This release adds support for PHP 5.3. If an LDAP error occured and with a sufficiently high log level, Plexcel could crash trying to retrieve the text of the LDAP error. This bug has been fixed. The Plexcel Operator's Manual has been updated significantly.

This release includes the following fixes and adjustments:

• The phpinfo output now includes much more information.
• The Plexcel Operator's Manual has been completely reviewed and updated to reflect the most current information about Plexcel.
• Plexcel could query AD for an invalid attribute. This behavior has been corrected (although it is believed to have been harmless).
• An additional warning will be generated if the Plexcel extension was loaded but failed to initialize completely.
• An extraneous log statement has been removed.

Querying large LDAP entries could result in a "sasl_gss_sbi_read: EINVAL: SASL buffer larger than negotiated maxbuf" error. This issue has been fixed.

A memory corruption bug in DNS response handling code has been fixed. In theory, this bug could cause Plexcel to crash (although that was never observed or reported).

Large DNS responses (30+ records) could cause an ENOMEM error. The memory block used to process these responses has been greatly increased.

The asynchronous "AD ping" lookup feature has been disabled as it has been found to cause long delays in event processing in some environments. Any existing 2.7.17 installations should add plexcel.cldap.ping_async_limit = 0 to their Plexcel INI or upgrade.

If DNS indicates that multiple domain controllers are available for the target domain, Plexcel will use the first domain controller to respond to an "AD ping".

If an entry in the directory was renamed or moved, Plexcel could incorrectly query the old DN resulting an an "Object not found" error until Apache was restarted. Plexcel will now transparently remove the cached data and retrying the operation.

An ASN.1 decoding error that affected CLDAP responses has been fixed.

Several Kerberos error text messages like "Server (name) unknown" have been changed to "The service account (name) was not found".

The FreeBSD build could incorrectly process timeouts. This issue has been fixed.

A plexcel_rename_object function has beed added to allow for renaming / moving objects in the directory. The Plexcel Developer's Guide and online API reference have been updated.

While trying to change a password with the plexcel_change_password function, the following error could occur:

src/change_password.c:253:psec_change_password: KRB5: Matching credential not found
  src/plexcel.c:1909:plexcel_change_password:

Plexcel now supports Unicode passwords.

The code responsible for reconnecting the DNS client was not robust when DNS slowness or general network failure occurred. This errant code has been fixed.

The DNS cache TTL, UDP response timeout and retry count values are now configurable using INI properties. The DNS cache TTL has been increased from 5 seconds to 24 seconds.

The SIGSEGV handler could get caught in an endless loop. This bug has been fixed. The handler should now properly dump backtrace information in the log file in the event that a segmentation fault should occur.

If the HTTP service account was not flagged as 'Trusted for delegation' the following error could occur:

src/gss.c:201:psec_get_gss_cred: GSS_S_FAILURE: Response too big for UDP, retry with TCP: alice@EXAMPLE.COM
  src/gss.c:320:psec_gss_initiator_create: 
  src/ldapx.c:401:ldapx_bind_gssapi: 
  src/ldapx.c:932:ldapx_bind:

The Creating the HTTP Service Account in Windows without Plexcel Setup section in the Plexcel Operator's Manual has also been updated regarding setting the 'Trust this user for delegation' option under the Delegation tab in ADUC and regarding deploying browser settings as GPOs.

This release fixes a bug in an ASN.1 decoding routine that could trigger the following error:

psec_gss_init_sec_context: Invalid GSS status: 0x6eda3605 0x00000000: username@EXAMP...
  src/ldapx.c:412:ldapx_bind_gssapi:
  src/ldapx.c:932:ldapx_bind:

The previous release (2.7.11) was accidentally compiled with symbol versioning turned off. This can cause sporadic symbol collisions with other instances of Kerberos and LDAP libraries. Plexcel has been recompiled and repackaged with the correct options. Please update your systems if you have installed the errant 2.7.11 package.

This release adds Kerberos 5 optimistic preauthentication support which significantly reduces network communication when performing explicit logons (e.g. using the login form of MediaWiki or Joomla!). This change suppresses the annoying "preauthentication required" eventlog messages in Active Directory (assuming the DC is configured to report these events).

This release also introduces a reworked condition variable implementation that is simpler and uses fewer semaphores (each Plexcel instance now uses 4 semaphores instead of 9).

This release includes several new and important features (and minor a bug fix):

• The AD "site" of the web server can now be specified using the new plexcel.dns.site INI property. For example, if you have domain controllers in Paris and and Quebec and you do not set plexcel.dns.site, Plexcel may choose to communicate with a domain controller in either country. For performance reasons this may not be desirable. However, if you use Active Directory Sites and Services to indicate which servers are in sites Paris and Quebec, you can set plexcel.dns.site = Paris and Plexcel will only communicate with domain controllers in that site.
• Multiple DNS servers may be specified with the plexcel.dns.servers INI property. For example, plexcel.dns.servers=192.168.2.110,192.168.2.111,192.168.3.99 would indicate to Plexcel that if one server should fail to respond or refuse a connection, the list of DNS servers will be rotated and the next server will be queried.
• A DNS cache is now enabled. All records expire after 5 seconds. This greatly reduces the number of DNS queries performed by Plexcel because DNS queries in this context are highly redundant. Negative DNS responses are not cached.
• The phosts file now supports multiple entries for each name. If multiple records are supplied for a particular name, the list will be rotated each time it is queried to emulate the load balancing effect provided by DNS servers.
• Both the phosts and resolv.conf files will be automatically reloaded 5 seconds after being updated. It is now not necessary to restart Apache after modifying these files (e.g. after modifying resolv.conf, the DNS client will be disconnected so that it will reconsider any changes in DNS servers).
• Previously, if PHP exited abnormally (e.g. Ctrl-C during ./install), the next attempt to start it could result in a peer_listen: EADDRINUSE: bind: /var/lib/plexcel/plexcel.supersock error. This issue has been fixed.

If Plexcel fails to parse the /etc/resolv.conf file for any reason, it will now gracefully fail and allow the plexcel.dns.servers property to be used instead.

Running multiple Plexcel instances simultaneously (e.g. running the PHP CLI as root from cron) would leak shared memory and eventually cause an out-of-memory error:

src/suba.c:330:suba_alloc: ENOMEM
   src/suba.c:331:suba_alloc: rethrowing...

The memory issue was caused by a number of unrelated initialization races. We are confident that all of these conditions have been fixed and that it is safe to run any number of PHP CLI instances simultaneously. However we have added a new INI parameter that can disable Plexcel in the CLI. The default value is to not disable Plexcel in the CLI but the plexcel.ini file installed during a new installations will contain the setting to disable it:

plexcel.sapi.cli = Off

To improve portability, security and standards compliance, the log date format has been changed slightly and date strings are no longer printed from signal handlers.

To better support sites with more than ~2500 users, the size of the memory region shared by multiple Plexcel instances has been increased from 2MB to 8MB. Plexcel will now print detailed memory allocation information in the log file on shutdown with a sufficiently high log level.

The Plexcel x86_64 binaries now support glibc 2.3 systems such as RHEL 4 (the i386 binaries always supported glibc 2.3).

Plexcel will now fall-back to querying the directory for authorization data if no PAC is present in the Kerberos service ticket. Without this update the following error will occur if no PAC is found:

src/pac.c:154:psec_gss_get_NetrSamInfo2: GSS_S_FAILURE: No such file or directory
  src/pac.c:396:psec_gss_build_psec:
  src/gss.c:512:psec_gss_accept_sec_context:
  src/plexcel.c:1102:plexcel_accept_token:

The acctmgr example has been updated with a checkbox for the NO_AUTH_DATA_REQUIRED userAccountControl flag which controls whether or not a PAC is included in Kerberos tickets for that service account.

The Plexcel Operator's Manual has been updated regarding Firefox configuration, the PLEXCEL_LDAP_UNWILLING_TO_PERFORM and Clock skew too great errors and a few other details. The Plexcel Developer's Guide has also been updated regarding PLEXCEL_SUPPLEMENTAL behavior, plexcel_get_domain and plexcel_sso.

The x86_64 Linux binaries are now compiled on an older version of Linux for improved compatibility. Versions of Linux on x86_64 that do not use the newer .gnu.hash symbol tables in binaries could not load the Plexcel extension or the Plexcel library and would result in a SIGFPE that would prevent Apache from starting. No errors were logged.

If the following command does not print .gnu.hash your system is affected by this issue:

# objdump -h /usr/sbin/httpd | grep hash
  2 .hash         000022b4  00000168  00000168  00000168  2**2

All libraries have be recompiled and relinked. There have been no code changes.

Options have been added to enable LDAP signing and encryption. If your Domain Controller Security Policy > Local Policies > Security Options > Domain controller: LDAP server signing requirements is set to Require signing, then you must set plexcel.ldap.signing = On in your PHP INI. To enable encryption, you may also set plexcel.ldap.encryption = On. These security options may also be specified on a per-context basis using plexcel_new options. See the Plexcel Operator's Manual and Plexcel Developer's Guide for details.

LDAP error message handling has been improved.

With short_open_tag = Off Plexcel Setup would would fail as it incorrectly included the contents of the file common.php. The open tag of this file has been fixed so that the file is correctly interpreted.

The maximum SASL buffer size was not correctly negotiated which could (in theory) result in the server sending more data than the client expected. This issue has been fixed.

Plexcel scripts will now die if the wrong version of plexcel.php is used.

This release fixes a "too many entries" error that could occur trying to retrieve information about accounts. The LDAP filter used by plexcel_get_account has been slightly modified to more precisely target the desired account.

If a service account was deleted in AD but the corresponding now-invalid plexcel.keytab file was not, Plexcel could segfault. This issue has been fixed.

The following issues have been fixed:

• The following error could suddenly start to occur after Apache has been running for 10 hours:

  Jan 28 14:12:38 src/gss.c:653:psec_gss_init_sec_context: GSS_S_FAILURE: Ticket expired 
    src/ldapx.c:333:ldapx_bind_gssapi: 
    src/ldapx.c:784:ldapx_bind: 
  

  This error was caused by a cached service credential ticket expiring. Service credential tickets are now re-acquired as necessary. This error would only occur when trying to use the service credential (the credential used when the Plexcel context has not been authenticated).
• The install script could fail half-way through with an error .: 9: .tailscript: not found. This issue has been fixed.
• Running a PHP CLI script as root while Apache is running with the Plexcel extension loaded could cause a semaphore array to be leaked.
• The FreeBSD build could not cleanup leaked semaphores from a previous execution if the /proc directory was not mounted.
• A memory leak in the Kerberos library used by Plexcel has been fixed.
• A note has been added to the DelegCurl.php link on the examples page regarding the configuration of system Kerberos libraries.
• Some debugging messages could be printed to stderr if the Plexcel extension could not be fully initialized.
• A memory leak could occur if the Plexcel extension could not be fully initialized.

This release includes the following bugfixes and enhancements:

• Numerous memory leaks have been fixed. Note that one of these leaks was significant - we recommend that everyone upgrade at the next opportunity.
• The DNS client was not robust with regard to UDP failure. Retried requests would frequently fail and cause the overall operation to return an error. This issue has been fixed. With respect to DNS, temporary network instability should now be handled gracefully and transparently to the caller.
• The FreeBSD build now includes an alternative to the missing semtimedop(2) function which should make it more forgiving to coding errors (although no such errors were believed to exist).
• Some improper function usage has been identified using a dynamic analysis tool and fixed (although these were not believed to be the source of any bugs).

This release includes the following bugfixes and enhancements:

• When an Apache worker exits, Plexcel could be deinitialized. Subsequent attempts to call Plexcel functions result in a fault. This issue has been fixed. Plexcel will now only be deinitialized by the same process that initialized it.
• Running a PHP CLI script as root while Apache is running with the Plexcel extension loaded could cause Plexcel to deinitialize in Apache. This issue has been fixed. CLI and server scripts can run independently without conflict.
• Running a PHP CLI script as root would delete files in the Plexcel temporary directory which could logoff users. This behavior has been changed so that temporary files will not be deleted unless they are at least 10 hours old. This also means that you can restart the server without causing people to be logged off.
• An ENOBUFS error during initialization could occur on 64 bit systems. This issue has been fixed.
• The plexcel_status function could return garbage data after setting the status value explicitly. This issue has been fixed.
• An invalid ssn_id parameter passed to plexcel_logon or plexcel_logoff could result in files being overwritten. The ssn_id parameter is now properly validated.
• Plexcel Setup will now issue a warning if magic_quotes_gpc is found to be on.

A plexcel_change_password function has been added which will allow users who are not Administrators or Account Operators to change their own password.

Plexcel Setup could incorrectly handle hyphens in hostnames and generate an invalid default DN when creating an HTTP service account. These issues have been fixed. Plexcel Setup will now print a warning if the web server is found to be running in the C locale.

Excessive log messages for harmless DNS lookup failures have been eliminated.

The plexcel_is_member_of function could return an error when called with a group that the user is not in. This issue has been fixed. The 2.6.3 release should not be used with the MediaWiki plugin.

The plexcel_is_member_of function did not handle Domain Local groups properly. This bug has been fixed. The plexcel_status function could return different values depending on how the plexcel.log.level value was set. This has been corrected so that plexcel_status always returns the status regardless of what is logged. A warning has been added to the examples page about using them as legitimate stand-alone applications. A new 'ismemberof' example has been added for exercising the plexcel_is_member_of function.

The Plexcel Setup program has been slightly modified to allow changing domain controllers so that the service account for a website in a child domain could be created in a parent domain. The domain selection screen is also now the default initial screen.

Trying to set the HTTP service account in Windows 2000 Server could cause Plexcel to fault. This issue was introduced in the previous release and has been fixed. The Plexcel Operator's Manual has also been updated with special instructions for using Plexcel with Windows 2000 Server.

This release includes several significant bug fixes.

• The plexcel.dns.servers INI property did not work as described in the Plexcel Operator's Manual. Plexcel could query the system DNS server regardless of how the plexcel.dns.servers property was set. All code libraries have been modified as necessary to ensure that all DNS queries are performed by the the Plexcel DNS resolver. If the plexcel.dns.servers INI property is specified, that nameserver should be used exclusively for all DNS queries.
• The FreeBSD build could not gracefully handle message timeouts (e.g. DNS failure) because FreeBSD does not have a semtimedop(2) function. This issue has been fixed.
• The RootDSE Netlogon LDAP request (aka AD "ping") used by the plexcel_get_domain function did not work with Windows 2000 Server because it does not support querying that attribute over TCP. This code has been modified to use LDAP over UDP (aka "CLDAP").

Plexcel could fail to resolve domain names using a special LDAP request if the server is Windows 2000. This release should fix this problem.

An incorrect error message could be displayed when removing an SPN in Plexcel Setup. This has been fixed. A minor change to the directory location query has been made. A debug statement that would print 'PHP_MSHUTDOWN_FUNCTION' on the console when running CLI with the Plexcel extension enabled has been removed.

The Plexcel Setup changes that added the "Set password in Active Directory" checkbox (used when creating the HTTP service account on the Windows side rather than through Plexcel Setup) were accidentally lost in a previous release. This release restores that functionality.

Some additional minor changes have been made to Plexcel Setup such as warning the operator if they attempt to run Plexcel Setup using a non-FQDN hostname in the URL.

If the plexcel_get_domain function is called with a NetBIOS domain name (as it is by a number of plugins and modules) before the corresponding DNS name has been resolved (e.g. via an SSO authentication with someone in that domain), the NetBIOS domain name will not be in cache and the query will fail. To remedy this issue, the domain information cache may be pre-loaded with a list of domains. A new plexcel.precache.domains PHP INI parameter may be used to specify a list of DNS domains that should be pre-cached when the server starts.

The Plexcel SugarCRM Module has been re-written and released as 2.0.

If non-ASCII characters were processed and the web server was not correctly set to run in the UTF-8 locale, plexcel could crash an Apache worker process. This issue has been fixed.

Plexcel Setup did not properly handle accounts that had CNs with a comma in them (e.g. CN=Jones\, Thomas,CN=Users...) because the backslash used to escape it was being lost during form submission. This issue has been fixed. Plexcel Setup should now properly create or manage existing accounts with any CN.

This release addresses the following issues:

• Plexcel Setup could cause the GSS_S_BAD_MECH error if SSO is enabled in the browser but the HTTP service account has not yet been created (a likely scenario). SSO has been disabled in Plexcel Setup to ensure that it does not interfere with the operator logging in.
• Plexcel Setup will now report an error if Apache 1.x is detected (Plexcel requires Apache 2.0 or later)
• The following error could occur calling plexcel_logon_with_password in a multi-DC environment:

  src/creds.c:411:psec_logon_with_password: KRB5: Client (http_sso_www1@EXAMPLE.COM) unknown
    src/set_password.c:300:psec_gen_service_keytab:
    src/plexcel.c:1688:plexcel_gen_service_keytab:
  

  This bug has been fixed by setting the target DC of the login to the authority established in the supplied Plexcel context.
• A plexcel_get_domain function has been added. This function is used by the MediaWiki plugin for account name canonicalization. The MediaWiki plugin has been updated to use this function.
• The Plexcel Operator's Manual has been updated. An Issue 10: Size of a request header field exceeds server limit section has been added and the Requirements section now mentions iptables and Basic and Digest authentication scheme restrictions.

The plexcel_login function was accidentally changed in a recent release to log sensitive information. This change has been fixed so that the sensitive information will no longer be written to the log file.

This release includes binaries for several new architectures. Plexcel now supports x86_64 and i386 on Linux and FreeBSD.

In addition to the portability changes for the new architectures, this release also contains a fix for a problem related to setting passwords. If the plexcel_set_password routine was called immediately after creating an account, a domain controller other than the one on which the account was created could be used to set the account password. This could result in a failure if the account has not yet replicated between domain controllers. The plexcel_set_password function has been modified to use the domain controller associated with the Plexcel context created with plexcel_new. Therefore, provided the same Plexcel context is used in scripts to both create the account and set it's password, the said failure cannot occur.

This release fixes a bug where the following error could occur while trying to set an account password:

src/set_password.c:25:psec_set_password: EINVAL: princname required
  src/plexcel.c:1625:plexcel_set_password:

This release will allow the HTTP service account to be created entirely on the Windows side using existing account management procedures. See the updated Plexcel Operator's Manual for details.

Setting a non-random password in Plexcel Setup did not work. The user would be pushed out to the login screen. This bug has been fixed.

When trying to set passwords, the following error could occur. This was caused by a name canonicalization issue and has been fixed.

src/set_password.c:89:psec_set_password: KRB5: Matching credential (krbtgt/example.com@EXAMPLE.COM) not found
  src/plexcel.c:1625:plexcel_set_password:

If a user's userPrincipalName had a space in it, Plexcel would fail to find it when authenticating the user resulting in a error like the following with a backslash before the space:

src/account.c:644:psec_account_get: ENOENT: Some\ User@EXAMPLE.COM
  src/plexcel.c:1367:plexcel_get_account: 

Also, the Plexcel MediaWiki Plugin package and documentation has been updated regarding the special PlexcelAccessDenied page not being editable.

This release fixes a minor logging issue when calling plexcel_is_member_of on the default Plexcel context.

This release fixes a bug in how security contexts are set on Plexcel bindings.

Specifically, calling plexcel_logon and/or plexcel_set_password multiple times within the same script could result in the following error:

src/psec.c:79:psec_current_push: ENOBUFS
  src/gss.c:92:psec_get_gss_cred: name=alice@EXAMPLE.COM

This release changes how Plexcel retrieves information about domains. Plexcel will no longer attempt to contact the Global Catalog to retrieve information about domains.

Some initialization code has been adjusted to more clearly report errors.

A clause has been added to the Plexcel Setup script that eliminates an unnecessary code path that would always record an error in the logfile.

Several issues that affect larger environments have been fixed. These include the following:

• Environments with many AD servers could result in repeated 'Failed to find DC in' messages running Plexcel Setup. This occurred because truncated DNS responses would not satisfy higher level logic trying to resolve a specific hostname. Plexcel will now retry DNS requests in TCP mode as necessary which fixes this issue.
• Logical errors in the Plexcel Setup and associated scripts and examples have been fixed. If you have previously installed Plexcel, be sure to re-copy these scripts when upgrading.
• The DNS section in the Plexcel Operator's Manual has been updated to include instructions regarding finding a suitable DNS server for Plexcel.
• If Plexcel cannot determine the FQDN of the web server, a psec_context_create: KRB5: No such file or directory error would result. This error message has been changed to be more informative. The DNS section in the documentation has also been updated.

This release fixes a number bugs related to Plexcel operation in forest environments. The Plexcel Setup program previously could not authenticate the operator in one domain and then allow them to create the HTTP service account in a different domain. Several adjustments have been made to the Plexcel Setup script and to the core libraries to fix these problems.

A new plexcel_get_authority function has been added to the Plexcel API. This function allows the caller to retrieve the hostname used as the authority server for the authenticated user or the directory server indicated by the binding string. See the API documentation for details.

The following issues have been addressed in this release:

• If Plexcel Setup could not locate a domain controller, the 'Plexcel failed to find a DC for ...' message would be displayed without providing the operator with further options or instructions. This behavior has been adjusted by adding a form field into which a DNS domain or domain controller hostname may be supplied by the operator in the event that a suitable domain controller could not be located.

  Note: The 'Plexcel failed to find a DC for ...' error indicates that the hostname suffix does not match the Windows domain name or that DNS is not configured properly for resolving Windows specific names. In either case, even though the operator may be able to create a service account, it is not clear that Plexcel will work properly (AD will not issue a Kerberos ticket given an IP address).

• All Plexcel Setup error messages and warnings should now be displayed in the correct color (e.g. the 'Plexcel failed to find a DC for ...' text had no color or emphasis at all).
• If the operator or user attempts to access setup.php by IP address, a warning is printed referring to the DNS section in the Plexcel Operator's Manual.

The build environment and tool-chain has changed significantly but otherwise there have been no changes to the source code. This release may be used to determine if changes in the build environment are responsible for a problem. There should be no change in behavior between 2.0.7 and 2.0.8. If you do notice a change, please report it to support@ioplex.com.

Load balancing between multiple AD servers could confuse the Plexcel DNS logic resulting in an error like the following:

dns_authority.c:193:dns_find_authority_by_domain: ENOENT: ad05.example.com
  src/ldapx.c:606:_ldapx_init: ad05.example.com
  src/ldapx.c:667:ldapx_bind: 

Systems without the special account nobody would fail to initialize with the following error:

src/pio.c:153:pio_open: EINVAL: failed to determine low privileged uid/gid
  src/pnet.c:147:pnet_open:
  src/plexcel.c:381:plexcel_ctx_new:

Logic has been added so that systems that do not return an FQDN from gethostname (frequently default Debian Linux installs do this) will no longer require a [libdefaults] default_realm directive in the Plexcel krb5.conf.

All instances of htmlentities in the examples have been replaced to allow a charset to be specified (currently UTF-8) so that i18n text will be displayed properly in form fields. Previously the acctmgr example did not display i18n text properly in HTML form fields.

Some users have reported that the Plexcel Setup script would generate an LDAP_UNWILLING_TO_PERFORM error when creating the HTTP service account. This was caused by password policy. The setup.php script has been changed to set the PLEXCEL_PASSWD_NOTREQD flag of the userAccountControl attribute.

Similarly an LDAP_UNWILLING_TO_PERFORM error could occur trying to set a random password. This was also due to password policy. The random password format has been modified to add the required complexity.

The format of dates in the accrmgr.php example has been changed to use 24 hour time (the 12 hour AM / PM time format is not used universally).

If a gdb backtrace is triggered but gdb is not present, a more informative message will be printed in the log ('The gdb package must be installed for automatic backtracing.').

Both the Plexcel Operator's Manual and Plexcel Developer's Guide have been updated significantly.