Resolves: rhbz#2141315 [Rebase] Rebase ipa to latest 4.10.x release for RHEL 9.2
Resolves: rhbz#2094673 ipa-client-install should just use system wide CA store and do not specify TLS_CACERT in ldap.conf
Resolves: rhbz#2117167 After leapp upgrade on ipa-client ipa-server package installation failed. (`REQ_FULL_WITH_MEMBERS` returns object from wrong domain)
Resolves: rhbz#2127833 Password Policy Grace login limit allows invalid maximum value
Resolves: rhbz#2143224 [RFE] add certificate support to ipa-client instead of one time password
Resolves: rhbz#2144736 vault interoperability with older RHEL systems is broken
Resolves: rhbz#2148258 ipa-client-install does not maintain server affinity during installation
Resolves: rhbz#2148379 Add warning for empty targetattr when creating ACI with RBAC
Resolves: rhbz#2148380 OTP token sync always returns OK even with random numbers
Resolves: rhbz#2148381 Deprecated feature idnssoaserial in IdM appears when creating reverse dns zones
Resolves: rhbz#2148382 Introduction of URI records for kerberos breaks location functionality

Resolves: rhbz#2124547 Attempt to log in as "root" user with admin's password in Web UI does not properly fail
Resolves: rhbz#2137555 Attempt to log in as "root" user with admin's password in Web UI does not properly fail [rhel-9.1.0.z]

Resolves: rhbz#2110014 ldap bind occurs when admin user changes password with gracelimit=0
Resolves: rhbz#2112901 RFE: Allow grace login limit to be set in IPA WebUI
Resolves: rhbz#2115495 group password policy by default does not allow grace logins
Resolves: rhbz#2116966 ipa-replica-manage displays traceback: Unexpected error: 'bool' object has no attribute 'lower'

Resolves: rhbz#2109645
Rebuild for samba-4.16.3-101.el9

Resolves: rhbz#2109645
Rebuild for samba-4.16.3-100.el9

Resolves: rhbz#2105294 IdM WebUI Pagination Size should not allow empty value

Resolves: rhbz#2091988 [RFE] Add code to check password expiration on ldap bind

Resolves: rhbz#747959 [RFE] Support random serial numbers in IPA certificates
Resolves: rhbz#2100227 [UX] Preserving a user account produces output saying it was deleted

Resolves: rhbz#2079469 [Rebase] Rebase ipa to latest 4.9.x release
Resolves: rhbz#2012911 named journalctl logs shows 'zone testrealm.test/IN: serial (serialnumber) write back to LDAP failed.'
Resolves: rhbz#2069202 [RFE] add support for authenticating against external IdP services using OAUTH2 preauthenticaiton mechanism provided by SSSD
Resolves: rhbz#2083218 ipa-dnskeysyncd floods /var/log/messages with DEBUG messages
Resolves: rhbz#2089750 RFE: Improve error message with more detail for ipa-replica-install command
Resolves: rhbz#2091988 [RFE] Add code to check password expiration on ldap bind
Resolves: rhbz#2094400 [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf
Resolves: rhbz#2096922 secret in ipa-pki-proxy.conf is not changed if new requiredSecret value is present in /etc/pki/pki-tomcat/server.xml

Resolves: rhbz#2067971 Consequences of FIPS crypto policy tightening in RHEL 9
tests: ensure AD-SUPPORT subpolicy is active in more cases
ipatests: fix check for AD topology being present

Resolves: rhbz#2067971 Consequences of FIPS crypto policy tightening in RHEL 9
KRB instance: make provision to work with crypto policy without SHA-1 HMAC types
tests: ensure AD-SUPPORT subpolicy is active
ipatests: extend AES keyset to SHA2-based ones
freeipa.spec: bump crypto-policies dependency for CentOS 9 Stream
Kerberos instance: default to AES256-SHA2 for master key encryption
test_otp: do not use paramiko unless it is really needed
test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Support AES for KRA archival wrapping
Set AES as default for KRA archival wrapping

Resolves: rhbz#2057467 Backport latest test fixes in python3-ipatests
ipatests: Tests for Autoprivate group.
mark xfail for test_idoverride_with_auto_private_group[hybrid]
Mark xfail test_gidnumber_not_corresponding_existing_group[true,hybrid]

Resolves: rhbz#2053025
add IPA test suite fixes

Resolves: rhbz#2053586 IPA LDAP plugin ipa-cldap memory leak
fix memory leak in CLDAP responder

Resolves: rhbz#2050540 Unable to join RHEL 8.5 Replica to RHEL 7.9 Master for migration purposes
Don't always override the port in import_included_profiles
Resolves: rhbz#2051582 Enable ipa-ccache-sweep.timer during server installation
Test ipa-ccache-sweep.timer enabled by default during installation
Enable the ccache sweep timer during installation
Resolves: rhbz#2051844 ipa-join tests are failing due to changes in expected output
Remove ipa-join errors from behind the debug option

Resolves: rhbz#2040619 - Changing default pac type to 'nfs:NONE and MS-PAC' doesnot display error 'ipa: ERROR: no modifications to be performed'
Config plugin: return EmptyModlist when no change is applied
config plugin: add a test ensuring EmptyModlist is returned
Resolves: rhbz#2048510 - [rhel-9.0] Backport latest test fixes in python3-ipatests
ipatests: webui: Tests for subordinate ids.
ipatests: webui: Use safe-loader for loading YAML configuration file
ipatests: Fix test_ipa_cert_fix.py::TestCertFixReplica teardown
Test cases for ipa-replica-conncheck command
PEP8 Fixes
ipatests: Test empty cert request doesn't force certmonger to segfault
ipatests: Test default value of nsslapd-sizelimit.
Extend test to see if replica is not shown when running `ipa-replica-manage list -v <FQDN>`
Added test automation for SHA384withRSA CSR support
Resolves: rhbz#2049104 - User can't log in after ipa-user-mod --user-auth-type=hardened
ipa-kdb: do not remove keys for hardened auth-enabled users
ipatests: add case for hardened-only ticket policy
Resolves: rhbz#2049174 - KRA GetStatus service blocked by IPA proxy
ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus