Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode

Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
Resolves: rhbz#2114771

Strip debugging data from ksu executable file

Include missing OpenSSL FIPS header
Make tests compatible with sssd_krb5_locator_plugin.so

Enable TMT integration with Fedora CI

Bump KDB ABI version provide to 9.0

New upstream version (1.20.1)
Resolves: rhbz#2124463
Restore "supportedCMSTypes" attribute in PKINIT preauth requests
Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms
Resolves: rhbz#2114766
Update error checking for OpenSSL CMS_verify
Resolves: rhbz#2119704
Remove invalid password expiry warning
Resolves: rhbz#2129113

Fix integer overflows in PAC parsing (CVE-2022-42898)
Resolves: rhbz#2143011

Use baserelease to set the release number
Add missing BR for resolv_wrapper to run t_discover_uri.py

Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Allow libkrad UDP/TCP connection to localhost in FIPS mode
Resolves: rhbz#2082189
Read GSS configuration files with mtime 0

Use p11-kit as default PKCS11 module
Resolves: rhbz#2073274
Try harder to avoid password change replay errors
Resolves: rhbz#2072059

Fix libkrad client cleanup
Fixes rhbz#2072059

Allow use of larger RADIUS attributes in krad library

Use SHA-256 instead of SHA-1 for PKINIT CMS digest