sssd-1.15.2-50.el7.6

The System Security Services Daemon (SSSD) service provides a set of daemons
to manage access to remote directories and authentication mechanisms. It also
provides the Name Service Switch (NSS) and the Pluggable Authentication
Modules (PAM) interfaces toward the system, and a pluggable back-end system to
connect to multiple different account sources.

This update fixes the following bugs:

* Prior to this update, the SSSD service handled sudo search filters inefficiently. As a consequence, the sssd_be process entered an infinite loop and consumed 100% of the CPU if an LDAP search filter contained a large number of sudo rules. With this update, a threshold value has been added to the SSSD service which limits the size of rules-refresh filters. As a result, the described problem no longer occurs. (BZ#1482927)

* Previously, an SSSD function return code was incorrectly translated across Samba shares. As a consequence, accessing Samba shares failed with the "session setup failed: NT_STATUS_LOGON_FAILURE" error message if Samba was configured to use SSSD for Active Directory (AD) authentication. With this update, the return code has been fixed, and the described problem no longer occurs. (BZ#1489290)

* Previously, the SSSD back end terminated unexpectedly when starting if the extended-key-usage (EKU) component of a matching rule contained only an object identifier (OID). With this update, a NULL pointer dereference has been fixed in SSSD, and the described problem no longer occurs. (BZ#1493916)

* Prior to this update, the AD provider component encountered an error when certificate mapping rules were evaluated for a trusted AD domain. As a consequence, the SSSD back end sometimes terminated unexpectedly when searching for a certificate after an offline-online cycle. With this update, the use-after-free error has been fixed, and, as a result, the described problem no longer occurs. (BZ#1493916)

Users of sssd are advised to upgrade to these updated packages, which fix
these bugs.