Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
Resolves: rhbz#2098617 - Harden kerberos ticket validation
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol

Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
Resolves: rhbz#2087745 - 2FA prompting setting ineffective
Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language

Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization

Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)

Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization

Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release

Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing

Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization

Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade

Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)

Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf

Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive

Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)

Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11

Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
Resolves: rhbz#1915395 - Memory leak in the simple access provider
Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)

Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
Resolves: rhbz#1893159 - Default debug level should report all errors / failures
Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication