Rebase ipa to 4.9.13
16936

ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
12198

Require krb5 release 1.18.2-25 or later

ipatests: fix test_topology
Installer: activate nss and pam services in sssd.conf

ipa-kdb: fix error handling of is_master_host()
ipatests: enable firewall rule for http service on acme client
User plugin: improve error related to non existing idp
Prevent admin user from being deleted
Fix memory leak in the OTP last token plugin

Upgrade: fix replica agreement, fix backported patch

kdb: Use-krb5_pac_full_sign_compat() when available
OTP: fix-data-type-to-avoid-endianness-issue
Upgrade: fix replica agreement
Upgrade: add PKI drop-in file if missing
Use the python-cryptography parser directly in cert-find
Backport test updates

Rely on sssd-krb5 to include SSSD-generated krb5 configuration

Use the OpenSSL certificate parser in cert-find

Rebase ipa to 4.9.12
user or group name: explain the supported format

Revert DNSResolver Fix use of nameservers with ports.

webui IdP: Remove arrow notation due to uglify-js limitation

Rebase ipa to 4.9.11
updates: fix memberManager ACI to allow managers from a specified group
Defer creating the final krb5.conf on clients
Exclude installed policy module file from RPM verification
Spec file: ipa-client depends on krb5-pkinit-openssl

ipa man page format the EXAMPLES section
Fix canonicalization issue in Web UI
Remove idnssoaserial argument from dns zone API.
Warn for permissions with read/write/search/compare and no attrs
Add PKINIT support to ipa-client-install
Generate CNAMEs for TXT+URI location krb records
Vault: fix interoperability issues with older RHEL systems
Fix typo on ipaupgrade.log chmod during RPM %post snipppet

Rebuild to samba 4.17.2.

webui: Allow grace login limit
check_repl_update: in progress is a boolean
Disabling gracelimit does not prevent LDAP binds
Set passwordgracelimit to match global policy on group pw policies