Resolves: rhbz#2040619 - Changing default pac type to 'nfs:NONE and MS-PAC' doesnot display error 'ipa: ERROR: no modifications to be performed'
Config plugin: return EmptyModlist when no change is applied
config plugin: add a test ensuring EmptyModlist is returned
Resolves: rhbz#2048510 - [rhel-9.0] Backport latest test fixes in python3-ipatests
ipatests: webui: Tests for subordinate ids.
ipatests: webui: Use safe-loader for loading YAML configuration file
ipatests: Fix test_ipa_cert_fix.py::TestCertFixReplica teardown
Test cases for ipa-replica-conncheck command
PEP8 Fixes
ipatests: Test empty cert request doesn't force certmonger to segfault
ipatests: Test default value of nsslapd-sizelimit.
Extend test to see if replica is not shown when running `ipa-replica-manage list -v <FQDN>`
Added test automation for SHA384withRSA CSR support
Resolves: rhbz#2049104 - User can't log in after ipa-user-mod --user-auth-type=hardened
ipa-kdb: do not remove keys for hardened auth-enabled users
ipatests: add case for hardened-only ticket policy
Resolves: rhbz#2049174 - KRA GetStatus service blocked by IPA proxy
ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus

Resolves: rhbz#2015608 - [Rebase] Rebase ipa to latest 4.9.x release RHEL9
Resolves: rhbz#1825010 - Concerns regarding 'ipa pwpolicy-mod --minlife 24 --maxlife 1'
Resolves: rhbz#1966289 - Info about searchrecordslimit set search limit to 10,000 after upgrade
Resolves: rhbz#1980356 - reinstalling samba client causes winbindd coredump
Resolves: rhbz#1986054 - fix automountlocation-tofiles output
Resolves: rhbz#2020205 - Missing bind-pkcs11-utils causing failures in OpenDNSSec
Resolves: rhbz#2021445 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
ipa-kdb: issue PAC_REQUESTER_SID only for TGTs
ipa-kdb: fix requester SID check according to MS-KILE and MS-SFU updates

Resolves: rhbz#2010701 ipa-server-install fails while 'configuring certificate server instance'
Parse getStatus as JSON not XML
Parse cert chain as JSON not XML
Specify PKI installation log paths
Make Dogtag return XML for ipa cert-find

Resolves: rhbz#2005864 ipa cert-request replaces user certificate instead of adding
Don't store entries with a usercertificate in the LDAP cache
ipatests: Test that a user can be issued multiple certificates

Resolves: rhbz#2003005 AVC denied { read } comm="ipa-custodia" on aarch64 during installation of ipa-server
selinux policy: allow custodia to access /proc/cpuinfo
Resolves: rhbz#2003004 extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
extdom: return LDAP_NO_SUCH_OBJECT if domains differ
Resolves: rhbz#2003003 subid: subid-match displays the DN of the owner, not its UID.
subid: subid-match: display the owner's ID not DN
Resolves: rhbz#2013116 ipa migrate-ds command fails to warn when compat plugin is enabled
migrate-ds: workaround to detect compat tree

Resolves: rhbz#1998098 - Backport latest test fixes in python3-ipatests
ipatests: Test unsecure nsupdate.
ipatests: Fix TestAJPSecretUpgrade tests on systems without pkiuser
ipatests: test_ipahealthcheck: Verify permissions for /var/log/ files
ipatests: test to renew certs on replica using ipa-cert-fix
ipatests: wait while http/ldap/pkinit cert get renew on replica
ipatests: refactor test_ipa_cert_fix with tasks
ipatests: use whole date for journalctl --since

Resolves: rhbz#1988383 Do SRV discovery in ipa-getkeytab if -s and -H aren't provided
ipa-getkeytab: add option to discover servers using DNS SRV
ipa-getkeytab: fix compiler warnings
ipatests: test ipa-getkeytab server option
Resolves: rhbz#1986329 ipa-server install failure without DNS
Fix ldapupdate.get_sub_dict() for missing named user
Resolves: rhbz#1980734 Remove python3-pexpect as dependency for ipatests pkg
freeipa.spec.in: remove python3-pexpect from Requires
Resolves: rhbz#1992538 Backport recent test fixes in python3-ipatests
ipatests: use whole date when calling journalctl --since
ipatests: Fix for test_source_ipahealthcheck_ipa_host_check_ipahostkeytab
ipatests: test_ipahealthcheck: print a message if a system is healthy
ipatests: test_installation: move tracking_reqs dependency to ipalib constants ipaserver: krainstance: utilize moved tracking_reqs dependency
webui tests: close notification when revoking cert
ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg
webui tests: fix algo for finding available idrange
ipatests: smbclient "-k" => "--use-kerberos=desired"
test_acme: refactor with tasks
test_acme: make password renewal more robust
tasks.py: fix flake8-reported issues
ipatests: Test for OTP when the LDAP connection timed out.
ipatests: verify that getcert output includes the issued date
ipatests: Look for warning into stderr instead of stdout
ipatests: use krb5_trace in TestIpaAdTrustInstall
ipatests: Test ldapsearch with base scope works with compat tree.
ipatests: skip test_basesearch_compat_tree on fedora.
ipatests: Refactor test_check_otpd_after_idle_timeout

Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

Use new method in check to prevent removal of last KRA (#1985072)
ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL (#1982952)
Fix index definition for memberOf (#1952028)

Resolves: rhbz#1979629 Add checks to prevent assigning authentication indicators to internal IPA services
Resolves: rhbz#1982212 ipa-trust-add fails with "not enough quota"
Resolves: rhbz#1952028 [RFE] Add support for managing subuids and subgids in FreeIPA
Resolves: rhbz#1981789 [man page] contradiction in ipa-server-upgrade command's man page and usage

Resolves: rhbz#1955440 ipa installation fails to configure chrony
Resolves: rhbz#1976761 Package python3-ipatests (from CRB repo) Requires python3-coverage
Resolves: rhbz#1979609 Unable to set ipaUserAuthType with stageuser-add
Resolves: rhbz#1979629 Add checks to prevent assigning authentication indicators to internal IPA services

Resolves: rhbz#1969351 Rebase IPA to latest 4.9.x version
Resolves: rhbz#1976288 ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache
Resolves: rhbz#1975139 Upgrade error: Add failure missing required attribute "objectclass"
Resolves: rhbz#1973024 CA_less ipa-server-install fails if CA cert subject contains non ascii chars
Resolves: rhbz#1966101 [RFE] - IDM - Allow specifying permanent logging settings for BIND
Resolves: rhbz#1962570 IPA in c9s should not require redhat-logos-ipa as a runtime package
Resolves: rhbz#1957736 [RFE] IPA to allow configuring auto-private-groups at idrange level

Rebuilt for RHEL 9 BETA for openssl 3.0

RHEL 9 Beta mass rebuild. Resolves: rhbz#1951304

Upstream release FreeIPA 4.9.3

Rebuild against 389-ds and PKI to fix https://github.com/389ds/389-ds-base/issues/4609