Accepting request 1296905 from network:ldap

- Update to release 2.11.1

OBS-URL: https://build.opensuse.org/request/show/1296905
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=144

_scmsync.obsinfo

@@ -0,0 +1,4 @@
+mtime: 1753994117
+commit: 0e0d1361c8452d81d3f95f3e2e6ee1170e16356d1e2c4145af472ea204b6b873
+url: https://src.opensuse.org/jengelh/sssd
+revision: master

build.specials.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a31e4d0a5d8f6b3d45219c049e9bb6f29dc8d630ca5dbc7f9e4e89be2ae35fa2
+size 256

sssd-2.11.1.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmiLT74ACgkQ09IbKRDP
+Z1nIIQ/+NjryrInjiH9LmBZKa5wgYE8d49aHxtOc4pySV3CFhVMM0cUT0rO1umy3
++4xlvxDs/7OYdZkJapotcpf8CJDyLttxsA4/0gfBDGoCRsRLAXxnoZ9K7+0PgV5j
+2DbB6+0Ay0JJ9IYjJwoIMbSKiWm2/KuqLBicNoaxvYK/OJc/K+3AkPIyqVmOItl8
+23UOMuMn6NRBJP6m0R+LUEJQ4rW6cej1lc+mqsPYlerHY8BmRFzRcFjVqhsgUpQj
+hCTJwq5iUpbhiyDIpYzGeS5Jr0bxAVeAZbo4YcN2GQVawOjLQYOP7UPWFm80JLbQ
+GEvQHHo2YDBxcZEma6Z614/8aQI6nVzc/DMq3ffPb4E5snMJ+/v9LCGN1jjmCPWo
+TSiYZrt33zeJrmsmnImWT4ejErkt7dLV9qOQS6BTjHGtgNgl4qrbiFLSZZk2oJp6
+1eJERF/uqBmBYJ2Bq7Fq0Gp4u90TK6kgLV8pkz71Tl+BUPjoD8H9b6VMrwY0jiux
+FfE9ZjWDDAlaLqRlbpd6lVHiQfkgCUflw7o5E+jSL96S4X+6e1aCcL3vdkLxFSCa
+PCQggDD+Ng2HvNsqQ8Z1eA0k2wNuYUNLKab2eUcc4siIKmoMsPQkgmLUBINiPMyR
+GR6ZQ6xdiQkBFBC+JplQM5AsVddJ7UZ2DCzUzFkriyqua58Cuyo=
+=DoFI
+-----END PGP SIGNATURE-----

sssd-2.12.0.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmlnsBgACgkQ09IbKRDP
-Z1m37g/+PxhS87IGms8Rl3WNf7MnJ9I8ACq+bWp5fJMx3MkX41GKohMVedbNiOSF
-mtJWDnStnHZoJ0iF8hWdSqihKhDRmFzf4vO5o3TqzjzwFGGiBHBgpjlKwYRp4iGz
-jNH+4kseY8zrzTOt4/ayX9wys+QlzJcl8QACq36rcUnKCGMxh7LdpzScIugqbxQl
-0t9u00e5hslxxvBe4R1xRsjRZbD4cBvfw1pe313efMyZVN1o83afhFQLMYxBsjDw
-G8Y1cLuyESfp7fOkM/Wq0ikAVzWXf5DmSt5Rlkkgm3eO7e8Mh3nazBBp4MtmR8/y
-8MGf/9mssoGJl0mV2giAjJLwHQsiY/F9BZ6Qvanu/cIvAZPahNmphA8QVKv8eBzB
-A4VBqW1XUmXn6aD8zmayyYLqGoAZaXDZxz21wYAAzbZ+8aipODPS3/loBVVQD7up
-KBB2hbUrlOilSGAtuBXgny+QA1KHYQRMMK94lS4oU8GnpYAkAzo8IzyLpuxzEnhk
-tJUSLPCoM/yKjGe0PWBoXs3mo23u/SXjt3UTH+jEst4hLG1TB0eH2OPnN8UKz1W/
-zm7nAPZ3iPH4bbgSqOMSr8Vg2pp0SKkYrIa3ru8Hb3YjA0QC7uriX6fkyltdoI7z
-GizxsRyKE5zNgJr33mZn4qqBcSATHJ4p3iJRQKK1DqW0UeVzNM4=
-=CSNh
------END PGP SIGNATURE-----

sssd.changes

@@ -1,32 +1,3 @@
--------------------------------------------------------------------
-Thu Jan 15 16:47:44 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
-
-- Update to release 2.12.0
-  * Fixed CVE-2025-11561 by disabling an2ln in the default
-    implicitly created Kerberos configuration snippet, typically in
-    /var/lib/sss/pubconf/krb5.include.d/localauth_plugin.
-  * SSSD now allows using machine credentials from a trusted AD
-    domain or Kerberos realm if no suitable domain-local
-    credentials are available.
-  * SSSD now supports authentication mechanism selection through
-    PAM using a JSON-based protocol. This feature enables
-    passwordless authentication mechanisms in GUI login
-    environments that support the protocol (e.g. GNOME 50).
-  * The generic SSSD LDAP provider (id_provider = ldap) now
-    supports fetching subid ranges, a feature previously supported
-    only by the IPA provider.
-  * The default value of the `session_provider` option was changed
-    to `none` (i.e. disabled) no matter what id_provider is used.
-- Delete 0002-krb5-disable-Kerberos-localauth-an2ln-plugin-for-AD-.patch
-  (merged)
-
--------------------------------------------------------------------
-Tue Nov 18 09:38:39 UTC 2025 - Samuel Cabrero <scabrero@suse.de>
-
-- Disable Kerberos localauth an2ln plugin for AD; (CVE-2025-11561);
-  (bsc#1251827);
-  add 0002-krb5-disable-Kerberos-localauth-an2ln-plugin-for-AD-.patch
-
 -------------------------------------------------------------------
 Thu Jul 31 16:15:46 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
 

sssd.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package sssd
 #
-# Copyright (c) 2026 SUSE LLC and contributors
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,14 +17,13 @@
 
 
 Name:           sssd
-Version:        2.12.0
+Version:        2.11.1
 Release:        0
 Summary:        System Security Services Daemon
 License:        GPL-3.0-or-later AND LGPL-3.0-or-later
 Group:          System/Daemons
 URL:            https://github.com/SSSD/sssd
 #Git-Clone:	https://github.com/SSSD/sssd
-#Changelog:     https://sssd.io/release-notes/sssd-2.12.0.html
 Source:         https://github.com/SSSD/sssd/releases/download/%version/%name-%version.tar.gz
 Source2:        https://github.com/SSSD/sssd/releases/download/%version/%name-%version.tar.gz.asc
 Source3:        baselibs.conf
@@ -48,17 +47,17 @@ BuildRequires:  libcmocka-devel
 %if 0%{?suse_version} >= 1600
 BuildRequires:  libsubid-devel
 %endif
-BuildRequires:  libopenssl-3-devel
 BuildRequires:  libtool
 BuildRequires:  libunistring-devel
 BuildRequires:  libxml2-tools
 BuildRequires:  libxslt-tools
+BuildRequires:  libopenssl-3-devel
 BuildRequires:  nss_wrapper
 BuildRequires:  openldap2-devel
 BuildRequires:  pam-devel
 BuildRequires:  pkg-config >= 0.21
-BuildRequires:  python3-setuptools
 BuildRequires:  python3-wheel
+BuildRequires:  python3-setuptools
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  sysuser-tools
 BuildRequires:  uid_wrapper
@@ -126,6 +125,7 @@ Obsoletes:      sssd-common < %version-%release
 %define mcpath		%sssdstatedir/mc
 %define ldbdir %(pkg-config ldb --variable=modulesdir)
 
+
 %if 0%{?suse_version} >= 1600
 %define permissions_path %_datadir/permissions/permissions.d/
 %else
@@ -343,6 +343,29 @@ Requires:       libsss_nss_idmap0 = %version
 %description -n libsss_nss_idmap-devel
 A utility library for FreeIPA to map Windows SIDs to Unix user/group IDs.
 
+%package -n libsss_simpleifp0
+Summary:        The SSSD D-Bus responder helper library
+License:        GPL-3.0-or-later
+Group:          System/Libraries
+# Even though sssd has obsoleted simpleifp, the plan here is to retain ABI
+# compatibility with the existing SUSE 15.x product line. ...at least, until
+# sssd completely removes SIFP from source.
+
+%description -n libsss_simpleifp0
+This subpackage provides a library that simplifies the D-Bus API for
+the SSSD InfoPipe responder.
+
+%package -n libsss_simpleifp-devel
+Summary:        Development files for the SSSD D-Bus responder helper library
+License:        GPL-3.0-or-later
+Group:          Development/Libraries/C and C++
+Requires:       libsss_simpleifp0 = %version
+
+%description -n libsss_simpleifp-devel
+This subpackage provides the development files for sssd's simpleifp,
+a library that simplifies the D-Bus API for the SSSD InfoPipe
+responder.
+
 %package -n libsss_sudo
 Summary:        A library to allow communication between sudo and SSSD
 License:        LGPL-3.0-or-later
@@ -408,17 +431,18 @@ autoreconf -fiv
 	--with-pid-path="%_rundir/sssd" \
 	--enable-pammoddir="%_pam_moduledir" \
 	--with-ldb-lib-dir="%ldbdir" \
+	--with-os=suse \
 	--disable-ldb-version-check \
 	--without-python2-bindings \
 	--without-oidc-child \
 	--with-sssd-user="%sssd_user" \
 %if 0%{?suse_version} >= 1600
 	--with-selinux=yes \
-	--with-subid \
+	--with-subid
 %else
 	--with-selinux=no \
+	--with-libsifp
 %endif
-	--with-os=suse
 %make_build all
 
 %install
@@ -529,10 +553,12 @@ fi
 # del_postun includes a try-restart
 %service_del_postun sssd.service sssd-autofs.service sssd-autofs.socket sssd-nss.service sssd-nss.socket sssd-pac.service sssd-pac.socket sssd-pam.service sssd-pam.socket sssd-ssh.service sssd-ssh.socket sssd-sudo.service sssd-sudo.socket
 
+
 %ldconfig_scriptlets -n libsss_certmap0
 %ldconfig_scriptlets -n libipa_hbac0
 %ldconfig_scriptlets -n libsss_idmap0
 %ldconfig_scriptlets -n libsss_nss_idmap0
+%ldconfig_scriptlets -n libsss_simpleifp0
 
 %verifyscript
 %verify_permissions -e %_libexecdir/%name/selinux_child %_libexecdir/%name/sssd_pam
@@ -661,7 +687,6 @@ fi
 %_mandir/man5/sssd-ldap-attributes.5*
 %_mandir/man5/sssd-session-recording.5*
 %_mandir/man5/sssd-simple.5*
-%_mandir/*/man5/sssd-simple.5*
 %_mandir/man5/sssd-sudo.5*
 %_mandir/man5/sssd.conf.5*
 %_mandir/man8/sssd.8*
@@ -751,7 +776,6 @@ fi
 %exclude %_libdir/sssd/libsss_idp.so
 %exclude %_libdir/%name/modules/sssd_krb5_idp_plugin.so
 %exclude %_mandir/man5/sssd-idp*
-%exclude %_mandir/*/man5/sssd-idp*
 
 %files ad
 %dir %_libdir/%name/

symvers.patch

@@ -15,11 +15,11 @@ the system only has libsss_util.so(-2.8.2) at this point.
  Makefile.am |   44 ++++++++++++++++++++++++++++++--------------
  1 file changed, 30 insertions(+), 14 deletions(-)
 
-Index: sssd-2.12.0/Makefile.am
+Index: sssd-2.10.1/Makefile.am
 ===================================================================
---- sssd-2.12.0.orig/Makefile.am
-+++ sssd-2.12.0/Makefile.am
-@@ -964,7 +964,11 @@ libsss_debug_la_SOURCES = \
+--- sssd-2.10.1.orig/Makefile.am
++++ sssd-2.10.1/Makefile.am
+@@ -971,7 +971,11 @@ libsss_debug_la_SOURCES = \
  libsss_debug_la_LIBADD = \
      $(SYSLOG_LIBS)
  libsss_debug_la_LDFLAGS = \
@@ -31,9 +31,9 @@ Index: sssd-2.12.0/Makefile.am
 +	echo "V_${PACKAGE_VERSION} { global: *; };" >$@
  
  pkglib_LTLIBRARIES += libsss_child.la
- libsss_child_la_SOURCES = src/util/child_handlers.c src/util/child_io.c
-@@ -973,7 +977,8 @@ libsss_child_la_LIBADD = \
-     $(TEVENT_LIBS) \
+ libsss_child_la_SOURCES = src/util/child_common.c
+@@ -981,7 +985,8 @@ libsss_child_la_LIBADD = \
+     $(DHASH_LIBS) \
      libsss_debug.la \
      $(NULL)
 -libsss_child_la_LDFLAGS = -avoid-version
@@ -42,7 +42,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_crypt.la
  
-@@ -1013,7 +1018,8 @@ libsss_crypt_la_LIBADD = \
+@@ -1021,7 +1026,8 @@ libsss_crypt_la_LIBADD = \
      libsss_debug.la \
      $(NULL)
  libsss_crypt_la_LDFLAGS = \
@@ -52,7 +52,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_cert.la
  
-@@ -1032,8 +1038,9 @@ libsss_cert_la_LIBADD = \
+@@ -1046,8 +1052,9 @@ libsss_cert_la_LIBADD = \
      libsss_debug.la \
      $(NULL)
  libsss_cert_la_LDFLAGS = \
@@ -63,7 +63,7 @@ Index: sssd-2.12.0/Makefile.am
  
  generate-sbus-code:
  	$(builddir)/sbus_generate.sh $(abs_srcdir)
-@@ -1134,8 +1141,9 @@ libsss_sbus_la_CFLAGS = \
+@@ -1148,8 +1155,9 @@ libsss_sbus_la_CFLAGS = \
      $(DBUS_CFLAGS) \
      $(NULL)
  libsss_sbus_la_LDFLAGS = \
@@ -74,7 +74,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_sbus_sync.la
  libsss_sbus_sync_la_SOURCES = \
-@@ -1170,8 +1178,9 @@ libsss_sbus_sync_la_CFLAGS = \
+@@ -1184,8 +1192,9 @@ libsss_sbus_sync_la_CFLAGS = \
      $(UNICODE_LIBS) \
      $(NULL)
  libsss_sbus_sync_la_LDFLAGS = \
@@ -85,7 +85,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_iface.la
  libsss_iface_la_SOURCES = \
-@@ -1200,8 +1209,9 @@ libsss_iface_la_CFLAGS = \
+@@ -1214,8 +1223,9 @@ libsss_iface_la_CFLAGS = \
      $(DBUS_CFLAGS) \
      $(NULL)
  libsss_iface_la_LDFLAGS = \
@@ -96,7 +96,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_iface_sync.la
  libsss_iface_sync_la_SOURCES = \
-@@ -1228,8 +1238,9 @@ libsss_iface_sync_la_CFLAGS = \
+@@ -1242,8 +1252,9 @@ libsss_iface_sync_la_CFLAGS = \
      $(DBUS_CFLAGS) \
      $(NULL)
  libsss_iface_sync_la_LDFLAGS = \
@@ -107,17 +107,17 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libsss_util.la
  libsss_util_la_SOURCES = \
-@@ -1323,7 +1334,8 @@ endif
- if BUILD_SYSTEMTAP
- libsss_util_la_LIBADD += stap_generated_probes.lo
- endif
+@@ -1338,7 +1349,8 @@ endif
+ if BUILD_PASSKEY
+ libsss_util_la_SOURCES += src/db/sysdb_passkey_user_verification.c
+ endif # BUILD_PASSKEY
 -libsss_util_la_LDFLAGS = -avoid-version
 +libsss_util_la_LDFLAGS = -avoid-version ${symv}
 +EXTRA_libsss_util_la_DEPENDENCIES = x.sym
  
  SSSD_INTERNAL_LTLIBS = \
      libsss_util.la \
-@@ -1339,7 +1351,7 @@ lib_LTLIBRARIES = libipa_hbac.la \
+@@ -1354,7 +1366,7 @@ lib_LTLIBRARIES = libipa_hbac.la \
                    $(NULL)
  
  pkgconfig_DATA += src/lib/ipa_hbac/ipa_hbac.pc
@@ -126,7 +126,7 @@ Index: sssd-2.12.0/Makefile.am
  libipa_hbac_la_SOURCES = \
      src/lib/ipa_hbac/hbac_evaluator.c \
      src/util/sss_utf8.c
-@@ -1636,8 +1648,9 @@ libifp_iface_la_CFLAGS = \
+@@ -1682,8 +1694,9 @@ libifp_iface_la_CFLAGS = \
      $(DBUS_CFLAGS) \
      $(NULL)
  libifp_iface_la_LDFLAGS = \
@@ -137,7 +137,7 @@ Index: sssd-2.12.0/Makefile.am
  
  pkglib_LTLIBRARIES += libifp_iface_sync.la
  libifp_iface_sync_la_SOURCES = \
-@@ -1662,8 +1675,9 @@ libifp_iface_sync_la_CFLAGS = \
+@@ -1708,8 +1721,9 @@ libifp_iface_sync_la_CFLAGS = \
      $(DBUS_CFLAGS) \
      $(NULL)
  libifp_iface_sync_la_LDFLAGS = \
@@ -148,7 +148,7 @@ Index: sssd-2.12.0/Makefile.am
  
  sssd_ifp_SOURCES = \
      src/responder/ifp/ifpsrv.c \
-@@ -4303,8 +4317,9 @@ libsss_ldap_common_la_LIBADD = \
+@@ -4314,8 +4328,9 @@ libsss_ldap_common_la_LIBADD = \
      $(SSSD_INTERNAL_LTLIBS) \
      $(NULL)
  libsss_ldap_common_la_LDFLAGS = \
@@ -159,7 +159,7 @@ Index: sssd-2.12.0/Makefile.am
  if BUILD_SYSTEMTAP
  libsss_ldap_common_la_LIBADD += stap_generated_probes.lo
  endif
-@@ -4360,7 +4375,8 @@ libsss_krb5_common_la_LIBADD = \
+@@ -4371,7 +4386,8 @@ libsss_krb5_common_la_LIBADD = \
      $(SSSD_INTERNAL_LTLIBS) \
      $(NULL)
  libsss_krb5_common_la_LDFLAGS = \