CHANGELOG

* Mon Nov 18 2024 dpavlotzky <david@pavlotzky.nl> - 7.12.0
- Add "ad" option to autofs_provider list (#147)

* Mon Nov 18 2024 G. Ryan Sablosky <sabo@users.noreply.github.com> - 7.12.0
- Make LDAP client-side TLS authentication optional (#137)

* Fri Sep 13 2024 Steven Pritchard <steve@sicura.us> - 7.11.0
- [puppetsync] Update module dependencies to support simp-iptables 7.x

* Wed Apr 10 2024 Mike Riddle <mike@sicura.us> - 7.10.0
- Added the pam_cert_auth parameter to the pam service
- Added the ldap_user_cert parameter to the ldap provider
- Users can now specify ldap providers via hieradata using sssd::ldap_providers

* Wed Nov 29 2023 Virus2500 <_________@gmail.com> - 7.9.0
- add domain option ldap_user_search_filter

* Mon Oct 23 2023 Steven Pritchard <steve@sicura.us> - 7.8.0
- [puppetsync] Add EL9 support

* Wed Oct 11 2023 Steven Pritchard <steve@sicura.us> - 7.7.0
- [puppetsync] Updates for Puppet 8
  - These updates may include the following:
    - Update Gemfile
    - Add support for Puppet 8
    - Drop support for Puppet 6
    - Update module dependencies

* Thu Aug 31 2023 Steven Pritchard <steve@sicura.us> - 7.6.0
- Add AlmaLinux 8 support

* Mon Jun 12 2023 Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.5.0
- Add RockyLinux 8 support

* Thu Aug 25 2022 Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.4.2
  - Fixed:
    - Made the `ldap_uri` parameter optional

* Fri Jul 15 2022 Mark Fitch <mark.fitch1@hotmail.com> - 7.4.1
  - Fixed:
    - Added missing parameters `ldap_user_extra_attrs` and
      `ldap_user_ssh_public_key` to allow SSH keys to be fetched from AD

* Wed Jun 22 2022 Yehuda Katz <ykatz@cs.umd.edu> - 7.4.1
- Allow `krb5_server` to be optional as implemented in the template

* Fri Jun 03 2022 Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.4.0
- Update from camptocamp/systemd to puppet/systemd

* Thu May 26 2022 Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.3.0
- Changed:
  - Made provider parameters Optional to support certain AD/realmd configurations:
     - sssd::provider::krb5::krb5_server
     - sssd::provider::ldap::ldap_search_base
     - sssd::provider::ldap::ldap_default_bind_dn
- Fixed:
  - nil? bug in template for ad provider

* Fri Aug 27 2021 Henry Pauli <henry+spam@mixict.nl> - 7.2.0
- Add an option in sssd::install to not install sssd client.
  This aids in better compatibility with non RedHat based systems
  where the ssssd-client package may not exists.

* Thu Aug 05 2021 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.1
- Add an override for sssd-sudo.service to start it as root:root. This aligns
  with how sssd itself would start the service and the daemon cannot access
  /var/lib/sss/db/config.ldb otherwise.

* Thu Jun 17 2021 Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.1.0
- Removed support for Puppet 5
- Ensured support for Puppet 7 in requirements and stdlib

* Thu Jun 03 2021 Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.2
- Added tests for ds389 ldap server
- SSSD will not start and the module fail if no domains are
  defined.  The enable_files_domain setting is set to true to ensure
  that sssd will start.

* Wed Jun 02 2021 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.1
- Fixed:
  - sssd-sudo.socket service

* Wed May 19 2021 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0
- Fixed:
  - `sssd::provider::ldap::ldap_pwd_policy` is based on the value in
    `ldap_account_expire_policy` to properly account for non-shadow systems
  - `sssd::provider::ldap::ldap_access_order` is set to the modern set
  - A typo in the `sssd::LdapAccountExpirePol` data type was fixed
  - Ported the krb5 ERB template to EPP and fixed a typo
- Removed:
  - `sssd::manage_service` - obsolete
  - `sssd::ldap_access_order_defaults()` - obsolelte
  - Removed EL6-only artifacts
  - Removed the `LOCAL` domain
  - Support for Puppet 5 was dropped
- Changed:
  - Fail if a version of `sssd` is being managed < 1.16.0
  - Now use the `/etc/sssd/conf.d` directory instead of `concat`
  - The `sssd::service` class is now private
  - Moved the `/etc/sssd` directory configuration into `sssd::config`
- Added:
  - `sssd::config::entry` defined type which allows consistent management of
    permissions and dependencies on config files
  - Users can set `sssd::custom_config` to a `String` that will be placed into
    `/etc/sssd/conf.d/zz_puppet_custom.conf`
  - Allow users to optionally purge the `/etc/sssd/conf.d` directory (disabled
    by default)
  - Trigger the `sssd-sudo.socket` service instead of including the service in
    the main configuration per the `sssd` documentation and error messages in
    the logs
  - Support for puppetlabs/stdlib 7 was added

* Thu Feb 18 2021 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0-0
- Ensure that systems bound to FreeIPA, but not connected do not cause
  compilation issues.

* Wed Jan 13 2021 Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.4.0-0
- Removed EL6 from supported OSes
- Added puppet 7 support

* Thu Apr 23 2020 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.1-0
- Ensure that EL6/7+ use the 'files' or 'local' provider as is appropriate for
  their platform
- Migrate the documentation to focus on the 'files' provider since 'local' is
  not recommended to be used any longer
- Fixed the core acceptance tests

* Tue Jan 21 2020 Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.3.0-0
- Added EL8 support
- Removed requirement for sssd domain entry for el8 and SSSD V2 since
  using the implicit files provider is valid and even recommended
  for performance by some.  An sssd domain is still required for
  el6 and el7.
- Automatically include the service section if the service is included in
  sssd::services.
- Removed deprecated variables from ldap provider for EL8.
- Added new variables for providers in EL8.
- Added ifp to list of services in service type
- Added files to types of providers
- Added support for simplib version 4.0

* Tue Jun 04 2019 steven.pritchard <steven.pritchard@onyxpoint.com> - 6.2.0-0
- Add v2 compliance_markup data

* Thu Mar 14 2019 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.6-0
- Fix the Active Directory tests

* Mon Mar 04 2019 Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.6-0
- Expanded the upper limit of the stdlib Puppet module version
- Updated URLs in the README.md

* Fri Feb 22 2019 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5-0
- Change the sssd::provider::ldap::ldap_access_order defaults to
  ['ppolicy','pwd_expire_policy_renew'] by default to prevent accidental system
  lockouts on upgrade.

* Mon Jan 21 2019 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.4-0
- Generated a REFERENCE.md
- Set the 'min_id' settings across the board to '1' to match the sssd defaults
  since they really have nothing to do with the target system's relationship
  with a centralized authentication service.
- Update the sssd::provider::ldap::ldap_access_order parameter to support the
  ppolicy related options that were added in sssd 1.14.0
  - ppolicy
  - pwd_expire_policy_reject
  - pwd_expire_policy_warn
  - pwd_expire_policy_renew

* Fri Oct 12 2018 Nick Miller <nick.miller@onyxpoint.com> - 6.1.3-0
- Changed $sssd::install::package_ensure from 'latest' to 'installed'
  - It will also respect `simp_options::package_ensure`

* Tue Sep 18 2018 Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.1.3-0
- Added OracleLinux to operating system check for 128 bit cipher
  work-around

* Tue Aug 28 2018 Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.3-0
- Fixed a bug in which the ldap_account_expire_policy setting
  for the LDAP provider could not be configured to use the system
  default. Now, when sssd::provider::ldap::ldap_account_expire_policy
  is set to '', that configuration parameter will not be written
  to the sssd configuration file. This allows the system default to
  be applied.
- Fixed a bug in which any boolean setting for the LDAP provider
  configuration could not be configured to be 'false'.
- Fixed bugs in which sssd::provider::ldap::debug_timestamps and
  sssd::provider::ldap::ldap_search_timeout were erroneously typed to
  be strings, instead of a Boolean and an Integer, respectively.
- Fixed bugs in which ad_enable_dns_sites, ad_enable_gc settings,
  dyndns_update, dyndns_update_ptr, krb5_use_enterprise_principal,
  and ldap_idmap_autorid_compat settings for the AD provider could
  not be configured to be 'false'.
- Fixed bugs in which ad_gpo_map_interactive, ad_gpo_map_remote_interactive,
  ad_gpo_map_network, ad_gpo_map_batch, ad_gpo_map_service, ad_gpo_map_permit
  and ad_gpo_map_deny settings for the AD provider were incorrectly formatted.
- Fixed a bug in which the dyndns_iface setting for the AD provider was not
  set from sssd::provider::ad::dyndns_ifaces.

* Thu Aug 23 2018 Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.1.3-0
- Add support for Oracle Enterprise Linux
- Add support for Puppet 5

* Fri Jul 13 2018 Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.1.3-0
- Added ldap_use_tokengroups, ldap_group_objectsid, ldap_user_objectsid to sssd::provider::ad
- Updated required version of puppetlabs-stdlib to 4.19.0 since fact function is used

* Tue Jun 19 2018 Nick Miller <nick.miller@onyxpoint.com> - 6.1.2-0
- Avoid changing the permissions from the vendored RPM
  - /etc/sssd/ owner is no longer managed
  - /etc/sssd/ perms went from 0640 to 0711
  - /etc/init.d/sssd went from 0754 to 0755 on EL6
- Update version range of auditd dependency in metadata.json
- Cleanup requires in metadata.json
- Cleanup unneeded fixtures and update CI assets

* Wed Mar 28 2018 Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
- sssd::provider::ad::ldap_schema should be a string, not a boolean
- AD test cleanup

* Wed Mar 14 2018 Philippe Muller <philippe.muller@gmail.com> - 6.1.0-0
- Allow passing ldap_tls_cacert to sssd::provider::ldap

* Wed Feb 28 2018 Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
- Some template and concat changes to make debugging the module easier
  - Add headers to more easily diagnose where to stick params
  - Order the concat sections
- Add some missing params from sssd::provider::ad
  - default_shell
  - dyndns_update
  - fallback_homedir
  - krb5_realm
  - krb5_store_password_if_offline
  - ldap_schema

* Fri Jan 19 2018 Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
- Added sssd class option to automatically configure SSSD for an IPA
  domain, when the host is joined to an IPA domain.

* Fri Dec 15 2017 Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
- Leveraged PR from Mark Fitch to add ima provider configuration

* Wed Dec 13 2017 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
- Enforce limits set in /etc/login.defs for uid_min and uid_max by default and
  fall back to something sensible for SSSD

* Mon Sep 18 2017 Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 6.0.4-0
- Set minimum length on sssd::domains

* Mon Sep 11 2017 Judy Johnson <judy.johnson@onyxpoint.com> - 6.0.3-0
- Only enable 'try_inotify' if explicitly set

* Wed Aug 30 2017 Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
- Sssd::DebugLevel now handles all variants specfied in sssd.conf man page
- All instances of debug_level are now typed as Sssd::DebugLevel

* Thu Jul 06 2017 Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.2-0
- Confine puppet version in metadata.json

* Fri Apr 07 2017 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
- Worked around a bug in EL6 where the ldap client library incorrectly handles
  128 bit ciphers in the cipher list

* Fri Mar 17 2017 Clayton Mentzer, Liz Nemsick 6.0.0-1
- Updated README
- Update puppet version in .travis.yaml

* Thu Feb 09 2017 Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
- Changed type of debug level to be consistent for all modules.

* Mon Jan 23 2017 Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
- Migrated to using puppetlabs-concat
- Added support for Active Directory Domains

* Thu Jan 12 2017 Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
- Updated to use new pki scheme.
- Application certs now managed in /etc/pki/simp_apps/sssd/x509
- Strongly typed

* Mon Dec 19 2016 Jeanne Greulich <jgreulich@onyxpoint.com> - 6.0.0-0
- Update Global Catalysts

* Wed Nov 23 2016 Jeanne Greulich <jgreulich@onyxpoint.com> - 5.0.0-0
- Fix dependancies for simp 6 bump

* Mon Nov 21 2016 Chris Tessmer <chris.tessmer@onyxpoint.com> - 5.0.0-0
- Updated to compliance_markup version 2

* Fri Sep 30 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-0
- Updated to use the version of 'simpcat' that does not conflict with
  'puppetlabs/concat'.

* Mon Aug 01 2016 Nicholas Hughes <nicholasmhughes@gmail.com> - 4.1.3-0
- Fixed incorrect variable references in ldap.erb.

* Sat Mar 19 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.2-0
- Migrated use_simp_pki to a global catalyst.

* Mon Mar 14 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.1-0
- Moved to Semantic Versioning 2.0
- Fixed a bug in the LDAP provider where we had
  `ldap_chpass_updates_last_change` as well as
  `ldap_chpass_update_last_change`. These were consolidated into a correct
  single `ldap_chpass_update_last_change` Boolean.
- Removed RPM dependencies on 'simp-boostrap' and 'puppet' since these are
  technically not necessary for just installing the module.

* Tue Mar 01 2016 Ralph Wright <ralph.wright@onyxpoint.com> - 4.1.0-9
- Added compliance function support

* Thu Dec 24 2015 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-8
- Added an sssd::install::client class for installing only the client
  libraries.

* Mon Nov 09 2015 Chris Tessmer <chris.tessmer@onypoint.com> - 4.1.0-7
- migration to simplib and simpcat (lib/ only)

* Thu Apr 02 2015 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-7
- Fixed variable references in some templates.

* Thu Feb 19 2015 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-6
- Migrated to the new 'simp' environment.

* Fri Jan 16 2015 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-4
- Changed puppet-server requirement to puppet

* Thu Nov 06 2014 Chris Tessmer <ctessmer@onyxpoint.com> - 4.1.0-3
- Remove sssd::conf as it is no longer needed and causes duplicate
  concat_fragment error

* Fri Oct 17 2014 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-2
- CVE-2014-3566: Updated cipher suites to help mitigate POODLE.

- The tls_cipher_suite variable is set to HIGH:-SSLv2 because OpenLDAP
  cannot set the SSL provider natively. By default, it will run TLSv1
  but cannot handle TLSv1.2 therefore the SSLv3 ciphers cannot be
  eliminated. Take care to ensure that your clients only connect with
  TLSv1 if possible.

* Sun Jun 22 2014 Kendall Moore <kmoore@keywcorp.com> - 4.1.0-1
- Removed MD5 file checksums for FIPS compliance.

* Mon Apr 14 2014 Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
- Refactored manifests to pass all lint tests.
- Removed all singleton defines.
- Added spec tests.

* Fri Apr 04 2014 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-0
- Added some validation and removed the 'stock' class. It now resides in the
  'simp' module.
- Collapsed the sssd::conf class into sssd.

* Thu Feb 13 2014 Kendall Moore <kmoore@keywcorp.com> - 4.0.0-1
- Converted all string booleans to native booleans.

* Fri Oct 25 2013 Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-0
- Updated all 'source' File parameters to use the modules directory
  for Puppet 3 compatibility.

* Mon Oct 07 2013 Kendall Moore <kmoore@keywcorp.com> 2.0.0-8
- Updated all erb templates to properly scope variables.

* Mon Jan 07 2013 Maintenance
2.0.0-7
- Created a Cucumber test to toggle the sssd flag to true and ensure that the
  sssd service is running and the nscd service is stopped.

* Thu Jun 07 2012 Maintenance
2.0.0-6
- Ensure that Arrays in templates are flattened.
- Call facts as instance variables.
- Moved mit-tests to /usr/share/simp...
- Updated pp files to better meet Puppet's recommended style guide.

* Fri Mar 02 2012 Maintenance
2.0.0-5
- Improved test stubs.

* Mon Dec 26 2011 Maintenance
2.0-4
- Updated the spec file to not require a separate file list.

* Mon Oct 03 2011 Maintenance
2.0-3
- Updates to work around the fact that the latest version of SSSD will silently
  allow expired users to access the system due to bugs in the way it works with
  OpenLDAP.

* Fri Jul 15 2011 Maintenance
2.0-2
- Ensure that the minimum uid for LDAP is set to 501 by default.

* Wed May 25 2011 Maintenance - 2.0.0-1
- Updated to fix a bug where nscd was not getting shut down at boot time and
  sssd was not triggered to start.

* Tue Apr 05 2011 Maintenance - 2.0.0-0
- Initial offering of the SSSD module.
- The use requires the $use_sssd variable to be set to 'true' within scope.