From 8c39f3cfd882f530ecc70517ed083cd89d73c3d7 Mon Sep 17 00:00:00 2001
From: Michal Židek <mzidek@redhat.com>
Date: Sep 16 2019 15:15:26 +0000
Subject: [PATCH 1/2] Release notes for SSSD 2.2.1


---

diff --git a/users/releases.rst b/users/releases.rst
index f143204..dfe3b08 100644
--- a/users/releases.rst
+++ b/users/releases.rst
@@ -9,6 +9,8 @@ for a longer time than other releases.
 2.x Series
 ^^^^^^^^^^
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-2.2.1.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz>`_     |`sssd-2.2.1.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz.asc>`_   |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes <relnotes/notes_2_2_1>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.1/man/>`_ |
++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`sssd-2.2.0.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.0.tar.gz>`_     |`sssd-2.2.0.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.0.tar.gz.asc>`_   |SHA256SUM: ``ae618d73c7dc174a1481853ddbea82896bef031c623d374c77888e45b7d88558``|Date: 2019-06-13|:doc:`Release notes <relnotes/notes_2_2_0>`  |`Manpages <http://jhrozek.fedorapeople.org/sssd/2.2.0/man/>`_ |
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`*sssd-2.1.0.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.1.0.tar.gz>`_    |`sssd-2.1.0.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.1.0.tar.gz.asc>`_   |SHA256SUM: ``10f04bd8a1ae7e888e2bcc13edc1a64ef19b4990866c09c65c667d0c72b66743``|Date: 2019-02-27|:doc:`Release notes <relnotes/notes_2_1_0>`  |`Manpages <http://jhrozek.fedorapeople.org/sssd/2.1.0/man/>`_ |
diff --git a/users/relnotes/notes_2_2_1.rst b/users/relnotes/notes_2_2_1.rst
new file mode 100644
index 0000000..eac23f3
--- /dev/null
+++ b/users/relnotes/notes_2_2_1.rst
@@ -0,0 +1,189 @@
+SSSD 2.2.1
+==========
+
+
+Highlights
+----------
+
+New features
+^^^^^^^^^^^^
+* New options were added which allow sssd-kcm to handle bigger data.
+  See manual pages for ``max_ccaches``, ``max_uid_caches``  and
+  ``max_ccache_size``.
+* SSSD can now automatically refresh cached user data from subdomains
+  in IPA/AD trust.
+
+Notable bug fixes
+^^^^^^^^^^^^^^^^^
+* Fixed issue with SSSD hanging when connecting to non-responsive
+  server with ldaps://
+* SSSD is now restarted by systemd after crashes.
+* Fixed refression when dyndns_update was set to True and
+  dyndns_refresh_interval was not set or set to 0 then DNS
+  records were not updated at all.
+* Fixed issue when ``default_domain_suffix`` was used with
+  ``id_provider = files`` and caused all results from files domain to be
+  fully qualified.
+* Fixed issue with sudo rules not being visible on OpenLDAP servers
+* Fixed crash with ``auth_provider = proxy`` that prevented logins
+
+
+Packaging Changes
+-----------------
+None
+
+Documentation Changes
+---------------------
+A new option ``dns_resolver_server_timeout`` was added
+A new option ``max_ccaches`` was added
+A new option ``max_uid_ccaches`` was added
+A new option ``max_ccache_size`` was added
+A new option ``ocsp_dgst`` was added
+
+Tickets Fixed
+-------------
+ * `2878 <https://pagure.io/SSSD/sssd/issue/2878>`_ - sssd failover does not work on connecting to non-responsive ldaps:// server
+ * `3217 <https://pagure.io/SSSD/sssd/issue/3217>`_ - Conflicting default timeout values
+ * `3386 <https://pagure.io/SSSD/sssd/issue/3386>`_ - sssd-kcm cannot handle big tickets
+ * `3489 <https://pagure.io/SSSD/sssd/issue/3489>`_ - p11_child should work wit openssl1.0+
+ * `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly
+ * `3833 <https://pagure.io/SSSD/sssd/issue/3833>`_ - port to pcre2
+ * `3894 <https://pagure.io/SSSD/sssd/issue/3894>`_ - multihost tests: ldb-tools is needed for multihost tests
+ * `3905 <https://pagure.io/SSSD/sssd/issue/3905>`_ - SSSD doesn't clear cache entries for IDs below min_id.
+ * `4012 <https://pagure.io/SSSD/sssd/issue/4012>`_ - SSSD is not refreshing cached user data for the ipa sub-domain in a IPA/AD trust
+ * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 
+ * `4028 <https://pagure.io/SSSD/sssd/issue/4028>`_ - sssd-kcm calls sssd-genconf which triggers nscd warning 
+ * `4037 <https://pagure.io/SSSD/sssd/issue/4037>`_ - Logins fail after upgrade to 2.2.0 
+ * `4040 <https://pagure.io/SSSD/sssd/issue/4040>`_ - Reasonable to Restart sssd on crashes? 
+ * `4046 <https://pagure.io/SSSD/sssd/issue/4046>`_ - sudo: incorrect usn value for openldap 
+ * `4047 <https://pagure.io/SSSD/sssd/issue/4047>`_ - dyndns_update = True is no longer not enough to get the IP address of the machine updated in IPA upon sssd.service startup 
+ * `4050 <https://pagure.io/SSSD/sssd/issue/4050>`_ - nss_cmd_endservent resets the wrong index 
+ * `4052 <https://pagure.io/SSSD/sssd/issue/4052>`_ - sssd config option "default_domain_suffix" should not cause the files domain entries to be qualified 
+ * `3931 <https://pagure.io/SSSD/sssd/issue/3931>`_ - proxy provider is not working with enumerate=true when trying to fetch all groups 
+ * `4043 <https://pagure.io/SSSD/sssd/issue/4043>`_ - Typo in systemd.m4 prevents detection of systemd.pc
+ * `3978 <https://pagure.io/SSSD/sssd/issue/3978>`_ - UPN negative cache does not use values from 'filter_users' config option 
+ * `4032 <https://pagure.io/SSSD/sssd/issue/4032>`_ - p11_child::do_ocsp() function implementation is not FIPS140 compliant 
+ * `4039 <https://pagure.io/SSSD/sssd/issue/4039>`_ - p11_child::sign_data() function implementation is not FIPS140 compliant 
+ * `4056 <https://pagure.io/SSSD/sssd/issue/4056>`_ - permission denied on logs when running sssd as non-root user 
+ * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG 
+ * `2854 <https://pagure.io/SSSD/sssd/issue/2854>`_ - FAIL test-find-uid 
+ * `3962 <https://pagure.io/SSSD/sssd/issue/3962>`_ - Problem with tests/cmocka/test_dyndns.c
+ * `4022 <https://pagure.io/SSSD/sssd/issue/4022>`_ - utils: sss_hmac_sha1() function implementation is not FIPS140 compliant 
+ * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG 
+ * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 
+
+Detailed changelog
+------------------
+Alex Rodin (1):
+      tests/cmocka/test_dyndns.c: Switching from tevent_loop_once() to tevent_loop_wait()
+
+Alexey Tikhonov (14):
+      util/crypto/libcrypto: changed sss_hmac_sha1()
+      util/crypto/libcrypto: changed sss_hmac_sha1()
+      util/secrets: memory leaks are fixed
+      util/crypto/nss/nss_nite: params sanitization
+      crypto/libcrypto/crypto_nite: HMAC calculation changed
+      util/find_uid.c: fixed debug message
+      util/find_uid.c: fixed race condition bug
+      util/crypto: removed erroneous declaration
+      util/crypto/sss_crypto.c: cleanup of includes
+      util/crypto: generate_csprng_buffer() changed
+      util/crypto: added sss_rand()
+      crypto/libcrypto/crypto_nite.c: memory leak fixed
+      FIPS140 compliant usage of PRNG
+      crypto/nss: some nss_ctx_init() params made const
+
+Jakub Hrozek (34):
+      Updating the version for the 2.2.1 release
+      TESTS: Install expect to drive password-change modifications
+      TESTS: Also add LDAP password when creating users
+      TESTS: Test changing LDAP password with extended operation and modification
+      TEST: Add a multihost test for not returning / for an empty home dir
+      MONITOR: Don't check for the nscd socket while regenerating configuration
+      SYSDB: Add sysdb_search_with_ts_attr
+      BE: search with sysdb_search_with_ts_attr
+      BE: Enable refresh for multiple domains
+      BE: Make be_refresh_ctx_init set up the periodical task, too
+      BE/LDAP: Call be_refresh_ctx_init() in the provider libraries, not in back end
+      BE: Pass in attribute to look up with instead of hardcoding SYSDB_NAME
+      BE: Change be_refresh_ctx_init to return errno and set be_ctx->refresh_ctx
+      BE/LDAP: Split out a helper function from sdap_refresh for later reuse
+      BE: Pass in filter_type when creating the refresh account request
+      BE: Send refresh requests in batches
+      BE: Extend be_ptask_create() with control when to schedule next run after success
+      BE: Schedule the refresh interval from the finish time of the last run
+      AD: Implement background refresh for AD domains
+      IPA: Implement background refresh for IPA domains
+      BE/IPA/AD/LDAP: Add inigroups refresh support
+      BE/IPA/AD/LDAP: Initialize the refresh callback from a list to reduce logic duplication
+      IPA/AD/SDAP/BE: Generate refresh callbacks with a macro
+      MAN: Amend the documentation for the background refresh
+      DP/SYSDB: Move the code to set initgrExpireTimestamp to a reusable function
+      IPA/AD/LDAP: Increase the initgrExpireTimestamp after finishing refresh request
+      MAN: Get rid of sssd-secrets reference
+      MAN: Document that it is enough to systemctl restart sssd-kcm.service lately
+      SECRETS: Use different option names from secrets and KCM for quota options
+      SECRETS: Don't limit the global number of ccaches
+      KCM: Pass confdb context to the ccache db initialization
+      KCM: Configurable quotas for the secdb ccache back end
+      TESTS: Add tests for the configurable quotas
+      Don't qualify users from files domain when default_domain_suffix is set
+
+Jakub Jelen (1):
+      pam_sss: Add missing colon to the PIN prompt
+
+Lukas Slebodnik (1):
+      PROXY: Return data in output parameter if everything is OK
+
+Michal Židek (2):
+      TESTS: ldb-tools and sssd-tools are required for multihost tests
+      Update the translations for the 2.2.1 release
+
+Niranjan M.R (1):
+      TESTS: Test kvno correctly displays vesion numbers of principals
+
+Pavel Březina (11):
+      ci: disable timeout
+      ci: switch to new tooling and remove 'Read trusted files' stage
+      ci: rebase pull request on the target branch
+      ci: print node on which the test is being run
+      sudo: use proper datetime for default modifyTimestamp value
+      systemd: add Restart=on-failure to sssd.service
+      man: fix description of dns_resolver_op_timeout
+      man: fix description of dns_resolver_timeout
+      failover: add dns_resolver_server_timeout option
+      failover: change default timeouts
+      config: add dns_resolver_op_timeout to option list
+
+Sam Morris (1):
+      build: fix detection of systemd.pc
+
+Samuel Cabrero (1):
+      nss: Fix command 'endservent' resetting wrong struct member
+
+Sumit Bose (10):
+      negcache: add fq-usernames of know domains to all UPN neg-caches
+      p11_child: prefer better digest function if card supports it
+      p11_child: fix a memory leak and other memory mangement issues
+      pam: make sure p11_child.log has the right permissions
+      ssh: make sure p11_child.log has the right permissions
+      BE: make sure child log files have the right permissions
+      utils: remove unused prototype (cert_to_ssh_key)
+      utils: move parse_cert_verify_opts() into separate file
+      p11_child: make OCSP digest configurable
+      pam: fix loop in Smartcard authentication
+
+Tomas Halman (9):
+      MAN: ldap_user_home_directory default missing
+      pcre: port to pcre2
+      CACHE: SSSD doesn't clear cache entries
+      LDAP: failover does not work on non-responsive ldaps
+      CONFDB: Files domain if activated without .conf
+      TESTS: adapt tests to enabled default files domain
+      BE: Introduce flag for be_ptask_create
+      BE: Convert be_ptask params to flags
+      DYNDNS: dyndns_update is not enough
+
+Yuri Chornoivan (1):
+      Fix minor typos in docs
+

From 31da1a6000983ec52a1b9dace853f0f03d55f1d6 Mon Sep 17 00:00:00 2001
From: Michal Židek <mzidek@redhat.com>
Date: Sep 16 2019 15:15:38 +0000
Subject: [PATCH 2/2] Add release notes for SSSD 2.2.2


---

diff --git a/users/releases.rst b/users/releases.rst
index dfe3b08..a148424 100644
--- a/users/releases.rst
+++ b/users/releases.rst
@@ -9,6 +9,8 @@ for a longer time than other releases.
 2.x Series
 ^^^^^^^^^^
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-2.2.2.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.2.tar.gz>`_     |`sssd-2.2.2.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.2.tar.gz.asc>`_   |SHA256SUM: ``5349a809d2e79ed6bbd875a49532e7e03c1e2e732c75e8d15e9e7de57d5a07d7``|Date: 2019-09-12|:doc:`Release notes <relnotes/notes_2_2_2>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.2/man/>`_ |
++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`sssd-2.2.1.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz>`_     |`sssd-2.2.1.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.1.tar.gz.asc>`_   |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes <relnotes/notes_2_2_1>`  |`Manpages <http://mzidek.fedorapeople.org/sssd/2.2.1/man/>`_ |
 +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 |`sssd-2.2.0.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-2.2.0.tar.gz>`_     |`sssd-2.2.0.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-2.2.0.tar.gz.asc>`_   |SHA256SUM: ``ae618d73c7dc174a1481853ddbea82896bef031c623d374c77888e45b7d88558``|Date: 2019-06-13|:doc:`Release notes <relnotes/notes_2_2_0>`  |`Manpages <http://jhrozek.fedorapeople.org/sssd/2.2.0/man/>`_ |
diff --git a/users/relnotes/notes_2_2_2.rst b/users/relnotes/notes_2_2_2.rst
new file mode 100644
index 0000000..29081cc
--- /dev/null
+++ b/users/relnotes/notes_2_2_2.rst
@@ -0,0 +1,104 @@
+SSSD 2.2.2
+==========
+
+
+Highlights
+----------
+
+New features
+^^^^^^^^^^^^
+None
+
+Notable bug fixes
+^^^^^^^^^^^^^^^^^
+* Removing domain from ad_enabled_domain was not reflected in SSSD's
+  cache. This has been fixed.
+* Because of a race condition SSSD could crash during shutdown. The race
+  condition was fixed.
+* Fixed a bug that limited number of external groups fetched by SSSD to 2000.
+* pam_sss now properly creates gnome keyring during login.
+* SSSD with KCM could wrongly pick older ccache instead of the latest one after
+  login. This was fixed.
+
+Packaging Changes
+-----------------
+None
+
+Documentation Changes
+---------------------
+None
+
+Tickets Fixed
+-------------
+ * `3932 <https://pagure.io/SSSD/sssd/issue/3932>`_ - MAN: Document that PAM stack contains the systemd-user service in the account phase in recent distributions
+ * `4009 <https://pagure.io/SSSD/sssd/issue/4009>`_ - Removing domain from ad_enabled_domains is not reflected in cache
+ * `4058 <https://pagure.io/SSSD/sssd/issue/4058>`_ - Paging not enabled when fetching external groups, limits the number of external groups to 2000
+ * `4063 <https://pagure.io/SSSD/sssd/issue/4063>`_ - sssd-kcm: type confusion on KDC offset
+ * `4067 <https://pagure.io/SSSD/sssd/issue/4067>`_ - pam_sss with smartcard auth does not create gnome keyring
+ * `4068 <https://pagure.io/SSSD/sssd/issue/4068>`_ - pam_sss: empty smart card pin registers as authentication attempt
+ * `4069 <https://pagure.io/SSSD/sssd/issue/4069>`_ -  pam_sss should reset PAM_USER based on use_fully_qualified_names option in sssd.conf
+ * `3996 <https://pagure.io/SSSD/sssd/issue/3996>`_ - sudo: do not update last usn when updating expired rules 
+ * `4065 <https://pagure.io/SSSD/sssd/issue/4065>`_ - IFP: GetUserAttr does not search by UPN 
+ * `4074 <https://pagure.io/SSSD/sssd/issue/4074>`_ - Integration tests use python2 unconditionally 
+
+Detailed changelog
+------------------
+Jakub Hrozek (6):
+      MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8
+      IPA: Allow paging when fetching external groups
+      MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8
+      IPA: Allow paging when fetching external groups
+      KCM: Use int32_t type conversion in DEBUG message for int32_t variable
+      KCM: Add a forgotten return
+      KCM: Allow modifications of ccache's principal
+      KCM: Fill empty cache, do not initialize a new one
+
+Lukas Slebodnik (18):
+      BUILD: Add macro for checking python3 modules
+      BUILD: Fix typo of detecting python module for intgcheck
+      BUILD: Move checking of python2 modules for intgcheck
+      BUILD: Add macro for checking pytest for intgcheck
+      BUILD: Change value of variable HAVE_PYTHON2/3_BINDINGS
+      BUILD: Move python checks for intgcheck to macro
+      INTG: Do hot hardcode version of python/pytest in intgcheck
+      BUILD: Prefer python3 for intgcheck
+      intg: Install python3 dependencies for intgcheck on new distros
+      pyhbac: Fix warning Wdiscarded-qualifiers
+      test_pam_responder: Fix unicore error
+      SSSDConfig: Add minimal test for parse method
+      SSSDConfig: Fix SyntaxWarning "is not" with a literal
+      TESTS: Add minimal test for pysss encrypt
+      pysss: Fix DeprecationWarning PY_SSIZE_T_CLEAN
+      pysss_murmur: Fix DeprecationWarning PY_SSIZE_T_CLEAN
+      test_pam_responder: Fix DeprecationWarning invalid escape sequence
+      testlib: Fix SyntaxWarning "is" with a literal
+
+Michal Židek (2):
+      Bumping the version to track the 2.2.2 development
+      Update the translations for the 2.2.2 release
+
+Pavel Březina (12):
+      ad: remove subdomain that has been disabled through ad_enabled_domains from sysdb
+      sysdb: add sysdb_domain_set_enabled()
+      ad: set enabled=false attribute for subdomains that no longer exists
+      sysdb: read and interpret domain's enabled attribute
+      sysdb: add sysdb_list_subdomains()
+      ad: remove all subdomains if only master domain is enabled
+      ad: make ad_enabled_domains case insensitive
+      ci: use python2 version of pytest
+      ci: pep8 was renamed to pycodestyle in Fedora 31
+      ci: remove left overs from previous rebase
+      sudo: do not update last usn value on rules refresh
+      ifp: let cache_req parse input name so it can fallback to upn search
+
+Sumit Bose (5):
+      pam: keep pin on the PAM stack for forward_pass
+      pam: do not accept empty PIN
+      pam: user PAM return codes where expected
+      pam: set PAM_USER properly with allow_missing_name
+      Revert "SERVER: Receving SIGSEGV process on shutdown"
+
+Tomas Halman (3):
+      SERVER: Receving SIGSEGV process on shutdown
+      BE: Invalid oprator used in condition
+      SERVER: Receving SIGSEGV process on shutdown

