is no issue. But
if there are multiple certificates which all apply to the given mapping
and matching rules for the user trying to log in and the user can choose
a certificate for authentication the authentication might fail if the
certificate use during pre-authentication and the one selected by the
user differ. Before the change to keep krb5_child running for all
authentication methods this was not an issue since the fresh instance
started during the authentication step was using the certificate
selected by the user.
With this patch krb5_child is restart during the authentication step is
Smartcard authentication was selected.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit f3a36bec2a6c9fe11076c8f4673775a0d4221ad1)
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
- - - - -
c3acaa3a by Pavel Březina at 2026-05-13T12:34:56+02:00
sdap: let callers mark SSSD as offline if kinit fails
The callers expected that ret == EIO and can_retry == false to bring
SSSD to an offline state.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit c5b631ee6df531b506d2b2ba7f2d9f0b9de02746)
- - - - -
e12ff3c6 by Simo Sorce at 2026-05-19T19:32:11+02:00
Correct x400Address type check in crypto.m4
Update the compilation check for the x400Address field in the GENERAL_NAME
struct. By comparing the address of the field against an ASN1_STRING double
pointer, it ensures the compiler strictly and safely verifies the exact type
during autoconf checks without causing invalid pointer arithmetic errors.
Co-authored-by: Gemini <gemini at google.com>
Signed-off-by: Simo Sorce <simo at redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit ab6713f781ba02c4ff881f276a9289b4b3ff1133)
- - - - -
e30bd32e by Simo Sorce at 2026-05-19T19:32:11+02:00
Update certmap for OpenSSL 4.0 compatibility
Replace direct struct field accesses with OpenSSL accessor functions like
ASN1_STRING_get0_data and ASN1_STRING_length. Add const qualifiers to
ensure compatibilitty with OpenSSL 4.0.
Signed-off-by: Simo Sorce <simo at redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit b197d9d3f566f8b840663e31105b338e1a4f962e)
- - - - -
52547f7f by Simo Sorce at 2026-05-19T19:32:11+02:00
Add const qualifier to X509_NAME pointers
The issuer_name and subject_name variables in get_issuer_subject_str have been
updated to use the const qualifier. This improves const-correctness and
prevents accidental modification of the certificate data.
Signed-off-by: Simo Sorce <simo at redhat.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit 770ae6cb020fd60e64507747bfddbb948cb52984)
- - - - -
eecbb52a by Justin Stephenson at 2026-05-26T10:20:39-04:00
tests: Clarify approx match filter
Reviewed-by: Tomáš Halman <thalman at redhat.com>
(cherry picked from commit 21674dd9689742b292f84c5e7f98278f6d99ab30)
- - - - -
1b6efb03 by Iker Pedrosa at 2026-05-26T10:36:14-04:00
tests: add TMT plan for passkey testing
Add comprehensive TMT plan for testing SSSD passkey functionality across
IPA, LDAP, and Samba identity providers using containerized environments.
Signed-off-by: Iker Pedrosa <ipedrosa at redhat.com>
Co-authored-by: Claude Sonnet 4 <noreply at anthropic.com>
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit d54cf526c92143653108b455fa4e477c24b6263f)
- - - - -
f21a1432 by Iker Pedrosa at 2026-05-26T10:36:14-04:00
ci: add TMT passkey tests to packit workflow
Enable automated passkey testing on pull requests after COPR builds
complete. Tests run on fedora-all and centos-stream-10 targets using
the TMT plan.
Signed-off-by: Iker Pedrosa <ipedrosa at redhat.com>
Co-Authored-By: Claude Sonnet 4 <noreply at anthropic.com>
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit 210f50f507c8443d1522fd7504b001e95af29950)
- - - - -
b292c6dd by Akshay Sakure at 2026-05-26T11:08:48-04:00
Component: sssd-tools
Explanation: This patch will make sure to print correct command on
running 'sssctl analyze --help' command avoiding confusion.
Resolves: https://github.com/SSSD/sssd/issues/8718
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit 30a4940f51736a9b2303a0573b5ca11c9f83ab73)
- - - - -
1c764c59 by aborah-sudo at 2026-05-27T08:42:33-05:00
Tests: fix the tests to check the new pattern
I got confirmation that this is simply a log change issue. We can fix the tests to check the new pattern.
https://github.com/SSSD/sssd/pull/8540
Reviewed-by: Scott Poore <spoore at redhat.com>
(cherry picked from commit 04d593755659b1afb2139c99c8c31ecc4a6c0436)
- - - - -
0ab98c7b by Pavel Březina at 2026-05-27T17:49:06+02:00
sdap: handle missing rootDSE gracefully
If `ldap_read_rootdse = never` then srv_opts is NULL which is unexpected.
It can also happen on other path in the connection code, because
sdap_cli_use_rootdse() is called only when the rootDSE is successfully
fetch. This patch makes sure that srv_opts are always set.
:fixes: SSSD no longer crashes if `ldap_read_rootdse = never` and
`enumerate = true`
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
(cherry picked from commit 2cc7dfa18830336bd75ee8fa7e8a5db40bc253fb)
- - - - -
fa138120 by Alexey Tikhonov at 2026-05-29T13:31:42+02:00
sdap: defer libldap global options setup to first connection
During initialization LDAP/AD/IPA backends unconditionally call
`setup_tls_config()` and `setup_ldap_debug()` that call
`ldap_set_option()`. This triggers `ldap_int_initialize()` ->
`getaddrinfo(local_hostname)`. If DNS is unresponsive, this blocks
and the backend doesn't complete initialization in time, so that
'monitor' terminates the entire SSSD.
Move these calls out of the module init path into a new
`sdap_setup_libldap_global_options()` wrapper guarded by a static bool.
Call it from `sdap_connect_send()` just before `sss_ldap_init_send()`,
which is the single entry point for all LDAP connections.
:fixes:Fixed an issue where SSSD fails to start when DNS is unresponsive.
Assisted-By: Claude Code (Opus 4.6)
Reviewed-by: Dan Lavu <dlavu at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
Reviewed-by: Tomáš Halman <thalman at redhat.com>
(cherry picked from commit b84e7fa856317cd629a212ddf05e5d5e2e20374d)
- - - - -
7682b02e by Alexey Tikhonov at 2026-06-01T17:30:15+02:00
Makefile: krb5 plugins: don't export internal symbols
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 9adeb27348decab9c47307d04e15b379d6bc7d92)
- - - - -
7b9e0059 by Akshay Sakure at 2026-06-01T13:40:13-04:00
sssd man-page: Improve man-page for override_gid
This commit improves the man-page statement for override_gid
option by adding clear description & "Default" value.
Resolves: https://github.com/SSSD/sssd/issues/7341
Signed-off-by: Akshay Sakure <asakure at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit 5b6c11d507ec9dcd4daef27b683e42af364d8dc7)
- - - - -
12d538c4 by aborah-sudo at 2026-06-04T07:32:17+02:00
Tests: Disable test_authentication_indicators
Test is avilable as: https://github.com/SSSD/sssd/blob/master/src/tests/system/tests/test_ipa.py#L339
Reviewed-by: Jakub Vávra <jvavra at redhat.com>
(cherry picked from commit c20c27003a45e82d3ea34a8fa151a270483657bd)
- - - - -
004a8be1 by dependabot[bot] at 2026-06-04T16:30:34+02:00
ci: bump cross-platform-actions/action from 1.0.0 to 1.2.0
Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 1.0.0 to 1.2.0.
- [Release notes](https://github.com/cross-platform-actions/action/releases)
- [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
- [Commits](https://github.com/cross-platform-actions/action/compare/v1.0.0...v1.2.0)
---
updated-dependencies:
- dependency-name: cross-platform-actions/action
dependency-version: 1.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support at github.com>
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
(cherry picked from commit 9dfd78c7c2fb0b0eb76d0a00d770e8a02de0e908)
- - - - -
9a3938fc by Alexey Tikhonov at 2026-06-04T19:59:42+02:00
RESOLV: handle empty addr list properly
The address list can be NULL or empty when '/etc/hosts' has
an IPv6 only entry and IPv4 was requested or vice versa. It
was treated as an indicator that the name component contains
the path to an LDAPI socket, leading to a crash.
Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
Reviewed-by: Sumit Bose <sbose at redhat.com>
(cherry picked from commit b6e7f0518990cbf786d35d387589dfa690bfa6d8)
- - - - -
b388d22d by Akshay Sakure at 2026-06-04T15:02:48-04:00
sssd man-page: Fix man-page for offline_timeout*
Currently, all the offline_timeout* options are in the wrong section
due to which 'sssctl config-check' gives a WARNING. Ideally, they should
be in DOMAIN SECTIONS.
This PR will move all offline_timeout* options into DOMAIN SECTIONS
and also fix a typo along with a couple of grammatical corrections.
Resolves: https://github.com/SSSD/sssd/issues/7289
Signed-off-by: Akshay Sakure <asakure at redhat.com>
Reviewed-by: Justin Stephenson <jstephen at redhat.com>
(cherry picked from commit c183ecbd2558b61a41e46913482ea64759584baf)
- - - - -
adf76523 by Sumit Bose at 2026-06-08T15:36:31+02:00
crypto: add get_jwk_from_pkcs12()
To allow signing web tokens with the help of libjose the new function
get_jwk_from_pkcs12() can generate a JSON Web Key (JWK) from a given
PKCS#12 file.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 8100381136a015ac72452c1d3ff6d71e71232232)
- - - - -
d50a0696 by Sumit Bose at 2026-06-08T15:36:31+02:00
oidc_child: add pkcs12-client-creds option
With the new option pkcs12-client-creds a PKCS#12 file with certificate
and private key can be specified for client authentication. The client
credential will be used as a password to unlock the key in the PKCS#12
file. The PKCS#12 file is used in a way to make mutual TLS (mTLS) work
with an IdP.
:relnote: new oidc_child option --pkcs12-client-creds to specify the
path to a PKCS#12 file with certificate and private key for certificate
based authentication. Password to unlock the private key can be given
with --client-secret or --client-secret-stdin options.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit ec078ea0e99d5b7038b2a77d7c0d1a46eb17eeac)
- - - - -
7b51a9ba by Sumit Bose at 2026-06-08T15:36:31+02:00
oidc_child: add JWT authentication
With the new option --client-auth-method oidc_child can select between
authentication with a client secret, mutual-TLS/mTLS (RFC-8705) and JWT
client assertion (RFC-7523). The latter two require a PKCS#12 file with
the client credentials (certificate and private key) and the password to
unlock the private key must be provided with the --client-secret or
--client-secret-stdin option.
:relnote: new oidc_child option --client-auth-method to select between
authentication with client secret, mutual-TLS/mTLS (RFC-8705) and JWT
client assertion (RFC-7523). For mTLS all key types supported by libcurl
can be used. For JWT RS256, ES256, ES384 and ES512 with matching key
types are supported.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 6577434c7429c3a176c1ba0dfead0d71f3c3c7e3)
- - - - -
d217bba4 by Sumit Bose at 2026-06-08T15:36:31+02:00
test: add tests for oidc_child 'get-device-code'
This new test call oidc_child with the '--get-device-code' option with
different client authentication methods.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Pavel Březina <pbrezina at redhat.com>
(cherry picked from commit 9a3487d757d9678b4474f53f76d9bf1832aa0083)
- - - - -
04f661d6 by Sumit Bose at 2026-06-08T15:36:31+02:00
oidc_child: remove potential double-free in JSON code
The reference is always stolen if the 'o' format specifier is used even
in the case of errors.
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
(cherry picked from commit f72a7a69dbc972adecf41544c9c5c4e73ecdd240)
- - - - -
28ca8cc2 by Sumit Bose at 2026-06-08T15:36:31+02:00
oisc_child: add missing NULL checks
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
(cherry picked from commit 44cd06ba7b58cc92466cd496715042986e19cd7a)
- - - - -
cd3809bd by Sumit Bose at 2026-06-08T15:36:31+02:00
oidc_child: clarify why a value isn't copied
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
(cherry picked from commit c2f9fff0c8811d62108479be749ef1b90c74980d)
- - - - -
92172fc3 by sssd-bot at 2026-06-08T16:27:41+00:00
pot: update pot files
- - - - -
57209f99 by sssd-bot at 2026-06-08T16:27:41+00:00
Release sssd-2.13.1
- - - - -
e08f1bd1 by Jakub Vávra at 2026-06-08T17:33:06-05:00
Tests: Update LdapOperations to fail on bind immediately
Co-authored-by: Cursor <cursoragent at cursor.com>
Reviewed-by: Scott Poore <spoore at redhat.com>
(cherry picked from commit 9df13ca250dcbc0dd37d3d91a13271787111bc8f)
- - - - -
cb1bdeda by kkz at 2026-06-09T13:41:07+02:00
resolv: Fix incorrect variable used in ares_parse_txt_reply() error check
Reviewed-by: Alexey Tikhonov <atikhono at redhat.com>
Reviewed-by: Alejandro López <allopez at redhat.com>
(cherry picked from commit 4a800e56a52c1eddc4b9e2a379d2e9731be0ef6f)
- - - - -
b9154c27 by sssd-bot at 2026-06-09T12:32:20+00:00
pot: update pot files
- - - - -
71168064 by sssd-bot at 2026-06-09T12:32:21+00:00
Release sssd-2.13.1
- - - - -
269 changed files:
- + .fmf/version
- .github/workflows/build.yml
- .github/workflows/ci.yml
- .github/workflows/release.yml
- .github/workflows/static-code-analysis.yml
- .packit.yaml
- Makefile.am
- configure.ac
- contrib/sssd.spec.in
- − contrib/test-suite/README.md
- − contrib/test-suite/test-suite.yml
- + plans/passkey.fmf
- po/LINGUAS
- po/bg.po
- + po/br.po
- po/ca.po
- po/cs.po
- po/de.po
- po/es.po
- po/eu.po
- po/fi.po
- po/fr.po
- po/hu.po
- po/id.po
- po/it.po
- po/ja.po
- po/ka.po
- po/ko.po
- + po/lv.po
- po/nb.po
- po/nl.po
- po/pl.po
- po/pt.po
- po/pt_BR.po
- po/ru.po
- po/sssd.pot
- po/sv.po
- po/tg.po
- po/tr.po
- po/uk.po
- po/zh_CN.po
- po/zh_TW.po
- + scripts/fixed-issues.sh
- + scripts/generate-full-release-notes.sh
- + scripts/generate-release-notes.py
- + scripts/release-notes.sh
- scripts/release.sh
- src/conf_macros.m4
- src/confdb/confdb.c
- src/confdb/confdb.h
- src/config/SSSDConfig/ipachangeconf.py
- src/config/SSSDConfig/sssdoptions.py
- src/config/SSSDConfigTest.py
- src/config/cfg_rules.ini
- src/config/etc/sssd.api.conf
- src/db/sysdb.h
- src/db/sysdb_init.c
- src/db/sysdb_ops.c
- src/db/sysdb_private.h
- src/db/sysdb_search.c
- src/db/sysdb_subdomains.c
- src/db/sysdb_sudo.h
- src/db/sysdb_upgrade.c
- src/db/sysdb_views.c
- src/doxy.config.in
- src/external/cifsidmap.m4
- src/external/crypto.m4
- src/external/libcmocka.m4
- src/external/libnfsidmap.m4
- src/external/platform.m4
- src/external/test_ca.m4
- src/ldb_modules/memberof.c
- src/lib/certmap/sss_cert_content_crypto.c
- src/lib/certmap/sss_certmap.c
- src/lib/certmap/sss_certmap.h
- src/lib/certmap/sss_certmap_int.h
- src/lib/idmap/sss_idmap.h
- src/lib/ipa_hbac/ipa_hbac.doxy.in
- src/lib/winbind_idmap_sss/winbind_idmap_sss.c
- src/lib/winbind_idmap_sss/winbind_idmap_sss.h
- src/man/Makefile.am
- + src/man/po/bg.po
- src/man/po/br.po
- src/man/po/ca.po
- src/man/po/cs.po
- src/man/po/de.po
- src/man/po/es.po
- src/man/po/eu.po
- src/man/po/fi.po
- src/man/po/fr.po
- + src/man/po/hu.po
- + src/man/po/id.po
- + src/man/po/it.po
- src/man/po/ja.po
- src/man/po/ko.po
- src/man/po/lv.po
- + src/man/po/nb_NO.po
- src/man/po/nl.po
- src/man/po/pt.po
- src/man/po/pt_BR.po
- src/man/po/ru.po
- src/man/po/sssd-docs.pot
- src/man/po/sv.po
- src/man/po/tg.po
- + src/man/po/tr.po
- src/man/po/uk.po
- src/man/po/zh_CN.po
- src/man/sss_ssh_knownhosts.1.xml
- src/man/sssd-ad.5.xml
- src/man/sssd-idp.5.xml
- src/man/sssd.conf.5.xml
- src/man/sssd_krb5_localauth_plugin.8.xml
- src/monitor/monitor.c
- + src/oidc_child/libcrypto/oidc_child_get_jwk.c
- src/oidc_child/oidc_child.c
- src/oidc_child/oidc_child_curl.c
- src/oidc_child/oidc_child_id.c
- src/oidc_child/oidc_child_json.c
- src/oidc_child/oidc_child_util.h
- src/p11_child/p11_child.h
- src/p11_child/p11_child_common.c
- src/p11_child/p11_child_common_utils.c
- src/p11_child/p11_child_openssl.c
- src/passkey_child/passkey_child.c
- src/passkey_child/passkey_child.h
- src/passkey_child/passkey_child_assert.c
- src/passkey_child/passkey_child_credentials.c
- src/passkey_child/passkey_child_devices.c
- src/providers/ad/ad_access.c
- src/providers/ad/ad_common.c
- src/providers/ad/ad_common.h
- src/providers/ad/ad_gpo.c
- src/providers/ad/ad_gpo_child.c
- src/providers/ad/ad_gpo_child_utils.c
- src/providers/ad/ad_id.c
- src/providers/ad/ad_init.c
- src/providers/ad/ad_opts.c
- src/providers/ad/ad_opts.h
- src/providers/ad/ad_pac.c
- src/providers/ad/ad_pac_common.c
- src/providers/ad/ad_subdomains.c
- src/providers/be_dyndns.c
- src/providers/be_ptask.h
- src/providers/be_refresh.c
- src/providers/data_provider/dp_request.h
- src/providers/data_provider/dp_target_id.c
- src/providers/fail_over.c
- src/providers/fail_over.h
- src/providers/idp/idp_auth.c
- src/providers/idp/idp_auth.h
- src/providers/idp/idp_auth_eval.c
- src/providers/idp/idp_common.h
- src/providers/idp/idp_id_eval.c
- src/providers/idp/idp_init.c
- src/providers/idp/idp_opts.c
- src/providers/ipa/ipa_access.c
- src/providers/ipa/ipa_auth.c
- src/providers/ipa/ipa_common.c
- src/providers/ipa/ipa_hbac_services.c
- src/providers/ipa/ipa_id.c
- src/providers/ipa/ipa_init.c
- src/providers/ipa/ipa_opts.c
- src/providers/ipa/ipa_s2n_exop.c
- src/providers/ipa/ipa_subdomains_id.c
- src/providers/krb5/krb5_auth.c
- src/providers/krb5/krb5_child.c
- src/providers/krb5/krb5_common.c
- src/providers/krb5/krb5_delayed_online_authentication.c
- src/providers/krb5/krb5_init.c
- src/providers/krb5/krb5_keytab.c
- src/providers/ldap/ldap_auth.c
- src/providers/ldap/ldap_init.c
- src/providers/ldap/sdap.c
- src/providers/ldap/sdap.h
- src/providers/ldap/sdap_async.c
- src/providers/ldap/sdap_async.h
- src/providers/ldap/sdap_async_connection.c
- src/providers/ldap/sdap_async_groups.c
- src/providers/ldap/sdap_async_initgroups.c
- src/providers/ldap/sdap_async_nested_groups.c
- src/providers/ldap/sdap_async_private.h
- src/providers/ldap/sdap_child_helpers.c
- src/providers/ldap/sdap_id_op.c
- src/providers/ldap/sdap_online_check.c
- src/providers/ldap/sdap_range.c
- src/python/sss_python.h
- src/resolv/async_resolv.c
- src/responder/common/cache_req/cache_req.c
- src/responder/common/cache_req/cache_req_private.h
- src/responder/common/cache_req/cache_req_search.c
- src/responder/common/cache_req/plugins/cache_req_user_by_filter.c
- src/responder/common/responder_common.c
- src/responder/kcm/kcm_renew.c
- src/responder/pam/pam_prompting_config.c
- src/responder/pam/pamsrv.c
- src/responder/pam/pamsrv.h
- src/responder/pam/pamsrv_cmd.c
- src/responder/pam/pamsrv_gssapi.c
- src/responder/pam/pamsrv_json.c
- src/responder/pam/pamsrv_p11.c
- src/responder/pam/pamsrv_passkey.c
- src/sbus/sbus_message.h
- src/shared/cred.h
- src/sss_client/autofs/sss_autofs.c
- src/sss_client/common.c
- src/sss_client/pam_sss.c
- src/sss_client/pam_sss_prompt_config.c
- src/sss_client/sss_cli.h
- src/sysv/systemd/sssd.service.in
- src/tests/cmocka/common_mock_sdap.c
- src/tests/cmocka/common_mock_sysdb_objects.c
- src/tests/cmocka/test_authtok.c
- src/tests/cmocka/test_cert_utils.c
- src/tests/cmocka/test_nested_groups.c
- src/tests/cmocka/test_pam_srv.c
- src/tests/cmocka/test_prompt_config.c
- src/tests/cmocka/test_sysdb_views.c
- src/tests/cwrap/cwrap_test_setup.sh
- src/tests/cwrap/test_responder_common.c
- src/tests/double_semicolon_test
- src/tests/intg/Makefile.am
- − src/tests/intg/test_memory_cache.py
- − src/tests/intg/test_netgroup.py
- src/tests/multihost/alltests/test_kcm.py
- src/tests/multihost/ipa/test_misc.py
- src/tests/multihost/sssd/testlib/common/utils.py
- src/tests/sysdb-tests.c
- src/tests/system/tests/test_access_control_ldap_filter.py
- src/tests/system/tests/test_ad.py
- src/tests/system/tests/test_failover.py
- src/tests/system/tests/test_gdm.py
- − src/tests/system/tests/test_gdm_passkey.py
- src/tests/system/tests/test_gpo.py
- src/tests/system/tests/test_identity.py
- src/tests/system/tests/test_idp.py
- src/tests/system/tests/test_infopipe.py
- src/tests/system/tests/test_ipa.py
- src/tests/system/tests/test_kcm.py
- + src/tests/system/tests/test_ldap_krb5.py
- src/tests/system/tests/test_logging.py
- src/tests/system/tests/test_memcache.py
- src/tests/system/tests/test_oidc_child.py
- src/tests/system/tests/test_proxy.py
- src/tests/system/tests/test_pysss_nss_idmap.py
- src/tests/system/tests/test_smartcard.py
- + src/tests/system/tests/test_socket.py
- src/tests/system/tests/test_sudo.py
- src/tests/system/tests/test_tools.py
- src/tests/test_CA/Makefile.am
- src/tests/test_ECC_CA/Makefile.am
- src/tests/whitespace_test
- src/tools/analyzer/sss_analyze.py
- src/tools/sssctl/sssctl_config.c
- src/util/authtok.c
- src/util/authtok.h
- src/util/child_common.h
- src/util/child_handlers.c
- src/util/debug.h
- src/util/find_uid.c
- − src/util/selinux.c
- src/util/sss_ini.c
- src/util/sss_ini.h
- src/util/sss_tc_utf8.c
- src/util/usertools.c
- src/util/util.c
- src/util/util.h
- src/util/util_errors.c
- src/util/util_errors.h
- version.m4
The diff was not included because it is too large.
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/1a1cf163b78ff4768cc8bfc1e631171bc021e2fe...7116806484d141b0f6cb051883041b059b6ab29c
--
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/1a1cf163b78ff4768cc8bfc1e631171bc021e2fe...7116806484d141b0f6cb051883041b059b6ab29c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-sssd-devel/attachments/20260803/96258547/attachment-0001.htm>
More information about the Pkg-sssd-devel
mailing list