Version 0.3.1:
-   General code cleanup and cleanup of gt4-interface-install:
    Previous README file is now manpage for gt4-interface-install which is
    renamed from gt4-interface-install.sh and updated for flavor-less globus.
    Previous outdated examples are either removed or updated.
-   Implement support for the 'sharing' service: when the service name is
    'sharing' the callout receives an additional argument (a PEM-string),
    which contains the credential on which the mapping should be based.
-   Bug fix: setting LLGT_ENABLE_DEBUG should also work for logging to file.
-   Bug fix: certain log entries are missing the last character.

Version 0.3.0:
-   When a 'desired_identity' is passed in from the Globus framework (e.g.
    gsissh), then this is passed to LCMAPS, iff the LCMAPS version >=1.6.0.
    LCMAPS makes this available to its plugins, to provide support for
	"/DN" user1,user2
    or
	"/FQAN" user1,user2
    syntax in the grid-mapfile for the (voms)localaccount plugin.
-   Bug fix: when callout runs twice with a logfile, it could cause a segfault.

Version 0.2.6:
-   LCAS is terminated and dlclose()ed after LCMAPS. This prevents a segfault
    appearing when VOMS is re-initialized after it is unloaded due to a dlclose
    on RH5 based systems in a globus setup.
-   Add env var LLGT_DLCLOSE_LCAS, when set to no, disable or disabled, do NOT
    call dlclose() on lcas. This might further aid with the RH5
    OpenSSL/VOMS/Globus dlclose bug.

Version 0.2.5:
-   The result of LCMAPS mapping is stored. When a non-NULL 'desired identity'
    is presented, a previous result is available, and the two results match,
    LCMAPS is not run a second time.
    This behaviour can be disabled by setting the new environment variable
    LLGT_CACHE_CALLOUT to no, disable or disabled.
-   Do not call globus_module_deactivate() since this might corrupt e.g. the
    OpenSSL library, it should be called from the calling program.
-   Add env var LLGT_DLCLOSE_LCMAPS, when set to no, disable or disabled, do NOT
    call dlclose() on lcmaps. This is a workaround for a RH5-based bug relating
    to gsisshd, which (could) run the callout twice.
-   Include a manpage for the install script.
-   Improve logging:
    -	When LLGT_LOG_FILE is provided and it can be opened, llgt internal
        logging goes to this file. In that case LCAS_LOG_FILE and
        LCMAPS_LOG_FILE when unset, will be set to the same file.
-   In case of syslog, openlog() is only called when either the log facility or
    the log ident is overridden (LLGT_LOG_FACILITY or LLGT_LOG_IDENT).

Version 0.2.4:
-   Fix a bug with closing the log file.

Version 0.2.3:
-   Sync headers with those specified in globus_internal.h headers in LCMAPS
-   Fix remaining renaming of globus_internal.h into llgt_globus_internal.h
-   Explicitly prefix globus_internal.h with llgt_ and insert macro to enforce
    single inclusion.
-   When an LCAS_LOG_FILE=<file> or LCMAPS_LOG_FILE=<file> is provided to the
    LLGT, it opened a FILE handle (for each of the environments).
    Now it also closes them.
-   Prefix all files with llgt_. Rename configure options file into
    llgt_config.h Add missing llgt_config.h header to all c and h files.
-   Cleanup of code: splitup lcas and lcmaps dependent code in separate .c and
    .h files, which are prefixed with llgt_ to prevent confusion with the
    framework files. Further removal of dead code.
-   Cleanup dead code: comment-out functions and their prototypes if they are
    not being used. Also remove unused header files.
-   Cleanup code to limit the handling of internal globus structs. All these
    structs are now defined in globus_internal.h. The need for this arises
    because there is no public way of obtaining a gss_cred_id_t from a
    gss_ctx_id_t.
-   Fix proper handling of --disable-lcas:
    -   use of AM_CONDITIONAL in configure.ac 
    -   use of AC_DEFINE and #if(n)def to skip LCAS code
    -   don't compile lcas.c (not even as empty file) Add some comments on globus
        modules.
-   Fix use of LCMAPS_POLICY_NAME, it wasn't used by llgt4 since it called
    lcmaps_run_and_return_username with policies==NULL meaning parse all
    policies.  The LCMAPS_POLICY_NAME is now split into an array of policy
    names using new function llgt4_policy_tokenize() similar to lcmaps_tokenize
-   fix two memory leaks: liblcmaps_path (in lcmaps.c) and client name (in
    lcmaps_gt4_front.c). At the same time client name is only determined once
    from context.
-   fix typos: lcas instead of lcmaps (in lcmaps.c)



Version 0.2.0:
-   Changed the copyright to The Initiative for Globus in Europe project.
-   Moved the default logging facility from LOG_LOCAL1 to LOG_DAEMON.
-   Change the default logging facility with the $LLGT_LOG_FACILITY environment
    variable. Use the name of (standard syslog) facility names. Example:
    LOG_DAEMON, LOG_LOCAL1, etcetera
-   The $LLGT_LOG_IDENT can (optionally) be set as the Syslog ident value. This
    will be the identifying string in Syslog for the current process. Not using
    this option will let Syslog (or one of the GT services) to set these
    options.  By default the Syslog ident will be set to the executable name.
-   Changed the default LCAS_DEBUG_LEVEL value to the build in number 4. Which
    equal to a cut off at the LOG_INFO Syslog priority. Setting it on 5 will
    let it run with LOG_DEBUG enabled.
-   Switched internal time from localtime() to gmtime() to generate a
    JOB_REPOSITORY_ID and GATEKEEPER_JM_ID.
-   Set the environment variable $LLGT_RUN_LCAS to "no", "disabled" or
    "disable" to avoid LCAS to run prior to the LCMAPS.
-   There is a matching ./configure option "--enable-lcas" which can be used to
    change the default behaviour to run LCAS or not. The $LLGT_RUN_LCAS
    environment variable can still influence the LCAS run.
-   Added ./configure options similar gLExec to manipulate LCAS and LCMAPS
    usage, e.g.  --with-lcas-db=FILE, --with-lcas-moduledir-sfx=path,
    --with-lcas-moduledir=path, --with-lcmaps-db=FILE,
    --with-lcmaps-moduledir-sfx=path, --with-lcmaps-moduledir=path
-   When the variable LLGT_LIFT_PRIVILEGED_PROTECTION is set the post-LCMAPS
    mapping to the 'root' user and group check is disabled. This check is
    implicitly enable to prevent erroneous configuration to silently result
    into a root-account mapping in services that don't have preventions for
    this of themselves.  This setting is NEEDED in services that:
    1.) don't user switch, and run as root.
    2.) services that expect only a username to be returned and perform the
        user switch themselves, e.g. the Globus GSI-OpenSSHd.
-   Depreciated: $LLGT_NO_CHANGE_USER in favor of $LLGT_LIFT_PRIVILEGED_PROTECTION. 
                (Depreciation does not mean non-functional anymore)
-   Depreciated: $LLGT4_NO_CHANGE_USER in favor of $LLGT_LIFT_PRIVILEGED_PROTECTION. 
                (Depreciation does not mean non-functional anymore)
-   Set the environment variable $LLGT_VOMS_DISABLE_CREDENTIAL_CHECK to disable
    the VOMS verification at run-time in LCMAPS, provided that LCMAPS has the
    feature to select it at run-time.
-   Set the environment variable $LLGT_VOMS_ENABLE_CREDENTIAL_CHECK explicitly
    enable the VOMS attribute verification. It will override the LCMAPS
    build-in default, which could be disabled with certain build flags.
-   Support for a CFLAGS setting for LCAS_LIBDIR to open the liblcas.so library
    from an alternative location at build-time to override it's default.
    Example: export CFLAGS='-DLCAS_LIBDIR=\"/usr/local/lib/\"'
-   Support for an alternative LCAS_LIBDIR as a run-time setting by exporting
    $LLGT_LCAS_LIBDIR="/usr/local/lib/liblcas.so"
-   Support for a CFLAGS setting for LCMAPS_LIBDIR to open the liblcmaps.so library
    from an alternative location at build-time to override it's default.
    Example: export CFLAGS='-DLCMAPS_LIBDIR=\"/usr/local/lib/\"'
-   Support for an alternative LCMAPS_LIBDIR as a run-time setting by exporting
    $LLGT_LCMAPS_LIBDIR="/usr/local/lib/liblcmaps.so"
-   If the $LLGT_ENABLE_DEBUG environment variable is set, then the debugging
    message logged at level LOG_DEBUG are passed to the log. The scope of this
    setting is only within the LCAS-LCMAPS-GT-interface



Version 0.1.5:
Applying Brian Bockelman's patch for the services that can handle an account
change itself. For instance, GSISSH and Condor.

The scenario is as follows: LCMAPS resolves an account and typically enforced
it into the process by changing to the resolved account. The enforcement step
can be disabled by simply not running the posix_enf plug-in. In effect the
process is still running as root after the LCMAPS account resolvement and the
LCAS LCMAPS GT4/GT5 Callout kicks to throw an error on the (effective) user ID
or (effective) group ID being root.

The patch allows for an exception to this safety measure when the environment
variable "LLGT4_NO_CHANGE_USER" is set. The final check in the GT4/GT5 call-out
is bypassed and continues to pass the Username to the GT4/GT5 Call-out
framework of the service.

With some more time and concideration the need for this environment variable
might disappear as I currently think that these checks in the GT4/GT5 Call-out
could be safely regarded as pedantic.



Version 0.1.4:
Fix to use the GSS interface to LCAS again. LCMAPS was changed to use it, but
LCAS wasn't yet.  This is now fixed and the services work reliably again.
Error appeared in the logs indicating that LCAS couldn't read the credentials
as input.
