sssd - Debian Package Tracker

general

source: sssd (main)
version: 2.12.0-4
maintainer: Debian SSSD Team (archive) (DMD)
uploaders: Timo Aaltonen [DMD] – Dominik George [DMD]
arch: any
std-ver: 4.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.4.1-2
o-o-sec: 2.4.1-2+deb11u1
oldstable: 2.8.2-4+deb12u1
stable: 2.10.1-2
unstable: 2.12.0-4

versioned links

2.4.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.1-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.8.2-4+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.12.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libipa-hbac-dev
libipa-hbac0t64
libnss-sss (2 bugs: 0, 2, 0, 0)
libpam-sss (5 bugs: 0, 4, 1, 0)
libsss-certmap-dev
libsss-certmap0
libsss-idmap-dev
libsss-idmap0
libsss-nss-idmap-dev
libsss-nss-idmap0
libsss-sudo (2 bugs: 1, 1, 0, 0)
python3-libipa-hbac
python3-libsss-nss-idmap
python3-sss
sssd (34 bugs: 0, 33, 1, 0)
sssd-ad (2 bugs: 0, 2, 0, 0)
sssd-ad-common
sssd-common (6 bugs: 0, 5, 1, 0)
sssd-dbus
sssd-idp (1 bugs: 0, 1, 0, 0)
sssd-ipa
sssd-kcm
sssd-krb5 (2 bugs: 0, 2, 0, 0)
sssd-krb5-common
sssd-ldap (2 bugs: 0, 2, 0, 0)
sssd-passkey
sssd-proxy
sssd-tools

action needed

8 security issues in trixie high

There are 8 open security issues in trixie.

3 important issues:

CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

5 issues left for the package maintainer to handle:

CVE-2026-6245: (needs triaging) A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).
CVE-2025-11561: (needs triaging) A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
CVE-2026-12610: (needs triaging) A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
CVE-2026-14474: (needs triaging) A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
CVE-2026-14476: (needs triaging) A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-10-10 Last update: 2026-08-08 22:01

7 security issues in sid high

There are 7 open security issues in sid.

7 important issues:

CVE-2026-6245: A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).
CVE-2026-12610: A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
CVE-2026-14474: A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
CVE-2026-14476: A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

Created: 2026-04-16 Last update: 2026-08-08 22:01

7 security issues in bullseye high

There are 7 open security issues in bullseye.

3 important issues:

CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

4 issues postponed or untriaged:

CVE-2025-11561: (postponed; to be fixed through a stable update) A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
CVE-2026-12610: (postponed; to be fixed through a stable update) A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
CVE-2026-14474: (postponed; to be fixed through a stable update) A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
CVE-2026-14476: (postponed; to be fixed through a stable update) A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

Created: 2026-08-03 Last update: 2026-08-08 22:01

7 security issues in bookworm high

There are 7 open security issues in bookworm.

3 important issues:

CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
CVE-2026-68744: A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

4 issues postponed or untriaged:

CVE-2025-11561: (needs triaging) A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
CVE-2026-12610: (postponed; to be fixed through a stable update) A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
CVE-2026-14474: (postponed; to be fixed through a stable update) A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
CVE-2026-14476: (postponed; to be fixed through a stable update) A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

Created: 2026-08-03 Last update: 2026-08-08 22:01

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:04:06
Last run: 2026-08-08T11:33:55.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:00:19
Last run: 2026-02-02T15:43:14.000Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:02:02
Last run: 2026-07-16T13:44:27.000Z
Previous status: unknown

Created: 2025-11-11 Last update: 2026-08-08 21:47

Multiarch hinter reports 4 issue(s) high

There are issues with the multiarch metadata for this package.

libpam-sss conflicts on 2 files starting with /usr/share/man/man8/pam_sss on amd64, arm64 and 6 more with 26 combinations
libipa-hbac0t64 could be marked Multi-Arch: same
libsss-idmap0 could be marked Multi-Arch: same
libsss-nss-idmap0 could be marked Multi-Arch: same

Created: 2026-01-22 Last update: 2026-08-08 21:47

A new upstream version is available: 2.13.1 high

A new upstream version 2.13.1 is available, you should consider packaging it.

Created: 2026-04-24 Last update: 2026-08-08 19:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-6245: A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).

Created: 2026-04-16 Last update: 2026-05-06 17:02

lintian reports 7 errors and 26 warnings high

Lintian reports 7 errors and 26 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-15 Last update: 2026-03-17 07:00

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-08-08 22:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-05-10 Last update: 2026-08-08 21:01

Depends on packages which need a new maintainer normal

The packages that sssd depends on which need a new maintainer are:

systemtap (#1114760)
- Build-Depends: systemtap-sdt-dev
docbook-xsl (#802370)
- Build-Depends: docbook-xsl

Created: 2019-11-22 Last update: 2026-08-08 20:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.13.1-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit ec28a053fa0140ac89eb3d33ff00e5aba74ad9c6
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Mon Aug 3 10:54:36 2026 +0300

    control: Change maintainer address.

commit e681127686d22d2dc65a2710105b972f55f2259a
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Mon Aug 3 10:01:13 2026 +0300

    source: Update diff-ignore.

commit 032e15d1e0ca30b4e0ac2193d50b5487a028e218
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Mon Aug 3 09:58:56 2026 +0300

    version bump

commit e8834d4f40fb31d0cd94e421b07ecadf9a7f94ac
Merge: 23387910 71168064
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Mon Aug 3 09:58:20 2026 +0300

    Merge branch 'upstream'

commit 233879108ddd07be1f764f419035df394a0274cb
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Mon Aug 3 09:54:37 2026 +0300

    patches: Drop upstreamed patch

commit 7116806484d141b0f6cb051883041b059b6ab29c
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Tue Jun 9 12:32:21 2026 +0000

    Release sssd-2.13.1

commit b9154c27bd6e5dbac59503c32ef06b8de0f25988
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Tue Jun 9 12:32:20 2026 +0000

    pot: update pot files

commit cb1bdedaad0aa156b82c1f36534d8443f6cc0e67
Author: kkz <zhaoshuang@uniontech.com>
Date:   Tue Jun 9 14:23:41 2026 +0800

    resolv: Fix incorrect variable used in ares_parse_txt_reply() error check
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Alejandro López <allopez@redhat.com>
    (cherry picked from commit 4a800e56a52c1eddc4b9e2a379d2e9731be0ef6f)

commit e08f1bd13cba0a576e086751c071014dfae3a82a
Author: Jakub Vávra <jvavra@redhat.com>
Date:   Thu May 28 08:47:06 2026 +0000

    Tests: Update LdapOperations to fail on bind immediately
    
    Co-authored-by: Cursor <cursoragent@cursor.com>
    Reviewed-by: Scott Poore <spoore@redhat.com>
    (cherry picked from commit 9df13ca250dcbc0dd37d3d91a13271787111bc8f)

commit 57209f99cb2b285abe1b20b21bf6b628e9f02eb6
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Mon Jun 8 16:27:41 2026 +0000

    Release sssd-2.13.1

commit 92172fc3a782a66f01390e9fe9c7291c5ad7028f
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Mon Jun 8 16:27:41 2026 +0000

    pot: update pot files

commit cd3809bd1e1f117ba036f923bfedbbe6aa100e23
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Jun 8 11:12:05 2026 +0200

    oidc_child: clarify why a value isn't copied
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    (cherry picked from commit c2f9fff0c8811d62108479be749ef1b90c74980d)

commit 28ca8cc2851f694fa9ea1b47cbb3d6caf3cb73ae
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Jun 8 10:39:31 2026 +0200

    oisc_child: add missing NULL checks
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    (cherry picked from commit 44cd06ba7b58cc92466cd496715042986e19cd7a)

commit 04f661d6e7ee1ce0e8323f72d6b3a7adfcb290b3
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Jun 8 09:59:34 2026 +0200

    oidc_child: remove potential double-free in JSON code
    
    The reference is always stolen if the 'o' format specifier is used even
    in the case of errors.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    (cherry picked from commit f72a7a69dbc972adecf41544c9c5c4e73ecdd240)

commit d217bba4613e381d75a8198305f063487eefe59f
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri May 15 10:08:01 2026 +0200

    test: add tests for oidc_child 'get-device-code'
    
    This new test call oidc_child with the '--get-device-code' option with
    different client authentication methods.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 9a3487d757d9678b4474f53f76d9bf1832aa0083)

commit 7b51a9ba6b5824e77c99d3229765c1271b294cd5
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri May 29 15:43:07 2026 +0200

    oidc_child: add JWT authentication
    
    With the new option --client-auth-method oidc_child can select between
    authentication with a client secret, mutual-TLS/mTLS (RFC-8705) and JWT
    client assertion (RFC-7523). The latter two require a PKCS#12 file with
    the client credentials (certificate and private key) and the password to
    unlock the private key must be provided with the --client-secret or
    --client-secret-stdin option.
    
    :relnote: new oidc_child option --client-auth-method to select between
    authentication with client secret, mutual-TLS/mTLS (RFC-8705) and JWT
    client assertion (RFC-7523). For mTLS all key types supported by libcurl
    can be used. For JWT RS256, ES256, ES384 and ES512 with matching key
    types are supported.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 6577434c7429c3a176c1ba0dfead0d71f3c3c7e3)

commit d50a069694efe430bc2be50f25c6e2713932b3e7
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Apr 15 16:56:31 2026 +0200

    oidc_child: add pkcs12-client-creds option
    
    With the new option pkcs12-client-creds a PKCS#12 file with certificate
    and private key can be specified for client authentication. The client
    credential will be used as a password to unlock the key in the PKCS#12
    file. The PKCS#12 file is used in a way to make mutual TLS (mTLS) work
    with an IdP.
    
    :relnote: new oidc_child option --pkcs12-client-creds to specify the
    path to a PKCS#12 file with certificate and private key for certificate
    based authentication. Password to unlock the private key can be given
    with --client-secret or --client-secret-stdin options.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit ec078ea0e99d5b7038b2a77d7c0d1a46eb17eeac)

commit adf76523c1db58424592a5c662ce7a8489370c08
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Apr 29 16:44:30 2026 +0200

    crypto: add get_jwk_from_pkcs12()
    
    To allow signing web tokens with the help of libjose the new function
    get_jwk_from_pkcs12() can generate a JSON Web Key (JWK) from a given
    PKCS#12 file.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 8100381136a015ac72452c1d3ff6d71e71232232)

commit b388d22dbe2142b001f2b8bf96f2bf74b92ca928
Author: Akshay Sakure <asakure@redhat.com>
Date:   Mon Jun 1 16:25:46 2026 +0530

    sssd man-page: Fix man-page for offline_timeout*
    
    Currently, all the offline_timeout* options are in the wrong section
    due to which 'sssctl config-check' gives a WARNING. Ideally, they should
    be in DOMAIN SECTIONS.
    
    This PR will move all offline_timeout* options into DOMAIN SECTIONS
    and also fix a typo along with a couple of grammatical corrections.
    
    Resolves: https://github.com/SSSD/sssd/issues/7289
    Signed-off-by: Akshay Sakure <asakure@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit c183ecbd2558b61a41e46913482ea64759584baf)

commit 9a3938fc5a0d7d1355454ba2175795dfa13c05b6
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Thu Jun 4 09:45:38 2026 +0200

    RESOLV: handle empty addr list properly
    
    The address list can be NULL or empty when '/etc/hosts' has
    an IPv6 only entry and IPv4 was requested or vice versa. It
    was treated as an indicator that the name component contains
    the path to an LDAPI socket, leading to a crash.
    
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit b6e7f0518990cbf786d35d387589dfa690bfa6d8)

commit 004a8be12056104df74bd53fad8ddaedaf83dbaf
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Wed Jun 3 12:19:16 2026 +0000

    ci: bump cross-platform-actions/action from 1.0.0 to 1.2.0
    
    Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 1.0.0 to 1.2.0.
    - [Release notes](https://github.com/cross-platform-actions/action/releases)
    - [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
    - [Commits](https://github.com/cross-platform-actions/action/compare/v1.0.0...v1.2.0)
    
    ---
    updated-dependencies:
    - dependency-name: cross-platform-actions/action
      dependency-version: 1.2.0
      dependency-type: direct:production
      update-type: version-update:semver-minor
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    (cherry picked from commit 9dfd78c7c2fb0b0eb76d0a00d770e8a02de0e908)

commit 12d538c42e13ef1c66caeab165499455f8e2fb82
Author: aborah-sudo <aborah@redhat.com>
Date:   Wed May 20 10:29:11 2026 +0530

    Tests: Disable test_authentication_indicators
    
    Test is avilable as: https://github.com/SSSD/sssd/blob/master/src/tests/system/tests/test_ipa.py#L339
    
    Reviewed-by: Jakub Vávra <jvavra@redhat.com>
    (cherry picked from commit c20c27003a45e82d3ea34a8fa151a270483657bd)

commit 7b9e0059a04cc440faae633448b9022f6242270c
Author: Akshay Sakure <asakure@redhat.com>
Date:   Thu May 28 17:32:01 2026 +0530

    sssd man-page: Improve man-page for override_gid
    
    This commit improves the man-page statement for override_gid
    option by adding clear description & "Default" value.
    
    Resolves: https://github.com/SSSD/sssd/issues/7341
    
    Signed-off-by: Akshay Sakure <asakure@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit 5b6c11d507ec9dcd4daef27b683e42af364d8dc7)

commit 7682b02e3b4e4c8885c9bb3bd1683fa35e0c188b
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Mon Jun 1 10:21:05 2026 +0200

    Makefile: krb5 plugins: don't export internal symbols
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 9adeb27348decab9c47307d04e15b379d6bc7d92)

commit fa138120caaf6cda85d0f87de0518988afc18d34
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Fri May 15 16:55:57 2026 +0200

    sdap: defer libldap global options setup to first connection
    
    During initialization LDAP/AD/IPA backends unconditionally call
    `setup_tls_config()` and `setup_ldap_debug()` that call
    `ldap_set_option()`. This triggers `ldap_int_initialize()` ->
    `getaddrinfo(local_hostname)`. If DNS is unresponsive, this blocks
    and the backend doesn't complete initialization in time, so that
    'monitor' terminates the entire SSSD.
    
    Move these calls out of the module init path into a new
    `sdap_setup_libldap_global_options()` wrapper guarded by a static bool.
    Call it from `sdap_connect_send()` just before `sss_ldap_init_send()`,
    which is the single entry point for all LDAP connections.
    
    :fixes:Fixed an issue where SSSD fails to start when DNS is unresponsive.
    
    Assisted-By: Claude Code (Opus 4.6)
    Reviewed-by: Dan Lavu <dlavu@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>
    (cherry picked from commit b84e7fa856317cd629a212ddf05e5d5e2e20374d)

commit 0ab98c7b3984fcf4128486c0efdb07c5e25dd75f
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Thu May 14 15:47:51 2026 +0200

    sdap: handle missing rootDSE gracefully
    
    If `ldap_read_rootdse = never` then srv_opts is NULL which is unexpected.
    It can also happen on other path in the connection code, because
    sdap_cli_use_rootdse() is called only when the rootDSE is successfully
    fetch. This patch makes sure that srv_opts are always set.
    
    :fixes: SSSD no longer crashes if `ldap_read_rootdse = never` and
      `enumerate = true`
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>
    (cherry picked from commit 2cc7dfa18830336bd75ee8fa7e8a5db40bc253fb)

commit 1c764c59bfb58be29ca5574a3b1c2b7ea36089df
Author: aborah-sudo <aborah@redhat.com>
Date:   Thu May 21 12:50:39 2026 +0530

    Tests: fix the tests to check the new pattern
    
    I got confirmation that this is simply a log change issue.   We can fix the tests to check the new pattern.
    https://github.com/SSSD/sssd/pull/8540
    
    Reviewed-by: Scott Poore <spoore@redhat.com>
    (cherry picked from commit 04d593755659b1afb2139c99c8c31ecc4a6c0436)

commit b292c6ddbcc163cf76f158cf310e304535d333c2
Author: Akshay Sakure <asakure@redhat.com>
Date:   Sat May 23 00:49:14 2026 +0530

    Component: sssd-tools
    
    Explanation: This patch will make sure to print correct command on
    running 'sssctl analyze --help' command avoiding confusion.
    
    Resolves: https://github.com/SSSD/sssd/issues/8718
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit 30a4940f51736a9b2303a0573b5ca11c9f83ab73)

commit f21a1432fd3abb9d8805e19c73092dc0bb85b116
Author: Iker Pedrosa <ipedrosa@redhat.com>
Date:   Tue May 5 12:05:51 2026 +0200

    ci: add TMT passkey tests to packit workflow
    
    Enable automated passkey testing on pull requests after COPR builds
    complete. Tests run on fedora-all and centos-stream-10 targets using
    the TMT plan.
    
    Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
    Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
    Reviewed-by: Jakub Vávra <jvavra@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit 210f50f507c8443d1522fd7504b001e95af29950)

commit 1b6efb03fa5fdb0f555d1a36dabd67fc176b1ee7
Author: Iker Pedrosa <ipedrosa@redhat.com>
Date:   Wed Apr 29 11:59:03 2026 +0200

    tests: add TMT plan for passkey testing
    
    Add comprehensive TMT plan for testing SSSD passkey functionality across
    IPA, LDAP, and Samba identity providers using containerized environments.
    
    Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
    Co-authored-by: Claude Sonnet 4 <noreply@anthropic.com>
    Reviewed-by: Jakub Vávra <jvavra@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit d54cf526c92143653108b455fa4e477c24b6263f)

commit eecbb52ab06905f2080318c13756b39422c3835d
Author: Justin Stephenson <jstephen@redhat.com>
Date:   Mon May 18 12:17:49 2026 -0400

    tests: Clarify approx match filter
    
    Reviewed-by: Tomáš Halman <thalman@redhat.com>
    (cherry picked from commit 21674dd9689742b292f84c5e7f98278f6d99ab30)

commit 52547f7f9efa5dc7c122f20467a31dbbbbcdc475
Author: Simo Sorce <simo@redhat.com>
Date:   Thu Apr 30 11:29:55 2026 -0400

    Add const qualifier to X509_NAME pointers
    
    The issuer_name and subject_name variables in get_issuer_subject_str have been
    updated to use the const qualifier. This improves const-correctness and
    prevents accidental modification of the certificate data.
    
    Signed-off-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit 770ae6cb020fd60e64507747bfddbb948cb52984)

commit e30bd32e9e278518108a47ad617f1d7888ef987c
Author: Simo Sorce <simo@redhat.com>
Date:   Thu Apr 30 11:02:04 2026 -0400

    Update certmap for OpenSSL 4.0 compatibility
    
    Replace direct struct field accesses with OpenSSL accessor functions like
    ASN1_STRING_get0_data and ASN1_STRING_length. Add const qualifiers to
    ensure compatibilitty with OpenSSL 4.0.
    
    Signed-off-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit b197d9d3f566f8b840663e31105b338e1a4f962e)

commit e12ff3c62d2b72fe5ded4242a3f4651ab3f396e6
Author: Simo Sorce <simo@redhat.com>
Date:   Thu Apr 30 15:05:54 2026 -0400

    Correct x400Address type check in crypto.m4
    
    Update the compilation check for the x400Address field in the GENERAL_NAME
    struct. By comparing the address of the field against an ASN1_STRING double
    pointer, it ensures the compiler strictly and safely verifies the exact type
    during autoconf checks without causing invalid pointer arithmetic errors.
    
    Co-authored-by: Gemini <gemini@google.com>
    Signed-off-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit ab6713f781ba02c4ff881f276a9289b4b3ff1133)

commit c3acaa3a5104ee32efdb536b311a343276afb5d0
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Wed May 6 16:53:50 2026 +0200

    sdap: let callers mark SSSD as offline if kinit fails
    
    The callers expected that ret == EIO and can_retry == false to bring
    SSSD to an offline state.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit c5b631ee6df531b506d2b2ba7f2d9f0b9de02746)

commit 22ee18410301def2c9979b2c2bdde20e7151d04b
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Apr 22 12:33:17 2026 +0200

    krb5: restart krb5_child for Smartcard authentication
    
    In contrast to other authentication methods for PKINIT some information
    about the used Smartcard and certificate are already needed for the
    pre-authentication step to trigger the MIT Kerberos PKINIT module to get
    back the information if PKINIT is possible or not and if the Smartcard
    can be used for authentication. If krb5_child is kept running between
    the pre-authentication and the authentication step the information given
    during pre-authentication is used if Smartcard authentication was
    selected.
    
    As long as only a single certificate is available there is no issue. But
    if there are multiple certificates which all apply to the given mapping
    and matching rules for the user trying to log in and the user can choose
    a certificate for authentication the authentication might fail if the
    certificate use during pre-authentication and the one selected by the
    user differ. Before the change to keep krb5_child running for all
    authentication methods this was not an issue since the fresh instance
    started during the authentication step was using the certificate
    selected by the user.
    
    With this patch krb5_child is restart during the authentication step is
    Smartcard authentication was selected.
    
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit f3a36bec2a6c9fe11076c8f4673775a0d4221ad1)
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

commit a4bbfb40be39bde05af2366366a6145e211427bd
Author: Jakub Vávra <jvavra@redhat.com>
Date:   Thu May 7 10:45:05 2026 +0200

    Tests: Fix test_refresh_contain_timestamp
    
    Reviewed-by: Madhuri Upadhye <mupadhye@redhat.com>
    (cherry picked from commit 1b802f4cbcf04ddd4cb43942701311a4e3a661c0)

commit 8c59fa3e6d069863f9f66985415597b1d79b75da
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri Apr 24 13:22:06 2026 +0200

    pam: refactor pack_cert_data
    
    Use safealign_memcpy() instead of plain memcpy() and add a consistency
    check.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 50a38380e2cb19f17dd2e0abf523091ddc45476b)

commit 072f8ec11aa280ec6213e1466fae989cc2282b54
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri Apr 24 10:03:08 2026 +0200

    pam_sss: fix potential memory leak
    
    In case the conversation callback allocates memory for a reply we have
    to free it.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 084268fc284b35514ac7e4cd9e9410d344817d37)

commit 89accfc155a216ff5688cade7786208e2ec5efd1
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri Feb 27 19:09:32 2026 +0100

    authtok: remove sss_authtok_set_sc_keypad()
    
    sss_authtok_set_sc_keypad() does not set which token and certificate
    should be used for authentication, just using sss_authtok_set_sc() with
    SSS_AUTHTOK_TYPE_SC_KEYPAD as type is sufficient.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit f3aea6728f2ccfc52fc2f8211828094dd5edf609)

commit cd184920572cb5949fafe6413cc8c4d9216e2381
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Feb 23 19:35:41 2026 +0100

    pam: handle protected authentication path
    
    If a Smartcard reader has a built-in keypad or keyboard the flag
    CKF_PROTECTED_AUTHENTICATION_PATH is set in the token info data. To
    properly tell the user that the pin must be given at the reader directly
    and not at the computer this information must be propagated to the
    pam_sss module.
    
    Resolves: https://github.com/SSSD/sssd/issues/5371
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 016bc7a2a389900907579631c0016986e5eb0678)

commit 67444c41fc8d21fdeae8d6c68128dfe67a36a47a
Author: Sumit Bose <sbose@redhat.com>
Date:   Fri Feb 20 16:29:18 2026 +0100

    p11_child: ignore failure of C_GetTokenInfo
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit d6483bb5c5639e3045092170cd5ee5cdcd5b5867)

commit 9826dca055e4f8f42eec24cde682a30806ab9e55
Author: Samuel Cabrero <scabrero@suse.com>
Date:   Mon May 11 16:51:22 2026 +0200

    sdap: Reduce log level when get_naming_context() fails
    
    Signed-off-by: Samuel Cabrero <scabrero@suse.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit edf4a0f9b683a96526a205ab8cd2148012da63b9)

commit 6e2b87aa43e15f18c10d859bbed59dab314ffed1
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Mon May 4 13:05:56 2026 +0200

    KRB5: read keytab copy in offline mode too
    
    The process can transition from offline pre-auth to online auth within
    the same invocation.
    
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit b070171e8371ce9be20c0554617b35d13a2ef17c)

commit d19f6860e6064399c51dec9b5ba99ff9ab4f1478
Author: Dan Lavu <dlavu@redhat.com>
Date:   Thu Apr 16 09:19:34 2026 -0400

    refactoring ipa tests for hostname framework changes.
    
    Reviewed-by: Jakub Vávra <jvavra@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    Reviewed-by: Madhuri Upadhye <mupadhye@redhat.com>
    (cherry picked from commit 8f170d08a0ca0a9573fc173ae5e7e6a1cd8ffc26)

commit 87b819c73abe5e6e79655f05331ce5ec35e1feca
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Sat May 2 01:47:20 2026 +0000

    ci: bump cross-platform-actions/action from 0.32.0 to 1.0.0
    
    Bumps [cross-platform-actions/action](https://github.com/cross-platform-actions/action) from 0.32.0 to 1.0.0.
    - [Release notes](https://github.com/cross-platform-actions/action/releases)
    - [Changelog](https://github.com/cross-platform-actions/action/blob/master/changelog.md)
    - [Commits](https://github.com/cross-platform-actions/action/compare/v0.32.0...v1.0.0)
    
    ---
    updated-dependencies:
    - dependency-name: cross-platform-actions/action
      dependency-version: 1.0.0
      dependency-type: direct:production
      update-type: version-update:semver-major
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>
    (cherry picked from commit fa413a9694a5dfbb17171e4b26cfce4d75881a5c)

commit a71bde755009a1bfba82cc0ec477707b1babf570
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu May 7 09:00:47 2026 +0300

    version bump

commit 6eccac754154dfe728d1e3183e908167f7b54e2b
Merge: 97fd8659 d1329f90
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu May 7 08:40:45 2026 +0300

    Merge branch 'upstream'

commit feef76172ce2259a8e73028561f78da408ad31db
Author: krishnavema <krishnavemak@gmail.com>
Date:   Mon Mar 16 03:05:47 2026 +0530

    tests: implement multi-token support for smart card authentication
    
    Reviewed-by: Scott Poore <spoore@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit e5b65979f11e10ffafa398fe38e4d1cf63cd99bf)

commit d77df8e584b43e5be14663513e3edefd025de545
Author: Madhuri Upadhye <mupadhye@redhat.com>
Date:   Mon Apr 27 21:17:44 2026 +0530

    tests: poll for KCM TGT renewal instead of fixed sleep
    
    test_kcm__tgt_renewal_updates_ticket_as_configured
    no longer uses a fixed sleep(5) and flaky retries.
    The test now polls klist every 0.5s and asserts renewal
    by checking that TGT start or end time advances,
    with a detailed failure message that prints both
    initial and last timestamps.
    
    To match KCM renewal behavior (renewal only starts
    after roughly half the ticket lifetime),
    the test uses a short renewable ticket (-r 5s -l 5s) and
    a bounded polling window (9s) so it stays fast while still
    waiting long enough for renewal to be attempted.
    Also removed the temporary CI comment and the flaky marker from this test.
    
    Assited by: Cursor(Claude Opus 4.6)
    
    Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Scott Poore <spoore@redhat.com>
    (cherry picked from commit 233db39fc84dc2a0b3bfb86000080b66d5d46713)

commit d1329f90294f1a59756886abd8a61296427f8d72
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Fri Apr 24 11:52:44 2026 +0000

    Release sssd-2.13.0

commit 9faae339dee2bd4ab6f0eb0fa3eadcbdca822832
Author: sssd-bot <sssd-maintainers@lists.fedoraproject.org>
Date:   Fri Apr 24 11:52:44 2026 +0000

    pot: update pot files

commit 9c836671ce51ee39c31baf7b4db48e985b3befb8
Author: Hosted Weblate <hosted@weblate.org>
Date:   Wed Apr 22 14:59:30 2026 +0000

    po: update translations
    
    (Italian) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 99.9% (2836 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 99.9% (2836 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 99.9% (2836 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 79.5% (2257 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 79.5% (2257 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 69.1% (1962 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 69.1% (1962 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 69.1% (1962 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 55.8% (1584 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 55.8% (1584 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 35.2% (1001 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 35.2% (1001 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 22.7% (646 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 6.7% (192 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 6.7% (192 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 6.7% (192 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 6.7% (192 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 6.7% (192 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/it/
    
    po: update translations
    
    (Italian) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
    
    po: update translations
    
    (Italian) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
    
    po: update translations
    
    (Italian) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
    
    po: update translations
    
    (Polish) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/pl/
    
    po: update translations
    
    (Italian) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/it/
    
    po: update translations
    
    (Portuguese) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/pt/
    
    po: update translations
    
    (Finnish) currently translated at 10.4% (77 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fi/
    
    po: update translations
    
    (Swedish) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/sv/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 68.1% (1681 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Czech) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/cs/
    
    po: update translations
    
    (Turkish) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/tr/
    
    po: update translations
    
    (Korean) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ko/
    
    po: update translations
    
    (Spanish) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/es/
    
    po: update translations
    
    (Spanish) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/es/
    
    po: update translations
    
    (Russian) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ru/
    
    po: update translations
    
    (French) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/fr/
    
    po: update translations
    
    (Russian) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ru/
    
    po: update translations
    
    (Korean) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 67.8% (1672 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Korean) currently translated at 67.8% (1672 of 2465 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/ko/
    
    po: update translations
    
    (Swedish) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/sv/
    
    po: update translations
    
    (Portuguese) currently translated at 100.0% (735 of 735 strings)
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/pt/
    
    po: update translations
    
    (Portuguese) currently translated at 100.0% (2838 of 2838 strings)
    Translation: SSSD/sssd-manpage
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-manpage-master/pt/
    
    Update translation files
    
    Updated by "Update LINGUAS file" hook in Weblate.
    
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/
    
    Added translation using Weblate (Turkish)
    
    Added translation using Weblate (Norwegian Bokmål)
    
    Added translation using Weblate (Italian)
    
    Added translation using Weblate (Indonesian)
    
    Added translation using Weblate (Hungarian)
    
    Added translation using Weblate (Bulgarian)
    
    Added translation using Weblate (Latvian)
    
    Update translation files
    
    Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.
    
    Translation: SSSD/sssd
    Translate-URL: https://translate.fedoraproject.org/projects/sssd/sssd-master/
    
    Added translation using Weblate (Breton)
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit 3b0b16e96728b3d2f8ddd8c0ee67b92ec210d44f
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Wed Apr 22 13:03:48 2026 +0200

    PAM/PASSKEY: avoid unnecessary memcpy
    
    `sss_authtok_set_passkey_reply()` -> `sss_authtok_set_string()` handles
    non NULL-terminated buffer correctly.
    
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit d0beceaa17b94fa07a2ee7af8165392b90e83d94
Author: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date:   Tue Apr 21 09:30:51 2026 -0700

    pam: gate PAC indicator code on BUILD_SAMBA
    
    Commit 1f680edad023c8c57343447b156f6b34696e8221 added ad_pac_common.c and
    $(NDR_KRB5PAC_LIBS) to sssd_pam unconditionally. So when building --without-samba, sssd_pam fails to link with undefined references to ndr_pull_init_blob and ndr_pull_PAC_DATA.
    
    This change qualifies those additions with `BUILD_SAMBA` so the PAC
    indicator feature is compiled in only when samba support is enabled.
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit ba4353fddc95d23131a73598e93b0e3cdec7a13c
Author: Gleb Popov <6yearold@gmail.com>
Date:   Tue Apr 21 11:18:26 2026 +0300

    dp_target_id.c: Fix typo "lenght" -> "length"
    
    Resolves #8590
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

commit 9926e7ef9f05bda8dbda07644ee02d5ebb48d625
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Apr 20 11:44:24 2026 +0200

    oidc_child: add new option return-tokens
    
    oidc_child should only return access and refresh tokens during
    authentication if the new option '--return-tokens' is given.
    
    Resolves: https://github.com/SSSD/sssd/issues/8616
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit 6726f5a8a4a42c68246c3f2e5e093dfd5341e199
Author: Dan Lavu <dlavu@redhat.com>
Date:   Tue Apr 21 16:11:31 2026 -0400

    removing unstable topologies from memecache tests
    
    Reviewed-by: Scott Poore <spoore@redhat.com>

commit 550b08cabe4dd5508c7ea74f634869374204d63f
Author: Xu Raoqing <609179072@qq.com>
Date:   Tue Apr 21 16:49:05 2026 +0800

    pam: fix out-of-bounds read in pam_passkey_child_read_data
    
    The pam_passkey_child_read_data() function failed to properly handle
    raw bytes received from a pipe. The data was treated as a NUL-terminated
    C string without explicit termination, resulting in an out-of-bounds read
    when processed by snprintf() with %s format.
    
    Fix by using memcpy instead of snprintf and explicitly NUL-terminating
    the buffer. Add checks for buf_len == 0 or buf == NULL to avoid undefined
    behavior. Check the return value of sss_authtok_set_passkey_reply and
    propagate errors properly.
    
    Fixes: CVE-2026-6245
    
    :relnote: Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey responder
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 1f680edad023c8c57343447b156f6b34696e8221
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Mar 18 15:49:50 2026 +0100

    pam: apply SIDs from PAC to authentication indicators
    
    This patch reads the PAC of a Kerberos ticket while evaluating the
    authentication indicators of the Kerberos ticket during a pam_sss_gss
    request. Based on the value of the pam_gssapi_indicators_apply option
    the found SIDs might add additional authentication indicators to the
    evaluation.
    
    The primary use case is to handle SIDs added by Active Directory's
    Authentication Mechanism Assurance (AMA).
    
    :relnote: During the processing of the pam_sss_gss request SSSD will
    read the SID from the PAC of the Kerberos ticket and might add
    authentication indicators based on the value of the new option
    pam_gssapi_indicators_apply. The primary use case is to handle SIDs
    added by Active Directory's Authentication Mechanism Assurance (AMA).
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit 22de4fd2d7679d9c00de277e5cd9076d032c6812
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Mar 25 16:10:34 2026 +0100

    pam: add pam_gssapi_indicators_apply option
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit 3f9c415abcf5a9c051a287602c00a9279c3d50b6
Author: Sumit Bose <sbose@redhat.com>
Date:   Tue Mar 24 19:33:36 2026 +0100

    ad: move ad_get_sids_from_pac() to ad_pac_common.c
    
    To make ad_get_sids_from_pac() better reusable it is moved with its
    dependencies into ad_pac_common.c
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit 80e64825795222fb6c21db116d7a5ae9fb76e407
Author: Madhuri Upadhye <mupadhye@redhat.com>
Date:   Mon Mar 23 16:34:39 2026 +0530

    tests: port LDAP+Kerberos tests to pytest
    
    - Port three downstream krb_misc_bugzilla bash tests to upstream pytest
    - BZ 773660: Clock skew errors logged to syslog
    - BZ 869150: ldap_child handles missing keytab without segfault
    - BZ 805281: Correct principal selected from multi-realm keytab
    
    Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>
    Reviewed-by: Dan Lavu <dlavu@redhat.com>
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit a809b9236250e6f20e9a9ff1452708cd288b705f
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Wed Apr 15 09:42:34 2026 +0200

    Add missing include
    
    Original patch f3af8c89af656767333410b0e94da9288dd8ade8 didn't include
    "config.h" that provides `HAVE_PTHREAD_EXT`
    It works in some branches accidentally because of transitive include
    via "sss_cli.h" but that's fragile (and in some branches "sss_cli.h"
    doesn't include "config.h")
    
    Reviewed-by: Tomáš Halman <thalman@redhat.com>

commit a32aab401ecc097bceff5313dd19d61abb2b50b0
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Tue Apr 14 10:38:46 2026 +0200

    add config option to enable logging sensitive data
    
    Sensitive data is logged by the new macro `DEBUG_SENSITIVE`, which is an
    alias to `DEBUG` if configured with `--enable-sensitive-logs`.
    Otherwise, it is simply a no-op.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit ec440c04c2923475040bb2fc5d981471388f69e2
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Wed Apr 1 15:58:16 2026 +0200

    fix gcc warning
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit f9ee090e7ded1b0a4f202f53464410d8f7b300e2
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Thu Dec 11 17:17:13 2025 +0100

    fix typos
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 3f65f58b2039d0bab55c8ec092eb7d630f59457f
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Wed Apr 1 15:54:25 2026 +0200

    oidc_child: initialize curl only once
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit c3f6388f8208a9a4ef85e06db9f7e623383f1945
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Wed Apr 1 15:07:40 2026 +0200

    idp: fix idp_id_scope Entra example
    
    Because scope is URL-encoded by oidc_child, the `idp_id_scope` option
    must not be encoded already.
    
    This also checks for and automatically corrects the old example value.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit fe5d548d7e1e2654d1d1f0c09bb032347dd32475
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Wed Apr 1 10:31:08 2026 +0200

    idp: pass sss_domain_info to create_refresh_token_timer
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit c9ca1900eb2b576de925f33a179ea3e26455c3c9
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Fri Mar 13 22:56:40 2026 +0100

    oidc_child: add macros for token names
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 0f08795fd02464526ac2de548cc21079a3fb3ad1
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Fri Mar 13 22:35:14 2026 +0100

    oidc_child: free json objects properly
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit a3c506dd9cf55b5b757aade127239c7f4cf33f08
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Fri Mar 13 22:21:48 2026 +0100

    oidc_child: url-encode post data items
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit aadae62db208c34062fdf35ce15a4338046ad601
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Mon Feb 23 14:20:48 2026 +0100

    idp: construct pam_data with timer
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 1f57c2b118542f0590683686baf1ed1eef27cfae
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Fri Mar 6 21:59:38 2026 +0100

    idp: delete non-replaced tokens from cache
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 2e887f12c94fadbdae1421885e125676305962e7
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Tue Jan 13 16:26:52 2026 +0100

    idp: add option to automatically refresh tokens
    
    :feature: Tokens acquired from the IdP are now stored in the domain
              cache, and are automatically refreshed if the new option
              `idp_auto_refresh` is enabled.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 9525cccb460115ef93f21a09dd5d0bd758128437
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Thu Dec 11 17:17:56 2025 +0100

    idp: automatically refresh tokens
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit ede49c2c25445a32edfea466345c1ed50d0f4d35
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Tue Dec 9 16:36:18 2025 +0100

    oidc_child: add --refresh-access-token flag
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 371148d7c7644cc55a621edede30c2308a77ffb6
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Fri Mar 13 00:03:41 2026 +0100

    oidc_child: store tokens in cache
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 6a3295280b338f6686680629448594425aba7e9f
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Thu Dec 4 11:06:55 2025 +0100

    oidc_child: get refresh_token for later
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 1233fc7d63e96d667e716c806549688977da5d5a
Author: Timo Eisenmann <eisenmann@b1-systems.de>
Date:   Tue Dec 9 14:15:21 2025 +0100

    config: add missing rules for idp options
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit 35019632b6fc199f60b11000413c9e793ecee594
Author: Striker Leggette <striker@redhat.com>
Date:   Fri Apr 10 13:05:46 2026 -0400

    More trivial spelling/grammatical fixes. No functional code was harmed in the changing of these files.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>

commit c8257a3ef5085e87f58eb910bcb1bfb4b25c609a
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Tue Mar 31 13:47:07 2026 +0200

    ci: automatically generate release notes
    
    The release workflow is extended to automatically generate release
    notes and open a draft pull request against sssd.io.
    
    Reviewed-by: Alejandro López <allopez@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>

commit 033a81befb6d57e34776e938e24813b93ecf7b06
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Mon Mar 30 13:50:42 2026 +0200

    scripts: add generate-full-release-notes.sh script
    
    This scripts prepares a release notes for sssd.io.
    
    Reviewed-by: Alejandro López <allopez@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>

commit 27aac3a294cf10a501d1565aa8d427bff24dd512
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Mon Mar 30 13:33:11 2026 +0200

    scripts: add generate-release-notes.py script
    
    Generate release notes from commit messages:
    ./scripts/generate-release-notes.py --from FROM --to TO --version VERSION --format md|rst
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Reviewed-by: Alejandro López <allopez@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>

commit cb1ef376a31262ea1f1b11b560de61986dc86c60
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Mon Mar 30 12:39:22 2026 +0200

    scripts: add fixed-issues.sh script
    
    Add a bash script to extract and list resolved GitHub issues from git commit
    history. The script searches for "Resolves:" references in commit messages
    between two git refs and outputs a formatted list of closed issues.
    
    Features:
    - Accepts --from <ref> (required) and --to <ref> (defaults to HEAD)
    - Supports multiple output formats via --format: plain, rst, md
    - Uses gh CLI to fetch issue details (number, title, state)
    - Filters to only include closed issues
    - Outputs formatted list with issue number, URL, and title
    
    🤖 Generated with [Claude Code](https://claude.com/claude-code)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Reviewed-by: Alejandro López <allopez@redhat.com>
    Reviewed-by: Justin Stephenson <jstephen@redhat.com>

commit a3b2b4f1517b250bde36f9278b18aa54f88645ef
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Mar 9 18:31:08 2026 +0100

    idp: do not update cache timeout if member is added
    
    If only a single member is added to a group, e.g. during an initgroups
    request, do not increment the cache timeout because it is not clear if
    the list of members is complete or not.
    
    Resolves: https://github.com/SSSD/sssd/issues/8330
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit c767b8ea06bbc538ddb40b32111c1d71323595c8
Author: Sumit Bose <sbose@redhat.com>
Date:   Mon Mar 9 18:30:35 2026 +0100

    cache_req: switch from ID to name lookup
    
    If 'avoid_by_id_lookups' is set to 'True' switch to a lookup by name if
    a user or a group is searched by ID.
    
    Resolves: https://github.com/SSSD/sssd/issues/7668
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit 10d509a84ba0c2f045b8d3ab843851e44b3ca7ce
Author: Sumit Bose <sbose@redhat.com>
Date:   Wed Mar 11 09:46:05 2026 +0100

    conf: add avoid_by_id_lookups domain option
    
    If this new option is set to 'true' SSSD will try to avoid sending
    lookups by ID to the backend and will switch to a lookup by name if a
    cached object with a matching ID can be found.  This option can e.g. be
    used in cases where searches by ID are expensive on the server side
    because of missing indexes or are not even possible.
    
    :config: New option 'avoid_by_id_lookups' to tell the SSSD responders to
             use a lookup by name instead of by id where possible
    
    Resolves: https://github.com/SSSD/sssd/issues/7668
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit 95d8476702386bd8567e3aad463fbd48c4508fd6
Author: Paymon MARANDI <paymon@encs.concordia.ca>
Date:   Fri Mar 27 11:24:07 2026 -0400

    krb5: make sure keytab is a FILE before checking for access
    
    KCM: and API: are other cases besides MEMORY:
    
    Resolves: https://github.com/SSSD/sssd/issues/8555
    Signed-off-by: Paymon MARANDI <paymon@encs.concordia.ca>
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>

commit 0100b1c3536688c12f1db2a65164f03765727f81
Author: Alexey Tikhonov <atikhono@redhat.com>
Date:   Mon Apr 13 09:21:45 2026 +0200

    KCM: fix use-after-free in `kcm_read_options()`
    
    The `renew_intv` string was allocated under tmp_ctx but not re-linked
    to mem_ctx before tmp_ctx was freed.
    
    Assisted-By: Claude Code (Opus 4.6)
    Reviewed-by: Sumit Bose <sbose@redhat.com>

commit f260623f95497cd7f629b4a3915ec2724889602c
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Tue Apr 7 14:46:47 2026 +0200

    dist: clean up and fix ditribution tarball
    
    The tarball contained malformed src/tests/tests folder due to including
    full src/tests in noinst_DATA (because $distdir/src/tests was already
    created by check unit tests).
    
    It also clean up the tarball to avoid various build time artifacts and
    including missing files.
    
    Resolves: https://github.com/SSSD/sssd/issues/8514
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>

commit 3b7dc8c739f2821ea389fa36daf75c9b0ec62c50
Author: Pavel Březina <pbrezina@redhat.com>
Date:   Tue Apr 7 15:04:50 2026 +0200

    contrib: removed unused test-suite
    
    This was used by sssd-test-suite virtual machines based CI that we no
    longer use.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>

https://salsa.debian.org/api/v4/projects/sssd-team%2Fsssd API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-03 Last update: 2026-08-08 11:01

debian/patches: 2 patches to forward upstream low

Among the 3 debian patches available in version 2.12.0-4 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-15 19:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.4.0).

Created: 2019-09-29 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for sssd (- to 2.12.0-4): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating sssd would introduce bugs in testing: #1129522, #1141769, #1143600, #1143947
- ∙ ∙ Autopkgtest for sssd/2.12.0-4: amd64: Pass, arm64: Pass, armhf: Failed ♻, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/s/sssd.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 147 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-05-11] sssd REMOVED from testing (Debian testing watch)
[2026-03-19] sssd 2.12.0-4 MIGRATED to testing (Debian testing watch)
[2026-03-15] Accepted sssd 2.12.0-4 (source) into unstable (Simon Josefsson)
[2026-03-07] Accepted sssd 2.12.0-3~exp0 (source) into experimental (Simon Josefsson)
[2026-02-20] sssd 2.12.0-2 MIGRATED to testing (Debian testing watch)
[2026-02-13] Accepted sssd 2.12.0-2 (source) into unstable (Timo Aaltonen)
[2026-02-11] sssd 2.12.0-1 MIGRATED to testing (Debian testing watch)
[2026-02-08] Accepted sssd 2.12.0-1 (source) into unstable (Timo Aaltonen)
[2026-02-08] sssd 2.11.1-2.1 MIGRATED to testing (Debian testing watch)
[2026-02-06] Accepted sssd 2.11.1-2.1 (source) into unstable (Daniel Baumann)
[2026-01-25] sssd REMOVED from testing (Debian testing watch)
[2026-01-09] Accepted sssd 2.11.1-2 (source) into unstable (Michael Tokarev)
[2025-11-10] Accepted sssd 2.11.1-1 (source) into unstable (Timo Aaltonen)
[2025-02-19] Accepted sssd 2.8.2-4+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Guilhem Moulin)
[2025-02-09] Accepted sssd 2.4.1-2+deb11u1 (source) into oldstable-security (Guilhem Moulin)
[2025-01-27] sssd 2.10.1-2 MIGRATED to testing (Debian testing watch)
[2025-01-14] Accepted sssd 2.10.1-2 (source) into unstable (Timo Aaltonen)
[2025-01-08] Accepted sssd 2.10.1-1 (source) into unstable (Timo Aaltonen)
[2024-12-29] sssd 2.9.5-5 MIGRATED to testing (Debian testing watch)
[2024-12-20] Accepted sssd 2.9.5-5 (source) into unstable (Simon Josefsson)
[2024-11-26] Accepted sssd 2.9.5-4 (source) into unstable (Simon Josefsson)
[2024-10-22] sssd REMOVED from testing (Debian testing watch)
[2024-07-30] sssd 2.9.5-3 MIGRATED to testing (Debian testing watch)
[2024-06-04] Accepted sssd 2.9.5-3 (source) into unstable (Timo Aaltonen)
[2024-06-04] Accepted sssd 2.9.5-2 (source) into unstable (Timo Aaltonen)
[2024-05-20] Accepted sssd 2.9.5-1 (source) into unstable (Timo Aaltonen)
[2024-04-25] sssd REMOVED from testing (Debian testing watch)
[2024-04-10] Accepted sssd 2.9.4-2 (source) into unstable (Timo Aaltonen)
[2024-02-29] Accepted sssd 2.9.4-1.1 (source) into unstable (Benjamin Drung)
[2024-02-04] Accepted sssd 2.9.4-1.1~exp1 (source) into experimental (Steve Langasek)

bugs [bug history graph]

all: 67 68
RC: 4
I&N: 58
M&W: 5 6
F&P: 0
patch: 3

links

homepage
lintian (7, 26)
buildd: logs, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (36, 56)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.12.0-1ubuntu5
patches for 2.12.0-1ubuntu5