nss-pam-ldapd (0.9.9-1) unstable; urgency=medium

  * new upstream release:
    - support spaces in attribute mapping expressions
    - allow parsing longer lines in the configuration file
    - allow for longer host names (closes: #890508)
  * upgrade to debhelper compatibility level 7
  * upgrade to standards-version 4.1.3 (change package priority to optional)
  * do not run test suite if DEB_BUILD_OPTIONS contains nocheck

 -- Arthur de Jong <adejong@debian.org>  Mon, 19 Feb 2018 21:00:00 +0100

nss-pam-ldapd (0.9.8-1) unstable; urgency=medium

  * new upstream release:
    - add a pam_authc_search option that can be used to configure the search
      operation that is performed after authentication
    - add nss_uid_offset and nss_gid_offset options that can be used to
      change returned numeric user and group ids from LDAP (thanks Seth
      Wright)
    - do not retry failed user password on second LDAP server
    - the validnames option now also applies to shadow lookups
    - support ethernet addresses in LDAP in compact and long formats
    - improvements to getent.ldap command (a few minor bug fixes and
      preparations for Python 3 support)
    - log entries and lookups failing nss_min_uid at debug level
  * update links to use HTTPS
  * remove --no-create-home from adduser to hide a few warnings
    (closes: #858826)
  * remove pie from hardening blacklist because it is no longer needed for
    stretch (thanks Adrian Bunk) (closes: #859432)
  * update debian/copyright
  * upgrade to standards-version 4.0.0 (no changes needed)

 -- Arthur de Jong <adejong@debian.org>  Tue, 27 Jun 2017 22:00:00 +0200

nss-pam-ldapd (0.9.7-2) unstable; urgency=medium

  * recommend ca-certificate which is needed due to adding tls_cacertfile by
    default (see #750949) and the checking of tls_cacertfile in 0.9.7
    (closes: #836720)
  * fix parsing of nslcd.conf tls_cacert option in package configuration
    (closes: #851564)
  * add dependency on lsb-base for init script (thanks lintian)

 -- Arthur de Jong <adejong@debian.org>  Sun, 22 Jan 2017 16:00:00 +0100

nss-pam-ldapd (0.9.7-1) unstable; urgency=medium

  * new upstream release:
    - check existence of TLS certificate and key files on start-up
    - fix password policy expiration handling when password was about to
      expire (thanks Mathieu Baeumler for tracking this down)
      (closes: #794068)
    - fix updating of shadowLastChange attribute when chasing referrals
      (thanks Vasilis Tsiligiannis)
    - add an pam_authc_ppolicy option to allows completely disabling ppolicy
      handling (thanks Mathieu Baeumler)
    - fix handling of nss_disable_enumeration (thanks Andrew W Elble for
      pointing this out)
    - display human readable password expiry messages (thanks Mathieu
      Baeumler)
    - fix error when changing PAM user name (thanks 依云)
    - support substring expressions ${var:offset:length} in attribute mapping
      (thanks Giovanni Mascellani)
    - also honor the ignorecase option in PAM
  * drop fix-ppolicy-expiration-warnings.patch which is part of 0.9.7
  * put nsswitch.conf services in more natural order in debconf question
  * update debian/copyright

 -- Arthur de Jong <adejong@debian.org>  Sun, 14 Aug 2016 23:00:00 +0200

nss-pam-ldapd (0.9.6-4) unstable; urgency=medium

  * debconf translation updates:
    - Brazilian Portuguese by Adriano Rafael Gomes (closes: #799414)
  * have init script stop action only return when nslcd has actually stopped
    (closes: #814881)
  * update Vcs and homepage URLs to HTTPS (thanks lintian)
  * remove explicit ldconfig call from libnss-ldapd.postrm (thanks lintian)
  * upgrade to standards-version 3.9.8 (no changes needed)

 -- Arthur de Jong <adejong@debian.org>  Fri, 27 May 2016 11:30:00 +0200

nss-pam-ldapd (0.9.6-3) unstable; urgency=medium

  * fix-ppolicy-expiration-warnings.patch: fix password policy expiration
    warnings (closes: #794068)

 -- Arthur de Jong <adejong@debian.org>  Sun, 30 Aug 2015 14:00:00 +0200

nss-pam-ldapd (0.9.6-2) unstable; urgency=medium

  * ensure proper return code of init script (closes: #794686)

 -- Arthur de Jong <adejong@debian.org>  Thu, 13 Aug 2015 21:00:00 +0200

nss-pam-ldapd (0.9.6-1) unstable; urgency=medium

  * new upstream release:
    - fix a race condition in signal handling during start-up that would
      cause nslcd to exit if a signal (such as SIGUSR1 that can be sent when
      network status changes) is received (closes: #759544)
    - fix signed integer overflow on 32bit systems when using objectSid
      (thanks Geoffrey McRae)
    - allow longer configuration values (thanks Jed Liu)
    - add an nss_getgrent_skipmembers option to disable retrieving group
      members to improve performance in specific environments
    - add an nss_disable_enumeration option to disable full listing of all
      users and groups to improve performance in specific environments
      (thanks Andrew Elble)
  * drop avoid-signal-race.patch which is part of 0.9.6
  * drop XS-Testsuite from debian/control
  * use pathfind from Developer's Reference instead of full path to nslcd and
    pynslcd

 -- Arthur de Jong <adejong@debian.org>  Fri, 19 Jun 2015 11:30:00 +0200

nss-pam-ldapd (0.9.5-2) unstable; urgency=medium

  * avoid-signal-race.patch: avoid a signal mask race condition that could
    prevent nslcd from starting correctly during boot (closes: #759544)

 -- Arthur de Jong <adejong@debian.org>  Thu, 16 Apr 2015 22:00:00 +0200

nss-pam-ldapd (0.9.5-1) unstable; urgency=medium

  * new upstream release:
    - handle situation better when server (or firewall) closed the connection
      (thanks Tim Harder)
    - make daemonising a little more robust and try to log more failures
    - fix integer format strings (thanks Jianhai Luan and Patrick McLean)
    - documentation updates (thanks Dalibor Pospíšil)
    - fix range check for search access (thanks David Binderma)
    - fix a bug in the NSS library when encountering IPv6 addresses in
      the hosts map (thanks Mark R Bannister)
    - adjust the Linux OOM (Out-Of-Memory) killer score to avoid killing
      nslcd (thanks Patrick McLean)
  * drop use-ip-range-for-tests.patch which is part of 0.9.5
  * debian/copyright: copyright year updates
  * upgrade to standards-version 3.9.6 (no changes needed)

 -- Arthur de Jong <adejong@debian.org>  Fri, 10 Apr 2015 16:00:00 +0200

# For older changelog entries, run 'apt-get changelog pynslcd'
