-
Notifications
You must be signed in to change notification settings - Fork 34
/
CHANGELOG
392 lines (315 loc) · 16 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
* Fri Sep 13 2024 Steven Pritchard <[email protected]> - 7.11.0
- [puppetsync] Update module dependencies to support simp-iptables 7.x
* Wed Apr 10 2024 Mike Riddle <[email protected]> - 7.10.0
- Added the pam_cert_auth parameter to the pam service
- Added the ldap_user_cert parameter to the ldap provider
- Users can now specify ldap providers via hieradata using sssd::ldap_providers
* Wed Nov 29 2023 Virus2500 <[email protected]> - 7.9.0
- add domain option ldap_user_search_filter
* Mon Oct 23 2023 Steven Pritchard <[email protected]> - 7.8.0
- [puppetsync] Add EL9 support
* Wed Oct 11 2023 Steven Pritchard <[email protected]> - 7.7.0
- [puppetsync] Updates for Puppet 8
- These updates may include the following:
- Update Gemfile
- Add support for Puppet 8
- Drop support for Puppet 6
- Update module dependencies
* Thu Aug 31 2023 Steven Pritchard <[email protected]> - 7.6.0
- Add AlmaLinux 8 support
* Mon Jun 12 2023 Chris Tessmer <[email protected]> - 7.5.0
- Add RockyLinux 8 support
* Thu Aug 25 2022 Chris Tessmer <[email protected]> - 7.4.2
- Fixed:
- Made the `ldap_uri` parameter optional
* Fri Jul 15 2022 Mark Fitch <[email protected]> - 7.4.1
- Fixed:
- Added missing parameters `ldap_user_extra_attrs` and
`ldap_user_ssh_public_key` to allow SSH keys to be fetched from AD
* Wed Jun 22 2022 Yehuda Katz <[email protected]> - 7.4.1
- Allow `krb5_server` to be optional as implemented in the template
* Fri Jun 03 2022 Chris Tessmer <[email protected]> - 7.4.0
- Update from camptocamp/systemd to puppet/systemd
* Thu May 26 2022 Chris Tessmer <[email protected]> - 7.3.0
- Changed:
- Made provider parameters Optional to support certain AD/realmd configurations:
- sssd::provider::krb5::krb5_server
- sssd::provider::ldap::ldap_search_base
- sssd::provider::ldap::ldap_default_bind_dn
- Fixed:
- nil? bug in template for ad provider
* Fri Aug 27 2021 Henry Pauli <[email protected]> - 7.2.0
- Add an option in sssd::install to not install sssd client.
This aids in better compatibility with non RedHat based systems
where the ssssd-client package may not exists.
* Thu Aug 05 2021 Trevor Vaughan <[email protected]> - 7.1.1
- Add an override for sssd-sudo.service to start it as root:root. This aligns
with how sssd itself would start the service and the daemon cannot access
/var/lib/sss/db/config.ldb otherwise.
* Thu Jun 17 2021 Chris Tessmer <[email protected]> - 7.1.0
- Removed support for Puppet 5
- Ensured support for Puppet 7 in requirements and stdlib
* Thu Jun 03 2021 Jeanne Greulich <[email protected]> - 7.0.2
- Added tests for ds389 ldap server
- SSSD will not start and the module fail if no domains are
defined. The enable_files_domain setting is set to true to ensure
that sssd will start.
* Wed Jun 02 2021 Trevor Vaughan <[email protected]> - 7.0.1
- Fixed:
- sssd-sudo.socket service
* Wed May 19 2021 Trevor Vaughan <[email protected]> - 7.0.0
- Fixed:
- `sssd::provider::ldap::ldap_pwd_policy` is based on the value in
`ldap_account_expire_policy` to properly account for non-shadow systems
- `sssd::provider::ldap::ldap_access_order` is set to the modern set
- A typo in the `sssd::LdapAccountExpirePol` data type was fixed
- Ported the krb5 ERB template to EPP and fixed a typo
- Removed:
- `sssd::manage_service` - obsolete
- `sssd::ldap_access_order_defaults()` - obsolelte
- Removed EL6-only artifacts
- Removed the `LOCAL` domain
- Support for Puppet 5 was dropped
- Changed:
- Fail if a version of `sssd` is being managed < 1.16.0
- Now use the `/etc/sssd/conf.d` directory instead of `concat`
- The `sssd::service` class is now private
- Moved the `/etc/sssd` directory configuration into `sssd::config`
- Added:
- `sssd::config::entry` defined type which allows consistent management of
permissions and dependencies on config files
- Users can set `sssd::custom_config` to a `String` that will be placed into
`/etc/sssd/conf.d/zz_puppet_custom.conf`
- Allow users to optionally purge the `/etc/sssd/conf.d` directory (disabled
by default)
- Trigger the `sssd-sudo.socket` service instead of including the service in
the main configuration per the `sssd` documentation and error messages in
the logs
- Support for puppetlabs/stdlib 7 was added
* Thu Feb 18 2021 Trevor Vaughan <[email protected]> - 6.4.0-0
- Ensure that systems bound to FreeIPA, but not connected do not cause
compilation issues.
* Wed Jan 13 2021 Chris Tessmer <[email protected]> - 6.4.0-0
- Removed EL6 from supported OSes
- Added puppet 7 support
* Thu Apr 23 2020 Trevor Vaughan <[email protected]> - 6.3.1-0
- Ensure that EL6/7+ use the 'files' or 'local' provider as is appropriate for
their platform
- Migrate the documentation to focus on the 'files' provider since 'local' is
not recommended to be used any longer
- Fixed the core acceptance tests
* Tue Jan 21 2020 Jeanne Greulich <[email protected]> - 6.3.0-0
- Added EL8 support
- Removed requirement for sssd domain entry for el8 and SSSD V2 since
using the implicit files provider is valid and even recommended
for performance by some. An sssd domain is still required for
el6 and el7.
- Automatically include the service section if the service is included in
sssd::services.
- Removed deprecated variables from ldap provider for EL8.
- Added new variables for providers in EL8.
- Added ifp to list of services in service type
- Added files to types of providers
- Added support for simplib version 4.0
* Tue Jun 04 2019 steven.pritchard <[email protected]> - 6.2.0-0
- Add v2 compliance_markup data
* Thu Mar 14 2019 Trevor Vaughan <[email protected]> - 6.1.6-0
- Fix the Active Directory tests
* Mon Mar 04 2019 Liz Nemsick <[email protected]> - 6.1.6-0
- Expanded the upper limit of the stdlib Puppet module version
- Updated URLs in the README.md
* Fri Feb 22 2019 Trevor Vaughan <[email protected]> - 6.1.5-0
- Change the sssd::provider::ldap::ldap_access_order defaults to
['ppolicy','pwd_expire_policy_renew'] by default to prevent accidental system
lockouts on upgrade.
* Mon Jan 21 2019 Trevor Vaughan <[email protected]> - 6.1.4-0
- Generated a REFERENCE.md
- Set the 'min_id' settings across the board to '1' to match the sssd defaults
since they really have nothing to do with the target system's relationship
with a centralized authentication service.
- Update the sssd::provider::ldap::ldap_access_order parameter to support the
ppolicy related options that were added in sssd 1.14.0
- ppolicy
- pwd_expire_policy_reject
- pwd_expire_policy_warn
- pwd_expire_policy_renew
* Fri Oct 12 2018 Nick Miller <[email protected]> - 6.1.3-0
- Changed $sssd::install::package_ensure from 'latest' to 'installed'
- It will also respect `simp_options::package_ensure`
* Tue Sep 18 2018 Adam Yohrling <[email protected]> - 6.1.3-0
- Added OracleLinux to operating system check for 128 bit cipher
work-around
* Tue Aug 28 2018 Liz Nemsick <[email protected]> - 6.1.3-0
- Fixed a bug in which the ldap_account_expire_policy setting
for the LDAP provider could not be configured to use the system
default. Now, when sssd::provider::ldap::ldap_account_expire_policy
is set to '', that configuration parameter will not be written
to the sssd configuration file. This allows the system default to
be applied.
- Fixed a bug in which any boolean setting for the LDAP provider
configuration could not be configured to be 'false'.
- Fixed bugs in which sssd::provider::ldap::debug_timestamps and
sssd::provider::ldap::ldap_search_timeout were erroneously typed to
be strings, instead of a Boolean and an Integer, respectively.
- Fixed bugs in which ad_enable_dns_sites, ad_enable_gc settings,
dyndns_update, dyndns_update_ptr, krb5_use_enterprise_principal,
and ldap_idmap_autorid_compat settings for the AD provider could
not be configured to be 'false'.
- Fixed bugs in which ad_gpo_map_interactive, ad_gpo_map_remote_interactive,
ad_gpo_map_network, ad_gpo_map_batch, ad_gpo_map_service, ad_gpo_map_permit
and ad_gpo_map_deny settings for the AD provider were incorrectly formatted.
- Fixed a bug in which the dyndns_iface setting for the AD provider was not
set from sssd::provider::ad::dyndns_ifaces.
* Thu Aug 23 2018 Adam Yohrling <[email protected]> - 6.1.3-0
- Add support for Oracle Enterprise Linux
- Add support for Puppet 5
* Fri Jul 13 2018 Adam Yohrling <[email protected]> - 6.1.3-0
- Added ldap_use_tokengroups, ldap_group_objectsid, ldap_user_objectsid to sssd::provider::ad
- Updated required version of puppetlabs-stdlib to 4.19.0 since fact function is used
* Tue Jun 19 2018 Nick Miller <[email protected]> - 6.1.2-0
- Avoid changing the permissions from the vendored RPM
- /etc/sssd/ owner is no longer managed
- /etc/sssd/ perms went from 0640 to 0711
- /etc/init.d/sssd went from 0754 to 0755 on EL6
- Update version range of auditd dependency in metadata.json
- Cleanup requires in metadata.json
- Cleanup unneeded fixtures and update CI assets
* Wed Mar 28 2018 Nick Miller <[email protected]> - 6.1.1-0
- sssd::provider::ad::ldap_schema should be a string, not a boolean
- AD test cleanup
* Wed Mar 14 2018 Philippe Muller <[email protected]> - 6.1.0-0
- Allow passing ldap_tls_cacert to sssd::provider::ldap
* Wed Feb 28 2018 Nick Miller <[email protected]> - 6.1.0-0
- Some template and concat changes to make debugging the module easier
- Add headers to more easily diagnose where to stick params
- Order the concat sections
- Add some missing params from sssd::provider::ad
- default_shell
- dyndns_update
- fallback_homedir
- krb5_realm
- krb5_store_password_if_offline
- ldap_schema
* Fri Jan 19 2018 Liz Nemsick <[email protected]> - 6.1.0-0
- Added sssd class option to automatically configure SSSD for an IPA
domain, when the host is joined to an IPA domain.
* Fri Dec 15 2017 Liz Nemsick <[email protected]> - 6.1.0-0
- Leveraged PR from Mark Fitch to add ima provider configuration
* Wed Dec 13 2017 Trevor Vaughan <[email protected]> - 6.1.0-0
- Enforce limits set in /etc/login.defs for uid_min and uid_max by default and
fall back to something sensible for SSSD
* Mon Sep 18 2017 Lucas Yamanishi <[email protected]> - 6.0.4-0
- Set minimum length on sssd::domains
* Mon Sep 11 2017 Judy Johnson <[email protected]> - 6.0.3-0
- Only enable 'try_inotify' if explicitly set
* Wed Aug 30 2017 Nick Markowski <[email protected]> - 6.0.3-0
- Sssd::DebugLevel now handles all variants specfied in sssd.conf man page
- All instances of debug_level are now typed as Sssd::DebugLevel
* Thu Jul 06 2017 Liz Nemsick <[email protected]> - 6.0.2-0
- Confine puppet version in metadata.json
* Fri Apr 07 2017 Trevor Vaughan <[email protected]> - 6.0.1-0
- Worked around a bug in EL6 where the ldap client library incorrectly handles
128 bit ciphers in the cipher list
* Fri Mar 17 2017 Clayton Mentzer, Liz Nemsick 6.0.0-1
- Updated README
- Update puppet version in .travis.yaml
* Thu Feb 09 2017 Jeanne Greulich <[email protected]> - 6.0.0-0
- Changed type of debug level to be consistent for all modules.
* Mon Jan 23 2017 Trevor Vaughan <[email protected]> - 6.0.0-0
- Migrated to using puppetlabs-concat
- Added support for Active Directory Domains
* Thu Jan 12 2017 Nick Markowski <[email protected]> - 6.0.0-0
- Updated to use new pki scheme.
- Application certs now managed in /etc/pki/simp_apps/sssd/x509
- Strongly typed
* Mon Dec 19 2016 Jeanne Greulich <[email protected]> - 6.0.0-0
- Update Global Catalysts
* Wed Nov 23 2016 Jeanne Greulich <[email protected]> - 5.0.0-0
- Fix dependancies for simp 6 bump
* Mon Nov 21 2016 Chris Tessmer <[email protected]> - 5.0.0-0
- Updated to compliance_markup version 2
* Fri Sep 30 2016 Trevor Vaughan <[email protected]> - 5.0.0-0
- Updated to use the version of 'simpcat' that does not conflict with
'puppetlabs/concat'.
* Mon Aug 01 2016 Nicholas Hughes <[email protected]> - 4.1.3-0
- Fixed incorrect variable references in ldap.erb.
* Sat Mar 19 2016 Trevor Vaughan <[email protected]> - 4.1.2-0
- Migrated use_simp_pki to a global catalyst.
* Mon Mar 14 2016 Trevor Vaughan <[email protected]> - 4.1.1-0
- Moved to Semantic Versioning 2.0
- Fixed a bug in the LDAP provider where we had
`ldap_chpass_updates_last_change` as well as
`ldap_chpass_update_last_change`. These were consolidated into a correct
single `ldap_chpass_update_last_change` Boolean.
- Removed RPM dependencies on 'simp-boostrap' and 'puppet' since these are
technically not necessary for just installing the module.
* Tue Mar 01 2016 Ralph Wright <[email protected]> - 4.1.0-9
- Added compliance function support
* Thu Dec 24 2015 Trevor Vaughan <[email protected]> - 4.1.0-8
- Added an sssd::install::client class for installing only the client
libraries.
* Mon Nov 09 2015 Chris Tessmer <[email protected]> - 4.1.0-7
- migration to simplib and simpcat (lib/ only)
* Thu Apr 02 2015 Trevor Vaughan <[email protected]> - 4.1.0-7
- Fixed variable references in some templates.
* Thu Feb 19 2015 Trevor Vaughan <[email protected]> - 4.1.0-6
- Migrated to the new 'simp' environment.
* Fri Jan 16 2015 Trevor Vaughan <[email protected]> - 4.1.0-4
- Changed puppet-server requirement to puppet
* Thu Nov 06 2014 Chris Tessmer <[email protected]> - 4.1.0-3
- Remove sssd::conf as it is no longer needed and causes duplicate
concat_fragment error
* Fri Oct 17 2014 Trevor Vaughan <[email protected]> - 4.1.0-2
- CVE-2014-3566: Updated cipher suites to help mitigate POODLE.
- The tls_cipher_suite variable is set to HIGH:-SSLv2 because OpenLDAP
cannot set the SSL provider natively. By default, it will run TLSv1
but cannot handle TLSv1.2 therefore the SSLv3 ciphers cannot be
eliminated. Take care to ensure that your clients only connect with
TLSv1 if possible.
* Sun Jun 22 2014 Kendall Moore <[email protected]> - 4.1.0-1
- Removed MD5 file checksums for FIPS compliance.
* Mon Apr 14 2014 Kendall Moore <[email protected]> - 4.1.0-0
- Refactored manifests to pass all lint tests.
- Removed all singleton defines.
- Added spec tests.
* Fri Apr 04 2014 Trevor Vaughan <[email protected]> - 4.1.0-0
- Added some validation and removed the 'stock' class. It now resides in the
'simp' module.
- Collapsed the sssd::conf class into sssd.
* Thu Feb 13 2014 Kendall Moore <[email protected]> - 4.0.0-1
- Converted all string booleans to native booleans.
* Fri Oct 25 2013 Trevor Vaughan <[email protected]> - 4.0.0-0
- Updated all 'source' File parameters to use the modules directory
for Puppet 3 compatibility.
* Mon Oct 07 2013 Kendall Moore <[email protected]> 2.0.0-8
- Updated all erb templates to properly scope variables.
* Mon Jan 07 2013 Maintenance
2.0.0-7
- Created a Cucumber test to toggle the sssd flag to true and ensure that the
sssd service is running and the nscd service is stopped.
* Thu Jun 07 2012 Maintenance
2.0.0-6
- Ensure that Arrays in templates are flattened.
- Call facts as instance variables.
- Moved mit-tests to /usr/share/simp...
- Updated pp files to better meet Puppet's recommended style guide.
* Fri Mar 02 2012 Maintenance
2.0.0-5
- Improved test stubs.
* Mon Dec 26 2011 Maintenance
2.0-4
- Updated the spec file to not require a separate file list.
* Mon Oct 03 2011 Maintenance
2.0-3
- Updates to work around the fact that the latest version of SSSD will silently
allow expired users to access the system due to bugs in the way it works with
OpenLDAP.
* Fri Jul 15 2011 Maintenance
2.0-2
- Ensure that the minimum uid for LDAP is set to 501 by default.
* Wed May 25 2011 Maintenance - 2.0.0-1
- Updated to fix a bug where nscd was not getting shut down at boot time and
sssd was not triggered to start.
* Tue Apr 05 2011 Maintenance - 2.0.0-0
- Initial offering of the SSSD module.
- The use requires the $use_sssd variable to be set to 'true' within scope.