Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release

Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9

Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #

Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"

Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)

Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed

Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release

Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8

Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend

Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
Resolves: rhbz#2098617 - Harden kerberos ticket validation
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
Resolves: rhbz#2087745 - 2FA prompting setting ineffective
Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language

Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization

Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)

Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization