sssd bug fix and enhancement update

Updated sssd packages that fix several bugs and add various enhancements are now
available for Red Hat Enterprise Linux 6.

SSSD (System Security Services Daemon) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides NSS
(Name Service Switch) and PAM (Pluggable Authentication Modules) interfaces
toward the system and a pluggable back end system to connect to multiple
different account sources.

These updated sssd packages include numerous bug fixes and enhancements. Space
precludes documenting all of these changes in this advisory. Users are directed
to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most
significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/sssd.html#RHBA-2012-0747

Users are advised to upgrade to these updated sssd packages, which fix these
bugs and add these enhancements.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

721289 - Process /usr/libexec/sssd/sssd_be was killed by signal 11 during auth when password for the user is not set.
726467 - SSSD takes 30+ seconds to login
744197 - [RFE] close LDAP connection to the server when idle for some (configurable) time
746181 - "getgrgid call returned more than one result" after group name change in MSAD
753763 - Provide logging configuration compatibility on SSSD 1.5/1.6 upgrade
753876 - [RFE] Add support for the services map
755506 - [RFE] Add host-based access control to sssd
759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
761570 - [RFE] support looking up autofs maps via SSSD
761582 - [RFE] Add ldap_sasl_minssf option
766141 - [RFE] SSSD should support FreeIPA's internal netgroup representation
766876 - [RFE] Make HBAC srchost processing optional
766904 - [RFE] Create a command line tool to change the debug levels on the fly
766907 - Use [...] for IPv6 addresses in kdc info files
766913 - [RFE] Add option to select validate and FAST keytab principal name
766930 - [RFE] Add a new option to override home directory value
766941 - The full dyndns update message should be logged into debug logs
768935 - Crash when apply settings
771361 - case_sensitive function not working as intended for ldap
771702 - sssd_pam crashes during change password operation against a IPA server.
772163 - Iterator loop reuse cases a tight loop in the native IPA netgroups code
772297 - Fails to update if all nisNetgroupTriple or memberNisNetgroup entries are deleted from a netgroup.
773660 - Kerberos errors should go to syslog
783138 - Backend occasionally goes offline under heavy load.
784870 - SSSD fails during autodetection of search bases for new LDAP features
785741 - sssd.api.conf and sssd.api.d should not be in /etc
785871 - wrong build dependency on nscd
785873 - IPA host search base cannot be set
785879 - sss_obfuscate/python config parser modifies config file too much
785880 - debug_level in sssd.conf overrides command-line
785881 - List the keytab to pick the princiapl to use instead of guessing
785883 - check DNS records before updates
785884 - Honour TTL when resolving host names
785888 - sssd returns empty netgroup at a second request for an non-existing netgroup
785898 - Enable midway cache refresh by default
785902 - Errors with empty loginShell and proxy provider
785904 - [RFE] SSSD should have --version option
785905 - [RFE] DEBUG timestamps should offer higher precision
785907 - [RFE] Add support to request canonicalization on krb AS requests
785908 - ldap_*_search_base doesn't fully limit the group / netgroup search base correctly
785909 - --debug-timestamps=1 is not passed to providers
786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as a dependancy
788979 - sssd crashes during initgroups against a user belonging to nested rfc2307bis group.
791208 - Entries lacking a POSIX username value break group lookups
795562 - Infinite loop checking Kerberos credentials
796307 - Simple Paged Search control needs to be used more sparingly
797282 - sssd-1.5.1-66.el6.x86_64 needs openldap >=openldap-2.4.23-20.el6.x86_64
797975 - sssd_be: The requested target is not configured is logged at each login
798317 - sssd crashes when ipa_hbac_support_srchost is set to true.
798655 - Password logins failing due to a process with high UID
798774 - IPA provider should assume that ipa_domain is also the dns_discovery_domain
798881 - Install-time warnings
799915 - Unable to lookup netgroups with case_sensitive=false.
799929 - Raise limits for max num of files sssd_nss/sssd_pam can use
799971 - sssd_be crashes on shutdown
801368 - Group lookups doesn't return members with proxy provider configured.
801377 - getent returns non-existing netgroup name, when sssd is configured as proxy provider
801407 - sssd_nss gets hung processing identical search requests
801533 - sssd_be crashes when resolving non-trivial nested group structure
802207 - getent netgroup hangs when "use_fully_qualified_names = TRUE" in sssd
803659 - Service lookup shows case sensitive names twice with case_sensitive=false
803842 - Unable to bind to LDAP server when minssf set
803937 - sssd crashed after "LDAP connection error"
804057 - Initial service lookups having name with uppercase alphabets doesn't work.
804065 - Service lookup using case-sensitive protocol names doesn't work when case_sensitive=false.
805034 - accessing an undefined variable might cause crash
805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login
805281 - sssd: Uses the wrong key when there a multiple realms in a single keytab.
805452 - Unable to lookup user, group, netgroup aliases with case_sensitive=false.
805729 - sssd_nss dies and does not get restarted properly
805918 - Wrong resolv_status might cause crash when name resolution times out
805924 - SSSD should attempt to get the RootDSE after binding
808458 - Authconfig crashes when sets krb realm
808597 - sssd_nss crashes on request when no back end is running
812281 - autofs client: map name length used as key length
814237 - sdap_check_aliases must not error when detects the same user
814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes
816616 - group members are now lowercased in case insensitive domains
818642 - Auth fails for user with non-default attribute names
819063 - sssd fails to provide partial data till paged search returns "Size Limit Exceeded"
820585 - Group enumeration fails in proxy provider
820759 - AVC denial seen on sssd upgrade during ipa-client upgrade
821044 - sss_groupadd no longer detects duplicate GID numbers
822236 - SSSD netgroups do not honor entry_cache_nowait_percentage
824616 - sssd_nss crashes when configured with use_fully_qualified_names = true
825028 - Service lookups by port number doesn't work on s390x/ppc64 arches

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/sssd.html#RHBA-2012-0747