release-notes-4-10-2-draft.txt

{{ReleaseDate|2023-04-20}}
The FreeIPA team would like to announce FreeIPA 4.10.2 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora distributions will be available from the official repository soon.

== Highlights in 4.10.2 ==

'''TODO RELEASE NOTES - put release notes (if any) to proper categories'''
* 5444: [RFE] Support Resource based kerberos constrained delegation


--------
* 9287: [RFE] makeapi should validate the generated API doc vs stored doc


--------
* 9298: [Tracker] Nightly test failure (updates-testing) in test_acme.py::TestACME::test_certbot_certonly_standalone
:: With Certbot update to 2.0.0, Certbot defaults to ECDSA certificate private keys for all new certificates. PKI ACME cert profile supports only rsa private keys, meaning that the key type needs to be forced to rsa when requesting an ACME certificate, using certbot --key-type rsa [...]
--------
'''END TODO'''

=== Enhancements ===

=== Known Issues ===


=== Bug fixes ===
FreeIPA 4.10.2 is a stabilization release for the features delivered as a
part of 4.10.0 version series.

There are more than 50 bug-fixes since FreeIPA 4.10.1 release.
Details of the bug-fixes can be seen in the list of resolved tickets below.

== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.

== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/)
or #freeipa channel on libera.chat.


== Resolved tickets ==
* [https://pagure.io/freeipa/issue/5130 #5130] ([https://bugzilla.redhat.com/show_bug.cgi?id=1243261 rhbz#1243261]) non-admin users cannot search hbac rules
* [https://pagure.io/freeipa/issue/5444 #5444] [RFE] Support Resource based kerberos constrained delegation
* [https://pagure.io/freeipa/issue/6044 #6044] ([https://bugzilla.redhat.com/show_bug.cgi?id=1353899 rhbz#1353899]) ipa-advise: object of type 'type' has no len()
* [https://pagure.io/freeipa/issue/9002 #9002] Nightly failure in test_fips.py::TestInstallFIPS::test_basic::setup
* [https://pagure.io/freeipa/issue/9124 #9124] Nightly test failure in test_smb.py::TestSMB::test_smb_service_s4u2self
* [https://pagure.io/freeipa/issue/9135 #9135] Nightly test failure (f37+): reverse zone not created
* [https://pagure.io/freeipa/issue/9195 #9195] ([https://bugzilla.redhat.com/show_bug.cgi?id=2158775 rhbz#2158775]) Hiding a server does not completely clean up DNS records
* [https://pagure.io/freeipa/issue/9226 #9226] ([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547]) Infinite redirect loop in the WebUI for user root
* [https://pagure.io/freeipa/issue/9232 #9232] ipaserver circular import
* [https://pagure.io/freeipa/issue/9249 #9249] ([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630]) Deprecated feature idnssoaserial in IdM appears when creating reverse dns zones
* [https://pagure.io/freeipa/issue/9259 #9259] ([https://bugzilla.redhat.com/show_bug.cgi?id=2144737 rhbz#2144737]) vault interoperability with older RHEL systems is broken
* [https://pagure.io/freeipa/issue/9264 #9264] Nightly failure in test_integration/test_sso.py::TestSsoBridge::test_ipa_login_with_sso_user
* [https://pagure.io/freeipa/issue/9278 #9278] Pylint 2.15 issues
* [https://pagure.io/freeipa/issue/9279 #9279] ipa-otpd@.service: deprecated syslog setting
* [https://pagure.io/freeipa/issue/9282 #9282] Nightly test failure in test_webui/test_subid.py/test_subid/test_subid_range_deletion_not_allowed
* [https://pagure.io/freeipa/issue/9285 #9285] ipa-certupdate restarts HTTPd too early
* [https://pagure.io/freeipa/issue/9286 #9286] ([https://bugzilla.redhat.com/show_bug.cgi?id=2056009 rhbz#2056009]) memberManager ACIs aren't allowing group-based manager access due to missing upgrade code
* [https://pagure.io/freeipa/issue/9287 #9287] [RFE] makeapi should validate the generated API doc vs stored doc
* [https://pagure.io/freeipa/issue/9290 #9290] ([https://bugzilla.redhat.com/show_bug.cgi?id=2149889 rhbz#2149889]) idm:client is missing dependency on krb5-pkinit.
* [https://pagure.io/freeipa/issue/9291 #9291] Nightly test failure (rawhide) in test_ipa_dns_systemrecords_check
* [https://pagure.io/freeipa/issue/9294 #9294] ([https://bugzilla.redhat.com/show_bug.cgi?id=2162677 rhbz#2162677]) Enable the certificate pruning job in PKI
* [https://pagure.io/freeipa/issue/9295 #9295] Nightly test failure (sssd) in test_trust.py::TestNonPosixAutoPrivateGroup and test_trust.py::TestPosixAutoPrivateGroup
* [https://pagure.io/freeipa/issue/9298 #9298] [Tracker] Nightly test failure (updates-testing) in test_acme.py::TestACME::test_certbot_certonly_standalone
* [https://pagure.io/freeipa/issue/9306 #9306] ([https://bugzilla.redhat.com/show_bug.cgi?id=2160389 rhbz#2160389]) 'ERROR Could not remove /tmp/tmpbkw6hawo.ipabkp' can be seen prior to 'ipa-client-install' command was successful.
* [https://pagure.io/freeipa/issue/9309 #9309] ([https://bugzilla.redhat.com/show_bug.cgi?id=2160399 rhbz#2160399]) get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct
* [https://pagure.io/freeipa/issue/9310 #9310] ([https://bugzilla.redhat.com/show_bug.cgi?id=2162335 rhbz#2162335]) ipa-trust-add with --range-type=ipa-ad-trust-posix fails while creating an ID range
* [https://pagure.io/freeipa/issue/9313 #9313] Nightly test failure (rawhide): automember-rebuild test
* [https://pagure.io/freeipa/issue/9314 #9314] Redundant build dependency on python3-paste (if with lint)
* [https://pagure.io/freeipa/issue/9315 #9315] [tests] test_ipa_healthcheck_fips_enabled fails on system without fips-mode-setup
* [https://pagure.io/freeipa/issue/9316 #9316] ([https://bugzilla.redhat.com/show_bug.cgi?id=2166324 rhbz#2166324]) Passwordless (GSSAPI) SSH login with AD user
* [https://pagure.io/freeipa/issue/9318 #9318] Incomplete fast lint/codestyle check if both Python template files and Python modules were changed
* [https://pagure.io/freeipa/issue/9319 #9319] [tests] TestDNSResolver failures on systems without or empty /etc/resolv.conf
* [https://pagure.io/freeipa/issue/9320 #9320] ([https://bugzilla.redhat.com/show_bug.cgi?id=2018198 rhbz#2018198]) RFE - Add a warning note about possible performance impact of the Auto Member rebuild task.
* [https://pagure.io/freeipa/issue/9322 #9322] ([https://bugzilla.redhat.com/show_bug.cgi?id=2162677 rhbz#2162677]) Nightly test failure in test_integration/test_acme.py::TestACME
* [https://pagure.io/freeipa/issue/9323 #9323] Update the design doc for certificate pruning
* [https://pagure.io/freeipa/issue/9324 #9324] ipatests: Frequent timeout of test_acme
* [https://pagure.io/freeipa/issue/9325 #9325] ([https://bugzilla.redhat.com/show_bug.cgi?id=2168244 rhbz#2168244]) requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage pruning command
* [https://pagure.io/freeipa/issue/9326 #9326] ipatests: timeout of test_trust
* [https://pagure.io/freeipa/issue/9329 #9329] Azure test: WebUI_Unit_Tests are failing
* [https://pagure.io/freeipa/issue/9332 #9332] Extend negative test coverage for automember
* [https://pagure.io/freeipa/issue/9333 #9333] ipa-client-install --pkinit-identity can block in unattended mode
* [https://pagure.io/freeipa/issue/9338 #9338] Update 'Auth indicators' doc string to show 'ipd' usage
* [https://pagure.io/freeipa/issue/9339 #9339] Broken support for dnspython < 2
* [https://pagure.io/freeipa/issue/9342 #9342] Fedora trasiition license from short names to SPDX license expression
* [https://pagure.io/freeipa/issue/9344 #9344] ipa-server-install fails when the named keytab location is overridden in ipaplatform/paths.py
* [https://pagure.io/freeipa/issue/9347 #9347] Azure Ci does not work with Fedora Rawhide
* [https://pagure.io/freeipa/issue/9349 #9349] ([https://bugzilla.redhat.com/show_bug.cgi?id=2180914 rhbz#2180914]) Sequence processing failures for group_add using server context
* [https://pagure.io/freeipa/issue/9354 #9354] Implement resource-based constrained delegation
* [https://pagure.io/freeipa/issue/9355 #9355] support python cryptography 40.0
* [https://pagure.io/freeipa/issue/9358 #9358] update_dna_shared_config sometimes blocks installation for 2 minutes
== Detailed changelog since 4.10.1 ==
=== Alexander Bokovoy (15) ===
* doc/designs/rbcd.md: document use of S-1-18-* SIDs [https://pagure.io/freeipa/c/cb18ca31697320a58ae23a67afbfe7a0ff9a55a5 commit] [https://pagure.io/freeipa/issue/9354 #9354]
* doc/designs/rbcd.md: add usage examples [https://pagure.io/freeipa/c/b63e6a257006e846ef5d0a008d9c3c0f935c09bb commit] [https://pagure.io/freeipa/issue/9354 #9354]
* RBCD: add basic test for RBCD handling [https://pagure.io/freeipa/c/7d68f4f08361760adab90ad4b44c6da2c4ea664d commit] [https://pagure.io/freeipa/issue/9354 #9354]
* kdb: implement RBCD handling in KDB driver [https://pagure.io/freeipa/c/7ac6adfaac30473b14b589a71fac42fe147bc0d9 commit] [https://pagure.io/freeipa/issue/9354 #9354]
* IPA API changes to support RBCD [https://pagure.io/freeipa/c/5b6ad0e65600a96bb4d6f3b1acf4e16773a03493 commit] [https://pagure.io/freeipa/issue/9354 #9354]
* doc: add design document for Kerberos constrained delegation [https://pagure.io/freeipa/c/18cd909b4ad854147008a1010c97c75640a54177 commit] [https://pagure.io/freeipa/issue/9354 #9354]
* ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only [https://pagure.io/freeipa/c/7a7ba45c10a6da4f9e110f6cc57cfc47e0a16a16 commit] [https://pagure.io/freeipa/issue/5444 #5444]
* test_xmlrpc: adopt to automember plugin message changes in 389-ds [https://pagure.io/freeipa/c/52e6da9056697e2210736d5528826ae424fec9b1 commit] 
* Ignore empty modification error in case cifs/.. principal already added [https://pagure.io/freeipa/c/e7506403a988b98cc3381d2d986b53aee48448cb commit] [https://pagure.io/freeipa/issue/9354 #9354]
* ipalib/x509: Implement abstract method Certificate.verify_directly_issued_by [https://pagure.io/freeipa/c/e07ead943abf070107a9669fc4564c9dc7518832 commit] [https://pagure.io/freeipa/issue/9355 #9355]
* Fix tox in Azure CI [https://pagure.io/freeipa/c/aacaafce9d074342e383ad7007dee1b0e09d9b12 commit] [https://pagure.io/freeipa/issue/9347 #9347]
* Use system-wide chromium for webui tests [https://pagure.io/freeipa/c/84f5f87b1f77267aa4c6c13fbc2496793d06a3c7 commit] [https://pagure.io/freeipa/issue/9347 #9347]
* Don't fail if optional RPM macros file is missing [https://pagure.io/freeipa/c/b93f6b52a29659663fae65be51dafe350606eb6d commit] [https://pagure.io/freeipa/issue/9347 #9347]
* ipa-kdb: PAC consistency checker needs to handle child domains as well [https://pagure.io/freeipa/c/0206369eec8530e96c66986c4ca501d8962193ce commit] [https://pagure.io/freeipa/issue/9316 #9316]
* updates: fix memberManager ACI to allow managers from a specified group [https://pagure.io/freeipa/c/42be04fe4ff317efe599dcbc2637f94ecc6fa220 commit] [https://pagure.io/freeipa/issue/9286 #9286]

=== Anuja More (4) ===
* ipatests: Test that non admin user can search hbac rule. [https://pagure.io/freeipa/c/051bbe36dce57837bd1769aa4a88569e39565774 commit] [https://pagure.io/freeipa/issue/5130 #5130]
* ipatests: Test ipa-advise is not failing with error. [https://pagure.io/freeipa/c/983a6516f147ae95a512435cd05d237233d0b5fc commit] [https://pagure.io/freeipa/issue/6044 #6044]
* PRCI: update test_trust.py for nightly pipelines. [https://pagure.io/freeipa/c/2a2132ccfd3cfb26f5da550a829b267ca0a4f6ae commit] [https://pagure.io/freeipa/issue/9326 #9326]
* Add test for SSH with GSSAPI auth. [https://pagure.io/freeipa/c/a6cb905de74da38d62f9c3bd7957018924282521 commit] [https://pagure.io/freeipa/issue/9316 #9316]

=== Antonio Torres (8) ===
* Extend API documentation [https://pagure.io/freeipa/c/9c6b4f4445dbd1eefffbfff191063980a2f3a342 commit] 
* doc: allow notes on Param API Reference pages [https://pagure.io/freeipa/c/3eed25e92f951689658f6bbd178a5baca37442c6 commit] 
* ipaserver: deepcopy objectclasses list from IPA config [https://pagure.io/freeipa/c/b1b7cbc08d96e125ce21113ba1793a592d0ba35a commit] [https://pagure.io/freeipa/issue/9349 #9349]
* API doc: add usage guides for groups, HBAC and sudo rules [https://pagure.io/freeipa/c/649c35aa3b46e6d2f034d9afdc4c7ae1542630da commit] 
* API doc: add note about ipa show-mappings to usage guide [https://pagure.io/freeipa/c/a20acb6f833a22baad214a466848cb5833954532 commit] 
* API doc: validate generated reference [https://pagure.io/freeipa/c/364116c25f68b6b21c0a64466bda09c70cf146ec commit] [https://pagure.io/freeipa/issue/9287 #9287]
* API doc: add basic user management guide [https://pagure.io/freeipa/c/a10627bdb90bb6eeaf6a156476253edc503c72df commit] 
* Back to git snapshots [https://pagure.io/freeipa/c/657a7b2556e22b70802809dd784fe576d3edea95 commit] 

=== Carla Martinez (1) ===
* Update 'Auth indicators' doc string [https://pagure.io/freeipa/c/6a4d34fba90ede0a9d600daa24a8d95190a42495 commit] [https://pagure.io/freeipa/issue/9338 #9338]

=== Christian Heimes (3) ===
* Speed up installer by restarting DS after DNA plugin [https://pagure.io/freeipa/c/d63756eb08759740fe8b03f48d0a240f9935e6aa commit] [https://pagure.io/freeipa/issue/9358 #9358]
* Don't block when kinit_pkinit() fails [https://pagure.io/freeipa/c/8803938570dfb70586fa89d2d2d7aad4b0965305 commit] [https://pagure.io/freeipa/issue/9333 #9333]
* ipa-certupdate: Update client certs before KDC/HTTPd restart [https://pagure.io/freeipa/c/8e7d1ac4e4779cc15b39a9901bb26c5f5997eb5b commit] [https://pagure.io/freeipa/issue/9285 #9285]

=== Chris Kelley (1) ===
* Check that CADogtagCertsConfigCheck can handle cert renewal [https://pagure.io/freeipa/c/a786d3d584c8696df3b18858df1c429cba03721f commit] 

=== David Pascual (2) ===
* doc: Use case examples for PR-CI checker tool [https://pagure.io/freeipa/c/41c32174b2b3cf71474ea74df32f1f763f4a2c5b commit] 
* ipatests: fix (prci_checker) duplicated check & error return code [https://pagure.io/freeipa/c/1a965a3a6304607eb5acbdfee45843ebe8746c67 commit] 

=== Erik Belko (1) ===
* ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario [https://pagure.io/freeipa/c/e1f4f655a65777f5096e65b8e5c3e079f77f6ecc commit] [https://pagure.io/freeipa/issue/9286 #9286]

=== Filip Dvorak (1) ===
* ipa tests: Add LANG before kinit command to fix issue with locale settings [https://pagure.io/freeipa/c/2520a7adff7a49ddcddaaf19f0e586425dc0d878 commit] 

=== Florence Blanc-Renaud (46) ===
* ipatests: mark known failures for autoprivategroup [https://pagure.io/freeipa/c/e2b08433cf7cf74dea81b88953a4b8daa4c38614 commit] [https://pagure.io/freeipa/issue/9295 #9295]
* ipatests: fix test definition for test_trust [https://pagure.io/freeipa/c/def07260da883b1d27330b308bd0337205bf53a8 commit] [https://pagure.io/freeipa/issue/9326 #9326]
* ipatests: increase timeout for test_trust [https://pagure.io/freeipa/c/ae014c6a3e17da7b0775be79a425d769a2717243 commit] [https://pagure.io/freeipa/issue/9326 #9326]
* ipatests: adapt for new automembership fixup behavior [https://pagure.io/freeipa/c/34d048ede0c439b3a53e02f8ace96ff91aa1609d commit] [https://pagure.io/freeipa/issue/9313 #9313]
* ipatests: increase timeout for test_acme [https://pagure.io/freeipa/c/0a8a3922487b8029c509635c85b533474008bb9d commit] [https://pagure.io/freeipa/issue/9324 #9324]
* automember-rebuild: add a notice about high CPU usage [https://pagure.io/freeipa/c/2857bc69957bde7e59fff1c66c5a83c7f560616b commit] [https://pagure.io/freeipa/issue/9320 #9320]
* trust-add: handle missing msSFU30MaxGidNumber [https://pagure.io/freeipa/c/97fc368df2db3b559a9def236d3c3e0a12bcdd0a commit] [https://pagure.io/freeipa/issue/9310 #9310]
* Spec file: use %autosetup instead of %setup [https://pagure.io/freeipa/c/2a69d056176edd4ef0b1f4e59eb0548a483bc6e5 commit] 
* Spec file: unify with RHEL9 spec [https://pagure.io/freeipa/c/0e06786a44f8d12b08961fe0720a1b712e82c5cf commit] 
* Installer: create RID base before domain object [https://pagure.io/freeipa/c/7d1a35852fa53bcf3b88a8a80a2e86ef88a75795 commit] [https://pagure.io/freeipa/issue/9309 #9309]
* Tests: force key type in ACME tests [https://pagure.io/freeipa/c/0fa95852c935c7b079f8ed966d4f194099217038 commit] [https://pagure.io/freeipa/issue/9298 #9298]
* server install: remove error log about missing bkup file [https://pagure.io/freeipa/c/894dca12c120f0bfa705307a0609da47326b8fb2 commit] [https://pagure.io/freeipa/issue/9306 #9306]
* ipatests: mark test_smb as xfail [https://pagure.io/freeipa/c/b5f2b0b1b213149b5bfe2653c9e40de98249dc73 commit] [https://pagure.io/freeipa/issue/9124 #9124]
* pylint: disable deprecated-module message [https://pagure.io/freeipa/c/85037db2e1927c76fba963c6fde4ce17d2b95929 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: fix comparison-of-constants [https://pagure.io/freeipa/c/62e2d111fc3113aa5c9f22ae75068094403d1d39 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable comparison-of-constants [https://pagure.io/freeipa/c/015e25a581353aaf628f9e2ea8306fda89842cd5 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: fix consider-iterating-dictionary [https://pagure.io/freeipa/c/3d211b4f9f6950a2810496f30e57a421eeb31e85 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: globally disable useless-object-inheritance [https://pagure.io/freeipa/c/4e998848f08b52760225c5bcb1afa9a6b2f6361b commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable unhashable-member [https://pagure.io/freeipa/c/07111438389fde4a74845f9f797656712335795f commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable invalid-sequence-index [https://pagure.io/freeipa/c/a95e11dbbff58804c5b85acaa4d70b72ce750ae0 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: fix deprecated-class SafeConfigParser [https://pagure.io/freeipa/c/433599fdef1bf0608991d25ddbe6c891ae382ae0 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: fix duplicate-value [https://pagure.io/freeipa/c/b9ea3fcbdb9ab07153873aeea7d3e1bd69e0d065 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: fix implicit-str-concat [https://pagure.io/freeipa/c/71496be75f6523b51f9316d3dcf7e0662d2cb606 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable missing-timeout message [https://pagure.io/freeipa/c/84c4792bdbf82108771d796ae317e2cb1f1d2100 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: globally disable unnecessary-lambda-assignment message [https://pagure.io/freeipa/c/2b97c8caad267f97780d7ee8d940577c17ef1499 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable unnecessary-dunder-call message [https://pagure.io/freeipa/c/3336236ff1133ae86a5c9e2caeb90db7169fa454 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable using-constant-test [https://pagure.io/freeipa/c/5434c12b6012f035528f0b137c1af5c1be113542 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: remove arguments-renamed warnings [https://pagure.io/freeipa/c/22f182ee9203be5e014d438f2a27b8721dd0c3ae commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable modified-iterating-list [https://pagure.io/freeipa/c/ac69ad4ba5ec644fbb1b2768237fd2412d7e3101 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: replace deprecated distutils module [https://pagure.io/freeipa/c/328fb642f6aba1a15040b7374a59cb6f7679f8f5 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable used-before-assignment [https://pagure.io/freeipa/c/081dd26376b8ff704a83e1c783d97c40951c43b3 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: disable redefined-slots-in-subclass [https://pagure.io/freeipa/c/240b46db1451b8fed5f04244e9927b8fc03f10c0 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: remove useless suppression [https://pagure.io/freeipa/c/51e0f751e9c3b5cade75360d24ba64c75ec926ba commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: remove unneeded disable=unused-private-member [https://pagure.io/freeipa/c/fd21204559bd8fcac6a1b321adda163cd88aa149 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* azure tests: move to fedora 37 [https://pagure.io/freeipa/c/782873a2277ca7defa5554d2b7859f1c14767d68 commit] 
* ipatests: update the xfail annotation for test_number_of_zones [https://pagure.io/freeipa/c/304978924a09677805fd3b73614aad6a2de232a2 commit] [https://pagure.io/freeipa/issue/9135 #9135]
* Spec file: bump krb5_kdb_version on rawhide [https://pagure.io/freeipa/c/2904b15a94eebbb37ca6a289eccd6b95f063d7ca commit] 
* FIPS setup: fix typo filtering camellia encryption [https://pagure.io/freeipa/c/dfba6ebf9ab7b7d17e65f928c90ae63b31d9cae7 commit] 
* cert utilities: MAC verification is incompatible with FIPS mode [https://pagure.io/freeipa/c/c853cfde56fb56798424bd402012d78ed47647c0 commit] 
* ipatests: update the fake fips mode expected message [https://pagure.io/freeipa/c/68f6574cb2bcf0b04840b4f62a8ac70b4d45cb1a commit] [https://pagure.io/freeipa/issue/9002 #9002]
* ipatests: xfail on all fedora for test_ipa_login_with_sso_user [https://pagure.io/freeipa/c/9599e975bcdc0a58a32ccee6ad531c7298661a1d commit] [https://pagure.io/freeipa/issue/9264 #9264]
* Spec file: ipa-client depends on krb5-pkinit-openssl [https://pagure.io/freeipa/c/2d0a0cc40fb8674f30ba62980b1953cef840009e commit] [https://pagure.io/freeipa/issue/9290 #9290]
* webui tests: fix assertion in test_subid.py [https://pagure.io/freeipa/c/c411c2e7b2e400829ffac250db81609ef3c56faa commit] [https://pagure.io/freeipa/issue/9282 #9282]
* PRCI: update memory reqs for each topology [https://pagure.io/freeipa/c/aeb9cc9b622d3d4a40a7eb3fe5800649c68c3b96 commit] 
* API reference: update dnszone_add generated doc [https://pagure.io/freeipa/c/660da9ab1d93fd8e561643728ae3821193953433 commit] [https://pagure.io/freeipa/issue/9249 #9249]
* API reference: update vault doc [https://pagure.io/freeipa/c/42957f9e7819ad76394b20337e65c7bee828dd8f commit] [https://pagure.io/freeipa/issue/9259 #9259]

=== Jarl Gullberg (2) ===
* install: Fix missing dyndb keytab directive [https://pagure.io/freeipa/c/1b38ab1771944b51ddaeea972ea92a8e8ee5b92b commit] [https://pagure.io/freeipa/issue/9344 #9344]
* ipaplatform/debian: fix path to ldap.so [https://pagure.io/freeipa/c/03180bedcf99075d98f206d271a31ae7ceddc50d commit] 

=== mbhalodi (4) ===
* ipatests: Test for sequence processing failures with server context [https://pagure.io/freeipa/c/304fd550613e83d120c72f0dad89f6a89d31231c commit] [https://pagure.io/freeipa/issue/9349 #9349]
* ipatests: add missing automember-cli tests [https://pagure.io/freeipa/c/6db9bbd85a837950d9244502507535c1f79ab64a commit] [https://pagure.io/freeipa/issue/9332 #9332]
* ipatests: WebUI - ensure that ipa automember-rebuild prints a warning [https://pagure.io/freeipa/c/cd07413cba37150b12d6b279510941aad49b5afb commit] [https://pagure.io/freeipa/issue/9320 #9320]
* ipatests: ensure that ipa automember-rebuild prints a warning [https://pagure.io/freeipa/c/88b9be29036a3580a8bccd31986fc30faa9852df commit] [https://pagure.io/freeipa/issue/9320 #9320]

=== Michal Polovka (1) ===
* ipatest: loginscreen: do not use hardcoded password [https://pagure.io/freeipa/c/1f10aebcc5b3568a9992111e377c5caecc1e035f commit] [https://pagure.io/freeipa/issue/9226 #9226]

=== Mohammad Rizwan (2) ===
* ipatests: fix tests in TestACMEPrune [https://pagure.io/freeipa/c/e7c642bafcead5ce344f3b129d916045b00d0c1e commit] [https://pagure.io/freeipa/issue/9294 #9294]
* ipatests: tests for certificate pruning [https://pagure.io/freeipa/c/0f77b359e241fc4055fb8d785e18f96338451ebf commit] [https://pagure.io/freeipa/issue/9294 #9294]

=== Rob Crittenden (9) ===
* doc: Update pruning design with implement enable/disable options [https://pagure.io/freeipa/c/fe13baa0acdb885dd981cbd8fdf6cee5e5ef22e3 commit] [https://pagure.io/freeipa/issue/9323 #9323]
* Wipe the ipa-ca DNS record when updating system records [https://pagure.io/freeipa/c/4e0ad96fbd9f438c884eeeaa60c2fb0c910a2b61 commit] [https://pagure.io/freeipa/issue/9195 #9195]
* Fix setting values of 0 in ACME pruning [https://pagure.io/freeipa/c/20ff7c16022793c707f6c2b8fb38a801870bc0e2 commit] [https://pagure.io/freeipa/issue/9325 #9325]
* tests: add wrapper around ACME RSNv3 test [https://pagure.io/freeipa/c/d24b69981d94fce7b1e1aa4a5c1ab88a123f96b5 commit] [https://pagure.io/freeipa/issue/9322 #9322]
* doc: add the --run command for manual job execution [https://pagure.io/freeipa/c/f10d1a0f84ed0f16ab4a1469f16ffadb3e79e59e commit] [https://pagure.io/freeipa/issue/9294 #9294]
* ipa-acme-manage: add certificate/request pruning management [https://pagure.io/freeipa/c/9246a8a003b2b0062e07c289cd7cde8fe902b16f commit] [https://pagure.io/freeipa/issue/9294 #9294]
* tests: Add new ipa-ca error messages to IPADNSSystemRecordsCheck [https://pagure.io/freeipa/c/6ca119686aadfa72c0474f72758b63cd671952d4 commit] [https://pagure.io/freeipa/issue/9291 #9291]
* tests: Add ipa_ca_name checking to DNS system records [https://pagure.io/freeipa/c/ff31b0c40cc5e046f839b98b80bd16bb649205ac commit] [https://pagure.io/freeipa/issue/9291 #9291]
* doc: Design for certificate pruning [https://pagure.io/freeipa/c/51b1c22d025bf40e9ef488bb0faf0c8dff303ccd commit] [https://pagure.io/freeipa/issue/9294 #9294]

=== Rafael Guterres Jeffman (1) ===
* Migrated to SPDX license. [https://pagure.io/freeipa/c/e3507563877f1d64567f24b7f2e33ade8c310f86 commit] [https://pagure.io/freeipa/issue/9342 #9342]

=== Stanislav Levin (20) ===
* fastlint: Correct concatenation of file lists [https://pagure.io/freeipa/c/540262700d73b701b0fd5dd3b79e5b20f0fc84c3 commit] [https://pagure.io/freeipa/issue/9318 #9318]
* dns: Fix support for dnspython 1.1x [https://pagure.io/freeipa/c/b152e8c3aea9f2c3ade319934fd7c81cb5432407 commit] [https://pagure.io/freeipa/issue/9339 #9339]
* tests: webui: Update vendored qunit [https://pagure.io/freeipa/c/9b8e8edc22ade3027a5c3da487783f598e0732fd commit] [https://pagure.io/freeipa/issue/9329 #9329]
* AP: webui: List installed nodejs packages [https://pagure.io/freeipa/c/8fe8b262232ce65dddea8c92838200a1c5121f13 commit] [https://pagure.io/freeipa/issue/9329 #9329]
* tests: webui: Load qunit only once [https://pagure.io/freeipa/c/425cad6f114c981bfe41a30c7ad626164ac29be4 commit] [https://pagure.io/freeipa/issue/9329 #9329]
* tests: webui: Allow file access from files in tests [https://pagure.io/freeipa/c/450e78f5f3be3064d7ee1c6be5103dfae2ebaf87 commit] [https://pagure.io/freeipa/issue/9329 #9329]
* tests: Configure DNSResolver as platform agnostic resolver [https://pagure.io/freeipa/c/d662b125985369181a3ebcbad82a4a43215282f6 commit] [https://pagure.io/freeipa/issue/9319 #9319]
* spec: Drop no longer used build dependency on paste [https://pagure.io/freeipa/c/fb22c8e5bf9432b4a7c2866d5d210c353985ea50 commit] [https://pagure.io/freeipa/issue/9314 #9314]
* ipatests: healthcheck: Handle missing fips-mode-setup [https://pagure.io/freeipa/c/1be3188e3168e7a097e44a97f86e29b7e42fcae6 commit] [https://pagure.io/freeipa/issue/9315 #9315]
* pylint: Replace deprecated cgi module [https://pagure.io/freeipa/c/2009889d763ccc26479c966931ca1b60378496fd commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix useless-object-inheritance [https://pagure.io/freeipa/c/bccd3c942084c753543d63b4d409ac46f819d314 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix unhashable-member [https://pagure.io/freeipa/c/bd7b5bf71c443daa3ac12ff194748845a84b08f0 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix unnecessary-lambda-assignment [https://pagure.io/freeipa/c/dc8c8a7824565178333ef7ae8ac7934467424691 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix modified-iterating-list [https://pagure.io/freeipa/c/acc2daf25f5c12ef1d9a823de15df080ba42d059 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix used-before-assignment [https://pagure.io/freeipa/c/b12376560da944b0845b9ac0d424adaf5435670f commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Replace deprecated pipes [https://pagure.io/freeipa/c/1261bbf0016d4824f908a589d4943513e98f8b01 commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Fix cyclic-import [https://pagure.io/freeipa/c/c48c76e9d34bae09dc4eac1f3b33f7cb72355c25 commit] [https://pagure.io/freeipa/issue/9232 #9232], [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Replace deprecated extension-pkg-whitelist [https://pagure.io/freeipa/c/68ab438f5c2250d96733a0c1b47cbb3a1c518bed commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: More allowed C extensions [https://pagure.io/freeipa/c/f9822697659f134146e1dcfce0c48e2279a8becb commit] [https://pagure.io/freeipa/issue/9278 #9278]
* pylint: Lint in single process mode [https://pagure.io/freeipa/c/d673fdab6097ae783bd0075c0e990e42bc24f833 commit] [https://pagure.io/freeipa/issue/9278 #9278]

=== Sudhir Menon (1) ===
* Fixes: ipa-otpd@.service: deprecated syslog setting [https://pagure.io/freeipa/c/65a14a36936b8ebfdb17560d5976447c6f4cdf7e commit] [https://pagure.io/freeipa/issue/9279 #9279]

=== Todd Zullinger (2) ===
* spec: silence krb5 pkgconf errors in %krb5_base_version [https://pagure.io/freeipa/c/90d0f04987b5477efa64d64416d89890e6bcda75 commit] 
* spec: verify upstream source signature [https://pagure.io/freeipa/c/3b64eaa153d89920cbb0be87e5c2b512c4bf2008 commit] 

=== Thorsten Scherf (1) ===
* external-idp: change idp server name to reference name [https://pagure.io/freeipa/c/9323bafb645a377192efe17b489124a440c055c3 commit]