sssd-2.14.0-beta2

See full release notes here.

What's Changed

• tests: cover sssctl debug-level when SSSD is stopped and for PAC by @madhuriupadhye in #9362
• tests: Add tests for AD Forest multidomain and gpo tests by @jakub-vavra-cz in #9045
• SPEC: 'sssd-idp' requires 'libsss_idmap' by @alexey-tikhonov in #9403
• man: fix SEE ALSO punctuation after pam_sss by @asundark-tech in #9355
• certmap: check that SID exists in certificate by @thalman in #9408
• FreeBSD CI: Switch to 15.1-RELEASE by @arrowd in #9421
• tests: remove legacy intg test suite by @danlavu in #9078
• tests: collapse su/ssh parametrization in test_gpo.py by @danlavu in #9401
• tests: add autofs test for default autofs_provider behavior by @krishnavema in #9407
• nfs idmap: error out if buffer is too small by @sumit-bose in #9400
• PAM: clear state pointer before freeing state itself by @thalman in #9411
• test: fix missing cmocka prerequisite includes in test_nfsidmap.c by @pbrezina in #9441
• ldap: pwd_expire_policy_warn does not overwrite errors by @sumit-bose in #9393
• Tests: Convert remaining single-server ldap failover bash tests by @aborah-sudo in #9337
• sssctl: Improve the 'sssctl analyze' help output by @asakure in #9386
• tests: test_ldap_password_policy.py::test_bz954323 migration by @PetoSisan in #9402
• Man: fix sss_obfuscate(8) domain option and synopsis by @apeddire-wq in #9380
• krb5: filter AD host principals during TGT validation by @sumit-bose in #9381
• Treat shadowExpire=0 correctly by @thalman in #9442
• nss: guard against length underflow in packet by @justin-stephenson in #9463
• autofs: avoid leaked enumeration contexts after map by @justin-stephenson in #9464
• Add AD certificate authentication test by @krishnavema in #8453
• pam: keep preauth indicator for socket activation by @Apollo3zehn in #9399
• oidc_child: escape single quotes in Entra ID OData filters by @pbrezina in #9471
• 'autofs' CVE fixes by @alexey-tikhonov in #9486
• Tests: multihost ldap password policy fixes by @spoore1 in #9419
• tests: clear sssd cache in teardown of AD idmap range tests by @spoore1 in #9412
• IDP: Clean old items from open_request_table by @thalman in #9481
• autofs: add 'allowed_uids' option to the autofs responder by @alexey-tikhonov in #9489
• New SSS_NSS_GETORIGBYUSERNAME_WITH_GROUPS 'sss_client' command by @alexey-tikhonov in #8800
• ci: move system tests from Github Actions to Testing Farm by @pbrezina in #9304
• PAM/Authtok vulnerability fixes by @justin-stephenson in #9446
• Fix: Preserve explicitly set 'none' provider values by @rakkumar607 in #9420
• responder: back off accept() on fd exhaustion to stop busy-spin by @pbrezina in #9507
• ipa: compare users with domain awareness against HBAC rules by @pbrezina in #9508
• tests: wait for DNS resolve failure before checking logs by @madhuriupadhye in #9529
• kcm: prune per-connection credential cache on DESTROY by @pbrezina in #9514
• man: krb5_ccachedir is no longer created by SSSD by @kaushikub in #9539
• tests: test_ldap_password_policy.py::test_maxage migration by @PetoSisan in #9513
• kcm: do not hang on empty request message body by @pbrezina in #9530
• Add options to exclude UID and GID by @aplopez in #9515
• pam: offer local Smartcard authentication to GDM switchable authentication by @divinehawk in #9368
• ci: remove sssd db prior restarting it on ipa container by @pbrezina in #9562
• Fix ldap_use_ppolicy name in LDAP ppolicy test docstring by @rakkumar607 in #9568
• Tests/remove converted multihost by @madhuriupadhye in #9576
• PAM: Stop treating gdm-password as a Smartcard-capable service by @joantolo in #9493
• tests: fix false positive journal check for ldap_sudo_search_base war… by @madhuriupadhye in #9519
• lock session when smartcard removed (when gdm-switchable-auth is used too) by @joantolo in #9516
• CVE-2026-104041: another take (2) by @alexey-tikhonov in #9585
• po: update translations by @alexey-tikhonov in #9598

New Contributors

• @asundark-tech made their first contribution in #9355
• @apeddire-wq made their first contribution in #9380
• @Apollo3zehn made their first contribution in #9399
• @kaushikub made their first contribution in #9539
• @divinehawk made their first contribution in #9368

Full Changelog: 2.14.0-beta1...2.14.0-beta2