Identity Management and Authentication

The following identity management and authentication features and functionalities are deprecated in Oracle Linux 9.

PAM Console

pam_console module is deprecated. It grants file permissions and authentication to users logged in at the physical console or terminals, and adjusts these privileges based on console login status and user presence.

BDB backend (in 389-ds-base)

Berkeley Database (BDB) backend is deprecated in 389-ds-base package, the 389 Directory Server. As a replacement, Directory Server can now create instances with Lightning Memory-Mapped Database (LMDB) available as a Technology Preview.

sss_ssh_knownhostsproxy

sss_ssh_knownhostsproxy, a utility in the System Security Services Daemon (SSSD) package, is deprecated.

libsss_simpleifp

libsss_simpleifp that provides the libsss_simpleifp.so library is deprecated.

SSSD Files Provider

The SSSD files provider, which retrieves user information from local files such as /etc/shadow and group information from /etc/groups, is deprecated and disabled by default in Oracle Linux 9.

To retrieve user and group information from local files with SSSD:

  1. Configure SSSD. Choose one of the following options:

    1. Explicitly configure a local domain with the id_provider=files option in the sssd.conf configuration file.

      [domain/local]
      id_provider=files
      ...
    2. Enable the files provider by setting enable_files_domain=true in the sssd.conf configuration file.

      [sssd]
      enable_files_domain = true
  2. Configure the name services switch.

    sudo authselect enable-feature with-files-provider

OpenLDAP Utility Options

The OpenLDAP project has deprecated the -h and -p options in its utilities, and recommends using the -H option instead to specify the LDAP URI.

nsslapd-idlistscanlimit Parameter and Default Value

Because of optimizations to filter reordering, the nsslapd-idlistscanlimit parameter results in having a negative impact on search performance and is therefore deprecated. Further, the parameter's default value is changed to 2147483646

SMB1 Protocol

Beginning with Samba 4.11, the Server Message Block version 1 (SMB1) protocol is deprecated because of its insecure features. By default, this protocol is disabled in both Samba server and client utilities.