Resolves: rhbz#2057471 Consequences of FIPS crypto policy tightening in RHEL 9
KRB instance: make provision to work with crypto policy without SHA-1 HMAC types
tests: ensure AD-SUPPORT subpolicy is active
ipatests: extend AES keyset to SHA2-based ones
freeipa.spec: bump crypto-policies dependency for CentOS 9 Stream
Kerberos instance: default to AES256-SHA2 for master key encryption
test_otp: do not use paramiko unless it is really needed
test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Support AES for KRA archival wrapping
Set AES as default for KRA archival wrapping

Resolves: rhbz#2057467 Backport latest test fixes in python3-ipatests
ipatests: Tests for Autoprivate group.
mark xfail for test_idoverride_with_auto_private_group[hybrid]
Mark xfail test_gidnumber_not_corresponding_existing_group[true,hybrid]

Resolves: rhbz#2053025
add IPA test suite fixes

Resolves: rhbz#2053586 IPA LDAP plugin ipa-cldap memory leak
fix memory leak in CLDAP responder

Resolves: rhbz#2050540 Unable to join RHEL 8.5 Replica to RHEL 7.9 Master for migration purposes
Don't always override the port in import_included_profiles
Resolves: rhbz#2051582 Enable ipa-ccache-sweep.timer during server installation
Test ipa-ccache-sweep.timer enabled by default during installation
Enable the ccache sweep timer during installation
Resolves: rhbz#2051844 ipa-join tests are failing due to changes in expected output
Remove ipa-join errors from behind the debug option

Resolves: rhbz#2040619 - Changing default pac type to 'nfs:NONE and MS-PAC' doesnot display error 'ipa: ERROR: no modifications to be performed'
Config plugin: return EmptyModlist when no change is applied
config plugin: add a test ensuring EmptyModlist is returned
Resolves: rhbz#2048510 - [rhel-9.0] Backport latest test fixes in python3-ipatests
ipatests: webui: Tests for subordinate ids.
ipatests: webui: Use safe-loader for loading YAML configuration file
ipatests: Fix test_ipa_cert_fix.py::TestCertFixReplica teardown
Test cases for ipa-replica-conncheck command
PEP8 Fixes
ipatests: Test empty cert request doesn't force certmonger to segfault
ipatests: Test default value of nsslapd-sizelimit.
Extend test to see if replica is not shown when running `ipa-replica-manage list -v <FQDN>`
Added test automation for SHA384withRSA CSR support
Resolves: rhbz#2049104 - User can't log in after ipa-user-mod --user-auth-type=hardened
ipa-kdb: do not remove keys for hardened auth-enabled users
ipatests: add case for hardened-only ticket policy
Resolves: rhbz#2049174 - KRA GetStatus service blocked by IPA proxy
ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus

Resolves: rhbz#2015608 - [Rebase] Rebase ipa to latest 4.9.x release RHEL9
Resolves: rhbz#1825010 - Concerns regarding 'ipa pwpolicy-mod --minlife 24 --maxlife 1'
Resolves: rhbz#1966289 - Info about searchrecordslimit set search limit to 10,000 after upgrade
Resolves: rhbz#1980356 - reinstalling samba client causes winbindd coredump
Resolves: rhbz#1986054 - fix automountlocation-tofiles output
Resolves: rhbz#2020205 - Missing bind-pkcs11-utils causing failures in OpenDNSSec
Resolves: rhbz#2021445 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
ipa-kdb: issue PAC_REQUESTER_SID only for TGTs
ipa-kdb: fix requester SID check according to MS-KILE and MS-SFU updates

Resolves: rhbz#2010701 ipa-server-install fails while 'configuring certificate server instance'
Parse getStatus as JSON not XML
Parse cert chain as JSON not XML
Specify PKI installation log paths
Make Dogtag return XML for ipa cert-find

Resolves: rhbz#2005864 ipa cert-request replaces user certificate instead of adding
Don't store entries with a usercertificate in the LDAP cache
ipatests: Test that a user can be issued multiple certificates

Resolves: rhbz#2003005 AVC denied { read } comm="ipa-custodia" on aarch64 during installation of ipa-server
selinux policy: allow custodia to access /proc/cpuinfo
Resolves: rhbz#2003004 extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
extdom: return LDAP_NO_SUCH_OBJECT if domains differ
Resolves: rhbz#2003003 subid: subid-match displays the DN of the owner, not its UID.
subid: subid-match: display the owner's ID not DN
Resolves: rhbz#2013116 ipa migrate-ds command fails to warn when compat plugin is enabled
migrate-ds: workaround to detect compat tree

Resolves: rhbz#1998098 - Backport latest test fixes in python3-ipatests
ipatests: Test unsecure nsupdate.
ipatests: Fix TestAJPSecretUpgrade tests on systems without pkiuser
ipatests: test_ipahealthcheck: Verify permissions for /var/log/ files
ipatests: test to renew certs on replica using ipa-cert-fix
ipatests: wait while http/ldap/pkinit cert get renew on replica
ipatests: refactor test_ipa_cert_fix with tasks
ipatests: use whole date for journalctl --since

Resolves: rhbz#1988383 Do SRV discovery in ipa-getkeytab if -s and -H aren't provided
ipa-getkeytab: add option to discover servers using DNS SRV
ipa-getkeytab: fix compiler warnings
ipatests: test ipa-getkeytab server option
Resolves: rhbz#1986329 ipa-server install failure without DNS
Fix ldapupdate.get_sub_dict() for missing named user
Resolves: rhbz#1980734 Remove python3-pexpect as dependency for ipatests pkg
freeipa.spec.in: remove python3-pexpect from Requires
Resolves: rhbz#1992538 Backport recent test fixes in python3-ipatests
ipatests: use whole date when calling journalctl --since
ipatests: Fix for test_source_ipahealthcheck_ipa_host_check_ipahostkeytab
ipatests: test_ipahealthcheck: print a message if a system is healthy
ipatests: test_installation: move tracking_reqs dependency to ipalib constants ipaserver: krainstance: utilize moved tracking_reqs dependency
webui tests: close notification when revoking cert
ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg
webui tests: fix algo for finding available idrange
ipatests: smbclient "-k" => "--use-kerberos=desired"
test_acme: refactor with tasks
test_acme: make password renewal more robust
tasks.py: fix flake8-reported issues
ipatests: Test for OTP when the LDAP connection timed out.
ipatests: verify that getcert output includes the issued date
ipatests: Look for warning into stderr instead of stdout
ipatests: use krb5_trace in TestIpaAdTrustInstall
ipatests: Test ldapsearch with base scope works with compat tree.
ipatests: skip test_basesearch_compat_tree on fedora.
ipatests: Refactor test_check_otpd_after_idle_timeout

Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

Use new method in check to prevent removal of last KRA (#1985072)
ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL (#1982952)
Fix index definition for memberOf (#1952028)

Resolves: rhbz#1979629 Add checks to prevent assigning authentication indicators to internal IPA services
Resolves: rhbz#1982212 ipa-trust-add fails with "not enough quota"
Resolves: rhbz#1952028 [RFE] Add support for managing subuids and subgids in FreeIPA
Resolves: rhbz#1981789 [man page] contradiction in ipa-server-upgrade command's man page and usage

Resolves: rhbz#1955440 ipa installation fails to configure chrony
Resolves: rhbz#1976761 Package python3-ipatests (from CRB repo) Requires python3-coverage
Resolves: rhbz#1979609 Unable to set ipaUserAuthType with stageuser-add
Resolves: rhbz#1979629 Add checks to prevent assigning authentication indicators to internal IPA services