KCM: Fix restart during/after upgrade Oct 02 12:26:57 host systemd[1]: Closed SSSD Kerberos Cache Manager responder socket. Oct 02 12:26:57 host systemd[1]: Stopping SSSD Kerberos Cache Manager responder socket. Oct 02 12:26:57 host systemd[1]: sssd-kcm.socket: Socket service sssd-kcm.service already active, refusing. Oct 02 12:26:57 host systemd[1]: Failed to listen on SSSD Kerberos Cache Manager responder socket. Oct 02 12:26:57 host systemd[1]: Stopping SSSD Kerberos Cache Manager... Oct 02 12:26:57 host sssd[kcm][21492]: Shutting down Oct 02 12:26:57 host systemd[1]: Stopped SSSD Kerberos Cache Manager. Resolves: https://pagure.io/SSSD/sssd/issue/3529 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

SYSTEMD: Replace parameter --debug-to-files with ${DEBUG_LOGGER} Users can set variable DEBUG_LOGGER in environment files (/etc/sysconfig/sssd or /etc/default/sssd; depending on the distribution) to override default logging to files. e.g. DEBUG_LOGGER=--logger=stderr DEBUG_LOGGER=--logger=journald Resolves: https://pagure.io/SSSD/sssd/issue/3433 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

MAN: sssd-secrets documentation Resolves: https://fedorahosted.org/sssd/ticket/3053 Documents the API and the purpose of the sssd-secrets responder. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

BUILD: Ship systemd service file for sssd-secrets Adds two new files: sssd-secrets.socket and sssd-secrets.service. These can be used to socket-acticate the secrets responder even without explicitly starting it in the sssd config file. The specfile activates the socket after installation which means that the admin would just be able to use the secrets socket and the sssd_secrets responder would be started automatically by systemd. The sssd-secrets responder is started as root, mostly because I didn't think of an easy way to pass the uid/gid to the responders without asking about the sssd user identity in the first place. But nonetheless, the sssd-secrets responder wasn't tested as non-root and at least the initialization should be performed as root for the time being. Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>