Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)

Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed

Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release

Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8

Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend

Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
Resolves: rhbz#2098617 - Harden kerberos ticket validation
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
Resolves: rhbz#2087745 - 2FA prompting setting ineffective
Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language

Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization

Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)

Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization

Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release

Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing

Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization

Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade