sssd-users

sssd-users@lists.fedorahosted.org

1864 discussions

default_ccache_name ignored/overridden
by dasmouse 27 Aug '26

27 Aug '26

Hello sssd-users list I'm working on linux workstations in a single-domain Active Directory environment and I'm having a bit of trouble getting Kerberos authenticated SMB printing to work. In krb5.conf under [libdefaults] I have default_ccache_name = FILE:/tmp/krb5cc_%{uid}. In sssd.conf the krb5_ccname_template key I have left unconfigured. When I login I read in sssd_MYDOMAIN.log of the workstation: [sss_check_cc_template]: ccache file name template [FILE:/tmp/krb5cc_%{uid}] doesn't contain randomizing characters (XXXXXX), file might not be rewriteable. [... and much later ...] [krb5_mod_ccname]: Save ccname [FILE:/tmp/krb5cc_123456_Fl5FAw] for user [domainuser@mydomain]. From these log entries I take it that for some reason krb5.conf's default_ccache_name template gets overridden. Consequently, instead of a krb5 user cache credential path of FILE:/tmp/krb5cc_123456 that cups could read I get a /tmp/krb5cc_123456_Fl5FAw which cups responds to with file not found and cups requests user authenication. If I cp -p /tmp/krb5cc_123456_Fl5FAw to /tmp/krb5cc_123456 I can print Kerberos authenticated. In the sssd-krb5 documentation I can't find any hint on why the overriding takes place. Could you please help me? Best wishesPhilipp

2 1

GPO-based access control
by Tom Carpenter 03 Aug '26

03 Aug '26

Our campus hosts an on-prem Active Directory domain; Linux users I support run Ubuntu. Ultimately I'd like to implement the use of adsys to configure Ubuntu systems, but before trying to tackle that I'd like to resolve an issue I've run into with SSSD's GPO-based access control. I can successfully join Ubuntu systems to our AD domain, domain users can authenticate and home directories are automatically created, etc. However when I've executed "systemctl status sssd" I had been seeing the notification "Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode." I didn't see that there were any GPOs that would have been read by SSSD that would have generated that message so I modified the debug level for various SSSD-related logs. It seems as though it was after I executed "sssctl debug-level 0x0400 --domain <our campus domain>" that the "Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode." messages stopped. At that point I changed "ad_gpo_access_control = permissive" to "ad_gpo_access_control = enforcing", put a test system into an OU with a GPO that implements an ACL, and things seem to be working the way I would expect. I'd like to figure out why those warning messages appeared in the first place and what changed that made them stop. What information, logs, etc. would be helpful?

2 1

`ldap_sudo_search_base` is not set warning
by Orion Poplawski 02 Aug '26

02 Aug '26

I'm starting to see this: sssd_be[130128]: `ldap_sudo_search_base` is not set. SSSD will search the entire directory tree (dc=nwra,dc=com) for sudoRole objects. This may allow any LDAP principal with write access to any subtree to inject sudo rules granting arbitrary privileges. Set `ldap_sudo_search_base` to restrict the search scope (e.g., 'ou=sudoers,dc=example,dc=com'). Possibly due to an update to sssd-2.9.8-4.el9_8.1 But I already have: sudo_provider = ipa Shouldn't that already set an appropriate value for ldap_sudo_search_base? I have an IPA domain and a trusted (by IPA) AD domain. I'm not using ldap directly. -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 1

Correctly 'reset' a user access...
by Marco Gaiarin 26 Jun '26

26 Jun '26

[Subject is a bit misleading, but really i don't know how to write it...] In our domain we have some 'guest' users, that can logon to PCs, but data have to be wiped out on logoff. In a SSSD-joined box (ZorinOS/Ubuntu) i've added to /etc/rc.local, simply: # Remove on reboot guests homes. # for h in `find /home/ -maxdepth 1 -type d -group 'domain guests'`; do rm -rf $h if [ -x "/usr/sbin/sss_cache" ]; then sss_cache --user `basename $h`; fi done I've added sss_cache call because if i remove only the home, i cannot relogon (GDM throw an error...). In this way, work; but i can relogon as guest user if and only if i do a logon with another domain user; eg: a) test logon with guest user, worked b) reboot c) logon with guest user, failed d) logon with another domain user (tipically, non-guest) e) logon with guest user, worked What i'm doing wrong? Thanks. --

2 3

Export certificates for WPA/TLS...
by Marco Gaiarin 19 Jun '26

19 Jun '26

In our domain we use WPA Enterprise with TLS, managing certificates and wifi profiles for windows joined clients with the windows tools (windows CA, certificate generation and deployments for clients, ...). For non-windows client (mostly, linux) we export certificate with: Get-Certificate -Template "NPSClientno-domain" -DnsName clienthostname -SubjectName "cn=clienthostname" -CertStoreLocation cert:\LocalMachine\My to the local storage of a windows box, then with certlm.msc we export the certificate and then load to the client. I know that there's some stuff to do this automagically (eg, Ubuntu adsys; but also Samba seems have some tool...). But there's some way to simply export the certificate directly from Linux? I hope i was clear. Thanks. --

1 0

Trouble joining a forest - error on root domain
by Marco Gaiarin 19 Jun '26

19 Jun '26

I've tried to join an Ubuntu machine (22.04, latest upgrade applied) to our domain, composed of a root domain (ad.myshortdomain.it) and 4 other domain (lom.ad.myshortdomain.it, ven.ad.myshortdomain.it, fvg.ad.myshortdomain.it, pug.ad.myshortdomain.it), in a forest. I've joined the ubuntu box to one of the subdomain (ven.ad.myshortdomain.it). Join worked as expected, but i was not able to authenticate. I catch error like: [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [be_resolve_server_process] (0x0200): [RID#6] Found address for server lnfdc2.ad.myshortdomain.it: [10.7.5.22] TTL 2115 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_kinit_kdc_resolved] (0x1000): [RID#6] KDC resolved, attempting to get TGT... [...] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0100): [RID#6] Executing sasl bind mech: GSS-SPNEGO, user: CNL-RICERCA$ * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x0040): [RID#6] SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0080): [RID#6] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x1000): [RID#6] Waiting for child [3942]. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0100): [RID#6] child [3942] finished successfully. * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 14:22:48): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0020): [RID#6] waitpid did not found a child with changed status. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [_be_fo_set_port_status] (0x8000): [RID#6] Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2125 * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0100): [RID#6] Marking port 389 of server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0400): [RID#6] Marking port 389 of duplicate server 'lnfdc2.ad.myshortdomain.it' as 'not working' * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#6] Trace: sh[0x61ee25d7b110], connected[1], ops[(nil)], ldap[0x61ee25d7aa80], destructor_lock[0], release_memory[0] * (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#6] Successfully removed connection callback. and i was forced to limit access to subdomain, adding in /etc/sssd/sssd.conf: ad_enabled_domains = ven.ad.myshortdomain.it After that, still i catch errors that prevent me to open sessions, like: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_op_finished] (0x0400): [RID#5] Search result: Referral(10), 0000202B: RefErr: DSID-0310079D, data 0, 1 access points ref 1: 'ad.myshortdomain.it' * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_ext_add_references] (0x1000): [RID#5] Additional References: ldap://ad.myshortdomain.it/cn=%7BA66B11F6-4E7E-42F7-A0C0-B1548B3378B7%7D,cn=policies,cn=system,DC=ad,DC=lnf,DC=it * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_op_destructor] (0x2000): [RID#5] Operation 21 finished * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sss_domain_get_state] (0x1000): [RID#5] Domain ven.ad.myshortdomain.it is Active * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#5] Could not find domain matching [ad.myshortdomain.it] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x0200): [RID#5] communication error on cached connection, moving to next server * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] advising for connection retry #1 * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] releasing operation connection * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_release_conn_data] (0x4000): [RID#5] Releasing unused connection with fd [20] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#5] Trace: sh[0x58cb6cdc3bc0], connected[1], ops[(nil)], ldap[0x58cb6cdc2c10], destructor_lock[0], release_memory[0] * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#5] Successfully removed connection callback. * (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_som_attrs_done] (0x0040): [RID#11] no attrs found for SOM; try next SOM * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#11] Could not find domain matching [ad.myshortdomain.it] * ... skipping repetitive backtrace ... (2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#11] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile) * ... skipping repetitive backtrace ... (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated (2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated seems to me related to GPO, still of the root domain; i was forced to add also to /etc/sssd/sssd.conf: ad_gpo_access_control = disabled ad_gpo_ignore_unreadable = True ad_gpo_default_right = permit What is wrong on my setup? Thanks. --

4 11

Understanding uidNumber/gidNumber Filters
by Al Griff 09 Jun '26

09 Jun '26

I'm trying to build a caching proxy using OpenLDAP to improve login times against a remote LDAP directory. This requires me to understand what queries SSSD is running so I can craft appropriate templates for slapd. After banging my head against this for some days I realised the problem is slapd does not support caching of filters using negation. Unfortunately SSSD appears to append the following to the end of many queries for posixUser or posixGroup (&(uidNumber=*)(!(uidNumber=0)) (&(gidNumber=*)(!(gidNumber=0)) So, two questions. 1) what is the purpose of this? and 2) can it be disabled in any way?

3 3

05 Jun '26

I have a laptop enrolled with a FreeIPA server. Often, first login attempts fail and I have these logs in /var/log/sssd/krb5_child.log : (2026-06-04 15:55:33): [krb5_child[2738]] [validate_tgt] (0x0020): [RID#485] error reading keytab [/etc/krb5.keytab], not verifying TGT. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] Starting under ruid=995, euid=995, suid=995 : rgid=993, egid=993, sgid=993 * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] With following capabilities: CAP_DAC_READ_SEARCH: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* CAP_SETGID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* CAP_SETUID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1* * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x1000): [RID#485] total buffer size: [146] * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] cmd [249 (pre-auth)] uid [1462] gid [1462] validate [true] enterprise principal [false] offline [true] UPN [william.oprandi(a)FR.OTERA.LAN] * (2026-06-04 15:54:23): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] ccname: [KEYRING:persistent:1462] old_ccname: [KEYRING:persistent:1462] keytab: [/etc/krb5.keytab] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_cc_verify_ccache] (0x2000): [RID#485] TGT not found or expired. * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_ccache_check] (0x4000): [RID#485] Old ccache is [KEYRING:persistent:1462] and is active and TGT is valid. * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_ccache_check] (0x4000): [RID#485] Reusing old ccache [KEYRING:persistent:1462] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] Running under ruid=1462, euid=1462, suid=995 : rgid=1462, egid=1462, sgid=993 * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_log_process_caps] (0x0100): [RID#485] With following capabilities: (nothing) * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_setup] (0x0400): [RID#485] Updating principal * (2026-06-04 15:54:23): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific renewable lifetime requested. * (2026-06-04 15:54:23): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific lifetime requested. * (2026-06-04 15:54:23): [krb5_child[2738]] [main] (0x0400): [RID#485] Will perform pre-auth * (2026-06-04 15:54:23): [krb5_child[2738]] [tgt_req_child] (0x1000): [RID#485] Attempting to get a TGT * (2026-06-04 15:54:23): [krb5_child[2738]] [get_and_save_tgt] (0x0400): [RID#485] Attempting kinit for realm [FR.OTERA.LAN] * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_auth_methods_request] (0x4000): [RID#485] Got request [password]. * (2026-06-04 15:54:23): [krb5_child[2738]] [request_password] (0x4000): [RID#485] Setting password prompting. * (2026-06-04 15:54:23): [krb5_child[2738]] [sss_krb5_auth_methods_request] (0x4000): [RID#485] Request found for password * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_send_data] (0x0200): [RID#485] Received error code 0 * (2026-06-04 15:54:23): [krb5_child[2738]] [pack_response_packet] (0x2000): [RID#485] response packet size: [24] * (2026-06-04 15:54:23): [krb5_child[2738]] [k5c_send_data] (0x4000): [RID#485] Response sent. * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x1000): [RID#485] total buffer size: [157] * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] cmd [241 (auth)] uid [1462] gid [1462] validate [true] enterprise principal [false] offline [false] UPN [william.oprandi(a)FR.OTERA.LAN] * (2026-06-04 15:55:33): [krb5_child[2738]] [unpack_buffer] (0x0100): [RID#485] ccname: [KEYRING:persistent:1462] old_ccname: [KEYRING:persistent:1462] keytab: [/etc/krb5.keytab] * (2026-06-04 15:55:33): [krb5_child[2738]] [k5c_setup] (0x0400): [RID#485] Principal unchanged, keeping existing * (2026-06-04 15:55:33): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific renewable lifetime requested. * (2026-06-04 15:55:33): [krb5_child[2738]] [set_lifetime_options] (0x0100): [RID#485] No specific lifetime requested. * (2026-06-04 15:55:33): [krb5_child[2738]] [set_canonicalize_option] (0x0100): [RID#485] Canonicalization is set to [true] * (2026-06-04 15:55:33): [krb5_child[2738]] [sss_krb5_auth_methods_answer] (0x4000): [RID#485] Got question [password]. * (2026-06-04 15:55:33): [krb5_child[2738]] [sss_krb5_expire_callback_func] (0x2000): [RID#485] exp_time: [14365252] * (2026-06-04 15:55:33): [krb5_child[2738]] [validate_tgt] (0x0020): [RID#485] error reading keytab [/etc/krb5.keytab], not verifying TGT. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2026-06-04 15:55:33): [krb5_child[2738]] [debug_and_log] (0x0020): [RID#485] 2587: [13][Permission denied] (2026-06-04 15:55:33): [krb5_child[2738]] [debug_and_log] (0x0040): [RID#485] 2677: [13][Permission denied] * ... skipping repetitive backtrace ... Running a kinit <user> works as expected. I don't experience any network latency. Disabling TGT validation (krb5_validate = false) "fixes" it. With Fedora 43 (SSSD 2.12.0), it was relatively rare. Since the update to Fedora 44 (SSSD 2.13.0), this problem has become much more prevalent. It

2 2

Unable to resolve gid from sibling domain
by Tech Burgher 29 May '26

29 May '26

Hello -- one of the customers we work with is unable to resolve gid from a silbing domain. When we run the id command, we see 4294967295 returned for some of the groups. Based on AI analysis, it suggests that, the "Forest Root Is Required for Complete Subdomain Discovery" and the "Global Catalog Is Required for Cross-Domain Group Memberships". It is recommending the sssd.conf be defined with the root domain, and the subdomains be inferred, via discovery. This is only an extract, but the current sssd.conf provides no mention of the root domain, only the domains that the accounts belong to: ############################################################ # DOMAIN: domain1.foo.com ############################################################ [domain/domain1.foo.com] ad_server = _srv_ id_provider = ad auth_provider = ad access_provider = ad ad_domain = domain1.foo.com subdomains_provider = ad ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members ############################################################ # DOMAIN: domain2.foo.com ############################################################ [domain/domain2.foo.com] ad_server = _srv_ id_provider = ad auth_provider = ad access_provider = ad ad_domain = domain2.foo.com subdomains_provider = ad ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members It is proposing this change: [domain/foo.com] id_provider = ad auth_provider = ad access_provider = ad ad_domain = foo.com subdomains_provider = ad # discovers domain1, domain2 automatically ldap_id_mapping = False krb5_store_password_if_offline = True filter_users = root filter_groups = root ignore_group_members = True subdomain_inherit = ignore_group_members Does the proposal sound reasonable given the observed behavior? Thank you for your time.

2 1

kscreenlocker fails on the first attempt to unlock with pam_sss error
by Marek Greško 04 May '26

04 May '26

Hello, some time ago the users started to observe strange issue. When they try to unlock the kscreenlocker after switching consoles by Atl+Fx key even the type correct password, it fails and this is found in the logs: kscreenlocker_greet[109438]: pam_sss(kde:auth): received for user username: 4 (Chyba systému), which means system error. I cannot see any other log with more details on this. The second attempt works. It is hard to say when the issue started, because longer time we were thinking users just type wrong password. We are going to elaborate more on this. We are unsure whether the console switching is the necessary condition or only waiting for longer time is sufficient. Apparently when I try to unlock after several minutes, it works on a first attempt. Thanks Marek

1 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users