[DRAFT] FreeIPA 4.9.11 Release Notes

[Antonio Torres]

{{ReleaseDate|2022-11-03}}
The FreeIPA team would like to announce FreeIPA 4.9.11 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora distributions will be available from the official repository soon.

== Highlights in 4.9.11 ==

'''TODO RELEASE NOTES - put release notes (if any) to proper
categories'''
* 1539: [RFE] Add code to check password expiration on ldap bind
:: User can no longer do LDAP BIND operation with expired password.
--------
* 3226: [RFE] ipa sudorule-add-user should accept more types of characters


--------
* 8361: Add support for managing subuids and subgids in FreeIPA
:: IPA is now able to centrally store ID sub-ranges for users/groups.
More details can be found in the design document:
https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html
--------
* 8404: Detect and fail if not enough memory is available for installation
:: FreeIPA server now requires at least 1.2 GiB RAM for installation
to prevent performance degradation.
--------
* 8528: Use separate logs for AD Trust and DNS installer
:: ipa-adtrust-install and ipa-dns-install commands now log their
activity into separate log files.
--------
* 8655: Allow to establish trust to Active Directory in FIPS mode
:: When IPA is deployed in FIPS mode, it is now possible to establish
trust to Active Directory forest.
--------
* 8803: Add support for managing IdP references
:: FreeIPA can now authenticate users with the help of OAuth 2.0
identity providers supporting OAuth 2.0 Device Authorization Flow.
IdPs known to work are Keycloak, Microsoft Azure, Google, Github, and
Okta. Details on how to use Keycloak can be found in FreeIPA workshop:
https://freeipa.readthedocs.io/en/latest/workshop/12-external-idp-support...
--------
* 9150: Remove 'Remove' button from subid page
:: subid ranges cannot be removed. A button in Web UI subid management
page to remove the range was removed to not confuse users
--------
* 9159: [RFE] ipa-client-install should provide option to enable
subid: sss in /etc/nsswitch.conf
:: IPA installers now provide the ability to configure SSSD as
datasource for subid
--------
* 9187: [UX] Preserving a user account produces output saying it was deleted
:: Previously, the command to preserve a user account used to display
a confusing output "Deleted user: <user>" although the user was
preserved and not deleted. The command now displays "Preserved user:
<user>" for preserved users.
--------
* 9228: ipa-client-install does not maintain server affinity during installation
:: ipa-client-install will use a single server for the duration of the
installation process, either one discovered or provided on the
command-line. Previously it would use a temporary configuration to do
enrollment, then switch to a final one for the remaining operations.
This could lead to the installer talking with multiple servers. If the
client installer is faster than replication this could lead to errors.
--------
* 9237: Show order in sudo rule list in web interface
:: In the 'sudo rules' page, the WebUI is now displaying a 'sudo
order' column so that the users can easily see which rules override
other rules based on their order.
--------
* 9258: Do not add TLS CA configuration to ldap.conf anymore
:: FreeIPA client installer does not add explicit TLS CA configuration
to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA
configuration is not required as OpenLDAP uses the default CA store
provided by OpenSSL and IPA CA is installed in the default store by
the installer already.
--------
'''END TODO'''

=== Enhancements ===
* 8361: Add support for managing subuids and subgids in FreeIPA
:: IPA is now able to centrally store ID sub-ranges for users/groups.
More details can be found in the design document:
https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html
--------
=== Known Issues ===


=== Bug fixes ===
FreeIPA 4.9.11 is a stabilization release for the features delivered as a
part of 4.9 version series.

There are more than 50 bug-fixes since FreeIPA 4.9.10 release.
Details of the bug-fixes can be seen in the list of resolved tickets below.

== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.

== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list
(https://lists.fedoraproject.org/archives/list/[e-mail]...)
or #freeipa channel on libera.chat.


== Resolved tickets ==
* [https://pagure.io/freeipa/issue/1539 #1539]
([https://bugzilla.redhat.com/show_bug.cgi?id=782917 rhbz#782917])
[RFE] Add code to check password expiration on ldap bind
* [https://pagure.io/freeipa/issue/3226 #3226]
([https://bugzilla.redhat.com/show_bug.cgi?id=871208 rhbz#871208])
[RFE] ipa sudorule-add-user should accept more types of characters
* [https://pagure.io/freeipa/issue/8361 #8361] Add support for
managing subuids and subgids in FreeIPA
* [https://pagure.io/freeipa/issue/8404 #8404] Detect and fail if not
enough memory is available for installation
* [https://pagure.io/freeipa/issue/8452 #8452] update samba
configuration on IPA master to explicitly use 'server role' setting
* [https://pagure.io/freeipa/issue/8501 #8501] Unify how FreeIPA gets
FQDN of current host
* [https://pagure.io/freeipa/issue/8519 #8519] Fedora container
platform is incomplete
* [https://pagure.io/freeipa/issue/8524 #8524]
([https://bugzilla.redhat.com/show_bug.cgi?id=1851835 rhbz#1851835])
Deploy & manage the ACME service topology wide from a single system
* [https://pagure.io/freeipa/issue/8528 #8528] Use separate logs for
AD Trust and DNS installer
* [https://pagure.io/freeipa/issue/8584 #8584] ACME communication with
dogtag REST endpoints should be using the cookie it creates
* [https://pagure.io/freeipa/issue/8647 #8647]
([https://bugzilla.redhat.com/show_bug.cgi?id=1912556 rhbz#1912556])
Incorrect DNSKEY created when DNSSEC enabled for zone
* [https://pagure.io/freeipa/issue/8655 #8655]
([https://bugzilla.redhat.com/show_bug.cgi?id=1860129 rhbz#1860129])
Allow to establish trust to Active Directory in FIPS mode
* [https://pagure.io/freeipa/issue/8803 #8803] Add support for
managing IdP references
* [https://pagure.io/freeipa/issue/8804 #8804] Extend supported user
authentication methods in IPA to allow IdP auth
* [https://pagure.io/freeipa/issue/8805 #8805] Extend `ipa-otpd`
daemon to recognize IdP references
* [https://pagure.io/freeipa/issue/8832 #8832]
([https://bugzilla.redhat.com/show_bug.cgi?id=1957768 rhbz#1957768])
ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
* [https://pagure.io/freeipa/issue/8923 #8923]
([https://bugzilla.redhat.com/show_bug.cgi?id=1970168 rhbz#1970168])
Trust controller role should pull sssd-winbind-idmap package
* [https://pagure.io/freeipa/issue/8951 #8951] Test for RFE
ipa-healthcheck tool can include check to see if the system is FIPS
enabled or not
* [https://pagure.io/freeipa/issue/8972 #8972]
([https://bugzilla.redhat.com/show_bug.cgi?id=1998129 rhbz#1998129])
AVC denied { read } comm="ipa-custodia" on aarch64 during installation
of ipa-server
* [https://pagure.io/freeipa/issue/8984 #8984]
([https://bugzilla.redhat.com/show_bug.cgi?id=1999992 rhbz#1999992])
ipa migrate-ds command fails to warn when compat plugin is enabled
* [https://pagure.io/freeipa/issue/9062 #9062] [ipatests] SID
generation and test_xmlrpc/test_user_plugin.py
* [https://pagure.io/freeipa/issue/9127 #9127]
([https://bugzilla.redhat.com/show_bug.cgi?id=2062379 rhbz#2062379])
Use new getorigby{user|group}name() calls in extdom plugin
* [https://pagure.io/freeipa/issue/9150 #9150]
([https://bugzilla.redhat.com/show_bug.cgi?id=2063155 rhbz#2063155])
Remove 'Remove' button from subid page
* [https://pagure.io/freeipa/issue/9158 #9158] Internal error when
setting dnsconfig or dnsforwardzone forwarders.
* [https://pagure.io/freeipa/issue/9159 #9159]
([https://bugzilla.redhat.com/show_bug.cgi?id=2068088 rhbz#2068088])
[RFE] ipa-client-install should provide option to enable subid: sss in
/etc/nsswitch.conf
* [https://pagure.io/freeipa/issue/9160 #9160]
cryptography.utils.register_interface is scheduled for removal
* [https://pagure.io/freeipa/issue/9161 #9161] Nightly test failure in
test_selinuxusermap.py::test_selinuxusermap::test_misc
* [https://pagure.io/freeipa/issue/9178 #9178] idviews: use cached
ipaOriginalUid value when resolving ID override anchor
* [https://pagure.io/freeipa/issue/9183 #9183] Timeout issue in
test_installation.py when using interactive mode
* [https://pagure.io/freeipa/issue/9185 #9185] Fix missing parameter
for Suse ipaplatform task
* [https://pagure.io/freeipa/issue/9187 #9187]
([https://bugzilla.redhat.com/show_bug.cgi?id=2022028 rhbz#2022028])
[UX] Preserving a user account produces output saying it was deleted
* [https://pagure.io/freeipa/issue/9188 #9188]
([https://bugzilla.redhat.com/show_bug.cgi?id=2098187 rhbz#2098187])
Add warning for empty targetattr when creating ACI with RBAC
* [https://pagure.io/freeipa/issue/9189 #9189] ipatests: Fix
test_idp.py for downstream idm-ci
* [https://pagure.io/freeipa/issue/9190 #9190]
ipatests.test_ipaserver.test_secure_ajp_connector failing with python
3.6.8 with: TypeError: a bytes-like object is required, not 'str'
* [https://pagure.io/freeipa/issue/9192 #9192]
([https://bugzilla.redhat.com/show_bug.cgi?id=2094672 rhbz#2094672])
IdM WebUI Pagination Size should not allow empty value
* [https://pagure.io/freeipa/issue/9198 #9198] [Tracker] nightly
failure: after ipa trust-add, cred cache contains
cifs/master.ipa.test(a)IPA.TEST instead of admin principal
* [https://pagure.io/freeipa/issue/9204 #9204] [Tracker] In
ipa-server-upgrade ca_upgrade_schema() results in unnecessary pki
restarts
* [https://pagure.io/freeipa/issue/9206 #9206]
([https://bugzilla.redhat.com/show_bug.cgi?id=2109236 rhbz#2109236])
ldap bind occurs when admin user changes password with gracelimit=0
* [https://pagure.io/freeipa/issue/9207 #9207] Failure in
AzurePipeline.freeipa (GATING InstallDNSSECFirst_1_to_5)
* [https://pagure.io/freeipa/issue/9208 #9208] ap: Doc build fails
against Sphinx 5.1.0
* [https://pagure.io/freeipa/issue/9211 #9211]
([https://bugzilla.redhat.com/show_bug.cgi?id=2109243 rhbz#2109243])
RFE: Allow grace login limit to be set in IPA WebUI.
* [https://pagure.io/freeipa/issue/9212 #9212]
([https://bugzilla.redhat.com/show_bug.cgi?id=2115475 rhbz#2115475])
Nightly test failure in
test_user.py::test_user::test_password_expiration_notification
* [https://pagure.io/freeipa/issue/9214 #9214] Nightly failure in
webui test test_subid.py::test_subid::test_subid_range_deletion_not_allowed
* [https://pagure.io/freeipa/issue/9216 #9216] [Tracker] Nightly
failure: zone not signed
* [https://pagure.io/freeipa/issue/9218 #9218]
([https://bugzilla.redhat.com/show_bug.cgi?id=2116966 rhbz#2116966])
Random failure in test-winsyncmigrate
* [https://pagure.io/freeipa/issue/9225 #9225] pytest library module
rename from quarkus to keycloak
* [https://pagure.io/freeipa/issue/9226 #9226]
([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547])
Infinite redirect loop in the WebUI for user root
* [https://pagure.io/freeipa/issue/9228 #9228] ipa-client-install does
not maintain server affinity during installation
* [https://pagure.io/freeipa/issue/9230 #9230] build failure against gcc < 11
* [https://pagure.io/freeipa/issue/9231 #9231] /run/ipa/ccaches uses
all available tmpfs space
* [https://pagure.io/freeipa/issue/9237 #9237] Show order in sudo rule
list in web interface
* [https://pagure.io/freeipa/issue/9243 #9243]
([https://bugzilla.redhat.com/show_bug.cgi?id=2127833 rhbz#2127833])
Password Policy Grace login limit allows invalid maximum value
* [https://pagure.io/freeipa/issue/9245 #9245]
([https://bugzilla.redhat.com/show_bug.cgi?id=2117167 rhbz#2117167])
`extdom` plugin can return object from a wrong domain.
* [https://pagure.io/freeipa/issue/9246 #9246] Nightly test failure in
test_user_permissions.TestInstallClientNoAdmin
* [https://pagure.io/freeipa/issue/9248 #9248]
([https://bugzilla.redhat.com/show_bug.cgi?id=2124369 rhbz#2124369])
OTP token sync always returns OK even with random numbers
* [https://pagure.io/freeipa/issue/9249 #9249]
([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630])
Deprecated feature idnssoaserial in IdM appears when creating reverse
dns zones
* [https://pagure.io/freeipa/issue/9252 #9252]
([https://bugzilla.redhat.com/show_bug.cgi?id=2129895 rhbz#2129895])
[DDF] The Examples in the RHEL ipa(1) man page show "ipa help
commands" with content for "ipa halp topics" and "ipa hel
* [https://pagure.io/freeipa/issue/9254 #9254] Exclude installed
policy module file from RPM verification
* [https://pagure.io/freeipa/issue/9255 #9255] ipapython.dn_ctypes is
not compatible with libldap 2.6
* [https://pagure.io/freeipa/issue/9258 #9258]
([https://bugzilla.redhat.com/show_bug.cgi?id=2094673 rhbz#2094673])
Do not add TLS CA configuration to ldap.conf anymore
== Detailed changelog since 4.9.10 ==
=== Armando Neto (1) ===
* webui: Do not allow empty pagination size
[https://pagure.io/freeipa/c/991849cf58fa990ad4540a61214b5ab4fcd4baa1
commit] [https://pagure.io/freeipa/issue/9192 #9192]

=== Alexander Bokovoy (3) ===
* ipaclient: do not set TLS CA options in ldap.conf anymore
[https://pagure.io/freeipa/c/d9a56b51bbb350219d0f5cb0ea6b3cc00230d437
commit] [https://pagure.io/freeipa/issue/9258 #9258]
* fix canonicalization issue in Web UI
[https://pagure.io/freeipa/c/109cd579e3b089b7fad4c92bf25594eba1af8a21
commit] [https://pagure.io/freeipa/issue/9226 #9226]
* ipa-otpd: initialize local pointers and handle gcc 10
[https://pagure.io/freeipa/c/9290aa5500f752d0eedabdfc92c9fe6c0ee743b8
commit] [https://pagure.io/freeipa/issue/9230 #9230]

=== Anuja More (4) ===
* ipatests : Test query to AD specific attributes is successful.
[https://pagure.io/freeipa/c/21cb86a8e571ac7aa0304c57961881ca9c4aeacb
commit] [https://pagure.io/freeipa/issue/9127 #9127]
* ipatests: Fix install_master for test_idp.py
[https://pagure.io/freeipa/c/15f454f6f8d25275c9570e2cc3a97c4e030fc581
commit] [https://pagure.io/freeipa/issue/9189 #9189]
* ipatests: update prci definitions for test_idp.py
[https://pagure.io/freeipa/c/50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d
commit]
* Add end to end integration tests for external IdP
[https://pagure.io/freeipa/c/857713c5a9c8e0b62c06dd92e69c09eeb34b2e99
commit] [https://pagure.io/freeipa/issue/8803 #8803],
[https://pagure.io/freeipa/issue/8804 #8804],
[https://pagure.io/freeipa/issue/8805 #8805]

=== Antonio Torres (1) ===
* Back to git snapshots
[https://pagure.io/freeipa/c/3e90842b3d94268f2ccd42c8decd0eecbcf88f1f
commit]

=== Alexey Tikhonov (3) ===
* extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper()
returns object from a wrong domain (performance optimization)
[https://pagure.io/freeipa/c/a07cece0c006b3a89fc467284244f979d39f0209
commit]
* extdom: make sure result doesn't miss domain part
[https://pagure.io/freeipa/c/3de618f75416afd6c087c243fe35755739d229a4
commit] [https://pagure.io/freeipa/issue/9245 #9245]
* extdom: internal functions should be static
[https://pagure.io/freeipa/c/666357649f4dfb8254cb3707e97e12c69e6714f7
commit]

=== Carla Martinez (7) ===
* Update API and VERSION
[https://pagure.io/freeipa/c/856edcc8d3c9fe64eff532db669536a0a78ba70d
commit] [https://pagure.io/freeipa/issue/9249 #9249]
* webui: Set 'SOA serial' field as read-only
[https://pagure.io/freeipa/c/9f8c9a4d96877bab1cb474615d77aca2fa586ece
commit] [https://pagure.io/freeipa/issue/9249 #9249]
* ipatest: Remove warning message for 'idnssoaserial'
[https://pagure.io/freeipa/c/76604df09d8b62795f4e2d1fbc99af9ed55ec5cd
commit] [https://pagure.io/freeipa/issue/9249 #9249]
* Set 'idnssoaserial' to deprecated
[https://pagure.io/freeipa/c/e9048daac53e24759a33e2031c8b4224a80a0e54
commit] [https://pagure.io/freeipa/issue/9249 #9249]
* webui: Show 'Sudo order' column
[https://pagure.io/freeipa/c/0513a83a4fcd5626168cb45132af8cd1b4a9ee03
commit] [https://pagure.io/freeipa/issue/9237 #9237]
* Set pkeys in test_selinuxusermap.py::test_misc::delete_record
[https://pagure.io/freeipa/c/cefa8f1e5f5b01e6863d07e9f3849dfd4c485f22
commit] [https://pagure.io/freeipa/issue/9161 #9161]
* webui: Allow grace login limit
[https://pagure.io/freeipa/c/ade5093b08f92b279c200f341e96972a74f644d8
commit] [https://pagure.io/freeipa/issue/9211 #9211]

=== Jan Kuparinen (20) ===
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/841e0c673b222e686083cb96c210a55da6e09ff8
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/4d92e67a45b0caf72ce5028f8bbba06f4d63fb7f
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/e6accc7b3f39e0140e0d1dc3ee6bfcf6636d214d
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/20bcd69f38fb734dc80e5052cb2ed91c19b12994
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/49a41249e1d8cf6b349f895ba88c7490081ab462
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/20269ac630c451734dffef50298cba823ffe2624
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/1853d934d1e93dbf07d50799406ac12995a1d977
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/7037e5389006f1eeea0299918cbbae57893ef125
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/9df1672f479bee01efcd53c46e800e789762bc97
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/eb1a1f35849c1f2e43c282c555b62f7d12962e37
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/216cced00a1973f2103cf678ed94ef3b6c204190
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/e98691b491ae2a8d41c3eb6e7028f6e731dbdbae
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/4d306ee7ebe90275a47b4f182f66bc87bc397170
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/2203f3627f28ff4c81ab9fd24eed31669ae34ff5
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/15457a6d9fdb19466405f6882fbbc9e29510d40e
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/5dcb614691ed31a660edc936612b525b1be0ccae
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/c2061cf9c505c4821c7812a71c464afa367300b5
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/9d6d2e2dc9cfb7c1ef1e400ba90b27474866380f
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/6bdd02db7ace58cbb16d45d5c6dbfb1945e2bb43
commit]
* Added translation using Weblate (Finnish)
[https://pagure.io/freeipa/c/6169eb47e1ea42c81ad6022ab02ef3222566f70f
commit]

=== David Pascual (2) ===
* ipatest: fix prci checker target masked return code & add pylint
[https://pagure.io/freeipa/c/6483f33389c7bb1d185f2b39d68f407e131a282c
commit]
* ipatests: Checker script for prci definitions
[https://pagure.io/freeipa/c/f33266c2ba9d794a5a1e9994e5fa029d2fa5de70
commit]

=== Erik (1) ===
* ipatests: healthcheck: test if system is FIPS enabled
[https://pagure.io/freeipa/c/f962a0c2832619100046c923d15f21e8c10fce96
commit] [https://pagure.io/freeipa/issue/8951 #8951]

=== Florence Blanc-Renaud (11) ===
* Spec file: bump the selinux-policy version
[https://pagure.io/freeipa/c/58ad9f2eec0afe494c57015c4449ae39748117e4
commit] [https://pagure.io/freeipa/issue/9198 #9198]
* webui tests: fix test_subid suite
[https://pagure.io/freeipa/c/58e12bd93a9b7b1c9a39981ee0c6a724040e164f
commit] [https://pagure.io/freeipa/issue/9214 #9214]
* ipa man page: format the EXAMPLES section
[https://pagure.io/freeipa/c/64ef2b9c07ec0b1b316555739ff9f98229258838
commit] [https://pagure.io/freeipa/issue/9252 #9252]
* ipatests: add negative test for otptoken-sync
[https://pagure.io/freeipa/c/895a800e90a34f55f5d2789ece6e7bc8e6f5c0a6
commit] [https://pagure.io/freeipa/issue/9248 #9248]
* ipa otptoken-sync: return error when sync fails
[https://pagure.io/freeipa/c/4cc94cd3b929ee1878767d23f98ad5e755583c6b
commit] [https://pagure.io/freeipa/issue/9248 #9248]
* gitignore: add install/oddjob/org.freeipa.server.config-enable-sid
[https://pagure.io/freeipa/c/a7369944d8b68032eddcc4577b0cc5f9f603cda9
commit]
* ipatests: Fix expected object classes
[https://pagure.io/freeipa/c/2385d1d90aa91d34c4b36842a17e72aa2399a733
commit] [https://pagure.io/freeipa/issue/9062 #9062]
* check_repl_update: in progress is a boolean
[https://pagure.io/freeipa/c/05a298f56485222583cb7dd4f6a3a4c5c77fc8cf
commit] [https://pagure.io/freeipa/issue/9218 #9218]
* azure tests: disable TestInstallDNSSECFirst
[https://pagure.io/freeipa/c/d40fd287836dc8440f69314d77ccb461c7e6ccea
commit] [https://pagure.io/freeipa/issue/9216 #9216]
* xmlrpc tests: updated expected output for preserved user
[https://pagure.io/freeipa/c/4984ff210a169129e4e56b10e54e9c795520855c
commit] [https://pagure.io/freeipa/issue/9187 #9187]
* Preserve user: fix the confusing summary
[https://pagure.io/freeipa/c/ff4152539b96d309dcceaf854a3e0a49f435acff
commit] [https://pagure.io/freeipa/issue/9187 #9187]

=== Fraser Tweedale (2) ===
* install: suggest --skip-mem-check when mem check fails
[https://pagure.io/freeipa/c/cbf2614d8acc11a1b41558a45dac8ec98b032732
commit] [https://pagure.io/freeipa/issue/8404 #8404]
* man: add --skip-mem-check to man pages
[https://pagure.io/freeipa/c/585cebb1a9673e2fc083dd3c9545a6c080e171e3
commit] [https://pagure.io/freeipa/issue/8404 #8404]

=== Matthew Davis (1) ===
* Add missing parameter to Suse modify_nsswitch_pam_stack
[https://pagure.io/freeipa/c/4f15804270590fdf0f339fc53ed63bf440361b7b
commit] [https://pagure.io/freeipa/issue/9185 #9185]

=== Jesse Sandberg (1) ===
* Fix ipa-ccache-sweeper activation timer and clean up service file
[https://pagure.io/freeipa/c/358924455d87b67db6cd743f3cfe15522b4c0d91
commit] [https://pagure.io/freeipa/issue/9231 #9231]

=== Michal Polovka (3) ===
* ipatests: Healthcheck use subject base from IPA not REALM
[https://pagure.io/freeipa/c/afa94c7995f236c5eff516652f31c1a956466cf7
commit]
* ipatests: Healthcheck should ignore pki errors when CA is not
configured [https://pagure.io/freeipa/c/206e08d811c43ba8295816e609d4cb7148a774a3
commit]
* ipatests: Increase expect timeout for interactive mode
[https://pagure.io/freeipa/c/a6a6781284658e77f36c07cb7fd35b43240946a2
commit] [https://pagure.io/freeipa/issue/9183 #9183]

=== Marcin Stanclik (1) ===
* Translated using Weblate (Polish)
[https://pagure.io/freeipa/c/d198a35cb885b6cc1622bf99b8546675b98c8aed
commit]

=== Nikola Knazekova (1) ===
* Exclude installed policy module file from RPM verification
[https://pagure.io/freeipa/c/c977cefa101e145b13b5c19ae5369e5ca7ef1ef8
commit] [https://pagure.io/freeipa/issue/9254 #9254]

=== Piotr Drąg (1) ===
* Translated using Weblate (Polish)
[https://pagure.io/freeipa/c/3b0c1cafc16dc927449231a7a70b2876770ba962
commit]

=== Hela Basa (3) ===
* Added translation using Weblate (Korean)
[https://pagure.io/freeipa/c/0a6246ea971282a2f1fc0b5fe3f09f7d656bbf2f
commit]
* Translated using Weblate (Sinhala)
[https://pagure.io/freeipa/c/696a72f7aef3df7c0f619f0d67e5fe259cc80c37
commit]
* Added translation using Weblate (Sinhala)
[https://pagure.io/freeipa/c/f9590de2e0bc1d2dde4f6a78c72b6a69f773bd99
commit]

=== Rob Crittenden (11) ===
* Move client certificate request after krb5.conf is created
[https://pagure.io/freeipa/c/762d786bf7a3043fd56877949f02bccd077e2711
commit] [https://pagure.io/freeipa/issue/9246 #9246]
* Defer creating the final krb5.conf on clients
[https://pagure.io/freeipa/c/69413325158a3ea06d1491acd77ee6e0955ee89a
commit] [https://pagure.io/freeipa/issue/9228 #9228]
* Fix upper bound of password policy grace limit
[https://pagure.io/freeipa/c/91a02174a0a9694fd5611c071913ad4720be5ac9
commit] [https://pagure.io/freeipa/issue/9243 #9243]
* Set default on group pwpolicy with no grace limit in upgrade
[https://pagure.io/freeipa/c/a4ddaaf3048c4e8d78a1807af7266ee40ab3a30b
commit] [https://pagure.io/freeipa/issue/9212 #9212]
* Set default gracelimit on group password policies to -1
[https://pagure.io/freeipa/c/497a57e7a6872fa30d1855a1d91a455bfdbf9300
commit] [https://pagure.io/freeipa/issue/9212 #9212]
* doc: Update LDAP grace period design with default values
[https://pagure.io/freeipa/c/434620ee342ac4767beccec647a318bfa7743dfa
commit] [https://pagure.io/freeipa/issue/9212 #9212]
* upgrades: Don't restart the CA on ACME and profile schema change
[https://pagure.io/freeipa/c/aaf57185a2701b34948105e8b54075afe048ff18
commit] [https://pagure.io/freeipa/issue/9204 #9204]
* Disabling gracelimit does not prevent LDAP binds
[https://pagure.io/freeipa/c/1316cd8b2252c2543cf2ef2186956a8833037b1e
commit] [https://pagure.io/freeipa/issue/9206 #9206]
* Warn for permissions with read/write/search/compare and no attrs
[https://pagure.io/freeipa/c/b31631ad69f72fb42b5091375df8021580f8139a
commit] [https://pagure.io/freeipa/issue/9188 #9188]
* Only calculate LDAP password grace when the password is expired
[https://pagure.io/freeipa/c/3675bd1d7aca443832bb9bb2f521cc4d3a088aec
commit] [https://pagure.io/freeipa/issue/1539 #1539]
* Fix test_secure_ajp_connector.py failing with Python 3.6.8
[https://pagure.io/freeipa/c/de64d6724e028a1882c3a8be31c2752bebdd41fd
commit] [https://pagure.io/freeipa/issue/9190 #9190]

=== Ricky Tigg (4) ===
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/91b63fcae0a588fc174cf865b4e0135c8c0e48ec
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/e6451fe15acf406aa741d4eed296ab6eff7e9313
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/3392f31afe04e5b6b0d49d4e2f2906bc90b3643c
commit]
* Translated using Weblate (Finnish)
[https://pagure.io/freeipa/c/a8a2b2cf97bbf8b2b80acce08d0903b6c91c5f98
commit]

=== Sumit Bose (1) ===
* ipa-kdb: do not fail if certmap rule cannot be added
[https://pagure.io/freeipa/c/e51a0c927db4a4c9b3e1ab0c6dffca545532a2b4
commit]

=== 김인수 (44) ===
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/b8c39cca34b75a4ed3ed77a468836778f670027b
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/2c555646dd71911d1bcf860e6c3acbcfd3050ad2
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/53e4e7212b5b6fe0dceb809aaddc83158f8dfef4
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/29dba19aa8862ea7b3185dcc0dba789b8e4af5b8
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/425894153a17de0cdb827a83fad599343e2d3656
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/7f9588f36a2b82df3fd9ef7dd286886021e0ffa6
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/c07e0ec7a5acedef693b0f79fdc68529e64aa023
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/e6e638aea7fda83beb47fa6c2f75772673d351c2
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/994c43513950b4c82dd9e1ed38b56232f3efffaa
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/fd538803cf6c098b2a3386ecc1f4b1e3a27b9a88
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/aef749b632fd636e6d6b920757e13d64303da9d4
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/64b2c0ebfeb7035b8c9d9e38c2a75e046e855f62
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/a24adeab5ca162b3c79358128fcdee22d0bd18f2
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/b70041d904926e9d33423fe1f7b48ca0c3791718
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/246604ec696255674e8716610c387f0f2ef93d73
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/07a1cc5424760a4ef43ffc6734c901f1cc446909
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/e98e21709e2205c8c019cc7006d3f9ded94432ae
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/fe60d1f6f386734b7cb052f34fb798341130052a
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/5bd77e606cb6be3b3a133294027e284f5604b447
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/2c0924f38694603777bcbdab804d9b3331efa239
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/067cae55eced1c1c7bcdbbb0dd56a16d7127488c
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/aa00e7c3cff81e79a1dfce2c1e5348af9f3a3438
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/b5d6616aed77a46de2db53b3395aeaf531537df3
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/7ca1befe7e8ca463052f8b24f6c9b37093dabbaa
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/b2cf29ae168661a12a426bf72e98f43d769fb132
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/8b3ceace34a55fadb560a758c02632efa87ec96f
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/7d12b30e2c6762eda93eb66a1dab2e52770d94aa
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/20006cc713c7666c373804cd7d6415f9af6a6d27
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/9e2f7d041c1c72b329fdacac232451e57a4d0516
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/cf9f35e3eb2c90cb3b07a2c5ed33fdd2f3bfa0b3
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/d6ff8af62ee12517d438d9f3ff02f25219166da4
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/1e65336b3513cf7c6579ac5714c50cb4a965fd96
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/548afe9eed0696ceb4e8abdc3331b3f1f0fad6f2
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/715043df4ea1d416e64ce50b0e141faf36f6c45d
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/18346d99b214f6060ab7f6c83e02f2c4d56ec799
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/9658dbd3c31ad22e175e613f3c51073eb196c72c
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/27dba4a7c3605a1ab03c55458ad4bb47b7c4dbc7
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/d5726f04b6b73d6c1de183ee5b6b7bd96d590db5
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/eac046fd82d02105d3388af1f04527813546e6f7
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/77feee852ed01502c0a0e48d4d4e546332827885
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/00eba1f70445a5faf27db461fb762a030b0b5789
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/101460521cb228f68a52a934acf97eddcbbb9928
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/23fb8a4709af35db3e760159de405adad343c042
commit]
* Translated using Weblate (Korean)
[https://pagure.io/freeipa/c/fd81a77d78423293dee4e117b58f2f9077cb0cbf
commit]

=== Stanislav Levin (6) ===
* ipapython: Support openldap 2.6
[https://pagure.io/freeipa/c/7e93f46c589ba0a68c039d65ea3c0872644a0eb0
commit] [https://pagure.io/freeipa/issue/9255 #9255]
* x509: Replace removed register_interface with subclassing
[https://pagure.io/freeipa/c/89fe83b03ac3b046685389ee1059ca75c73e53b0
commit] [https://pagure.io/freeipa/issue/9160 #9160]
* ap: Constrain supported docutils
[https://pagure.io/freeipa/c/1ada42e3bce58a729e689377b1a41b6cfa90b508
commit] [https://pagure.io/freeipa/issue/9208 #9208]
* ap: Rearrange overloaded jobs
[https://pagure.io/freeipa/c/b59baf31bc097821ff7787ecd75affb27ea2a7c3
commit] [https://pagure.io/freeipa/issue/9207 #9207]
* ap: Disable azure's security daemon
[https://pagure.io/freeipa/c/98c6e96e8db3d5bdc0315094b8a7bf81d196479b
commit] [https://pagure.io/freeipa/issue/9207 #9207]
* ap: Raise dbus timeout
[https://pagure.io/freeipa/c/e77b0b08d78d4d5ae7632ef23aebc577848ea507
commit] [https://pagure.io/freeipa/issue/9207 #9207]

=== Scott Poore (1) ===
* ipatests: Rename create_quarkus to create_keycloak
[https://pagure.io/freeipa/c/88ea19b9a53d9c209105af049a1df100d07e081a
commit] [https://pagure.io/freeipa/issue/9225 #9225]

=== Sudhir Menon (2) ===
* ipatests: WebUI: do not allow subid range deletion
[https://pagure.io/freeipa/c/58b026716c973f422b1b98e27eb9536e59919d82
commit] [https://pagure.io/freeipa/issue/9150 #9150]
* ipatests: ipa-client-install --subid adds entry in nsswitch.conf
[https://pagure.io/freeipa/c/a5762621ef3ed1e699306a8d2eef634bc927a6fc
commit] [https://pagure.io/freeipa/issue/9159 #9159]

=== Timo Aaltonen (2) ===
* ipaplatform/debian: Drop the path for ldap.so
[https://pagure.io/freeipa/c/56c827099708d8613e194052857e121612fbd768
commit]
* ipaplatform/debian: Use multiarch path for libsofthsm2.so
[https://pagure.io/freeipa/c/c39c2ee80db056296f6826746b5b7a5bf7ba7cc4
commit]

=== Thomas Woerner (1) ===
* DNSResolver: Fix use of nameservers with ports
[https://pagure.io/freeipa/c/5e2e4664aec641886923c2bec61ce25b96edb62a
commit] [https://pagure.io/freeipa/issue/9158 #9158]

=== Yuri Chornoivan (3) ===
* Translated using Weblate (Ukrainian)
[https://pagure.io/freeipa/c/61dea74b405d251ea2778e209b03a167064b1bf6
commit]
* Translated using Weblate (Ukrainian)
[https://pagure.io/freeipa/c/842a6457fda382d78a11bce626b2ef0ef3749aa0
commit]
* Translated using Weblate (Ukrainian)
[https://pagure.io/freeipa/c/6353e45b5dd446b7acc46244d8bb10c38c39f9ce
commit]

[Florence Blanc-Renaud]

Hi Antonio,

the automation for the release notes seems to pick references to issues
fixed in previous releases already (maybe it's considering references to
pagure tickets even if they just mention Related instead of Fixes). I added
some inline comments for the ones I spotted, please see below

On Thu, Nov 3, 2022 at 12:04 PM Antonio Torres via FreeIPA-devel <
freeipa-devel(a)lists.fedorahosted.org&gt; wrote:

>  {{ReleaseDate|2022-11-03}}
>  The FreeIPA team would like to announce FreeIPA 4.9.11 release!
>
>  It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
>  for
>  Fedora distributions will be available from the official repository soon.
>
>  == Highlights in 4.9.11 ==
>
>  '''TODO RELEASE NOTES - put release notes (if any) to proper
> categories'''
>  * 1539: [RFE] Add code to check password expiration on ldap bind
>  :: User can no longer do LDAP BIND operation with expired password.
>  

>  --------
>  * 3226: [RFE] ipa sudorule-add-user should accept more types of characters
>  
Already fixed in a long time ago.


>  --------
>  * 8361: Add support for managing subuids and subgids in FreeIPA
>  :: IPA is now able to centrally store ID sub-ranges for users/groups.
>  More details can be found in the design document:
>  https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html 
Already fixed in 4.9.9


>  --------
>  * 8404: Detect and fail if not enough memory is available for installation
>  :: FreeIPA server now requires at least 1.2 GiB RAM for installation
>  to prevent performance degradation.
>  
In the new update, we updated the man page to mention the option
--skip-mem-check, but the option was also provided with 4.9.2. This one can
be removed.


>  --------
>  * 8528: Use separate logs for AD Trust and DNS installer
>  :: ipa-adtrust-install and ipa-dns-install commands now log their
>  activity into separate log files.
>  
Already fixed in 4.9.0


>  --------
>  * 8655: Allow to establish trust to Active Directory in FIPS mode
>  :: When IPA is deployed in FIPS mode, it is now possible to establish
>  trust to Active Directory forest.
>  
Already fixed in 4.9.1


>  --------
>  * 8803: Add support for managing IdP references
>  :: FreeIPA can now authenticate users with the help of OAuth 2.0
>  identity providers supporting OAuth 2.0 Device Authorization Flow.
>  IdPs known to work are Keycloak, Microsoft Azure, Google, Github, and
>  Okta. Details on how to use Keycloak can be found in FreeIPA workshop:
>
>  https://freeipa.readthedocs.io/en/latest/workshop/12-external-idp-support... 
Already in 4.9.10. 4.9.11 just adds tests.


>  --------
>  * 9150: Remove 'Remove' button from subid page
>  :: subid ranges cannot be removed. A button in Web UI subid management
>  page to remove the range was removed to not confuse users
>  
Already in 4.9.10. 4.9.11 just adds a test.


>  --------
>  * 9159: [RFE] ipa-client-install should provide option to enable
>  subid: sss in /etc/nsswitch.conf
>  :: IPA installers now provide the ability to configure SSSD as
>  datasource for subid
>  
already in 4.9.10, 4.9.11 just adds a test


>  --------
>  * 9187: [UX] Preserving a user account produces output saying it was
>  deleted
>  :: Previously, the command to preserve a user account used to display
>  a confusing output "Deleted user: <user>" although the user was
>  preserved and not deleted. The command now displays "Preserved user:
>  <user>" for preserved users.
>  --------
>  * 9228: ipa-client-install does not maintain server affinity during
>  installation
>  :: ipa-client-install will use a single server for the duration of the
>  installation process, either one discovered or provided on the
>  command-line. Previously it would use a temporary configuration to do
>  enrollment, then switch to a final one for the remaining operations.
>  This could lead to the installer talking with multiple servers. If the
>  client installer is faster than replication this could lead to errors.
>  --------
>  * 9237: Show order in sudo rule list in web interface
>  :: In the 'sudo rules' page, the WebUI is now displaying a 'sudo
>  order' column so that the users can easily see which rules override
>  other rules based on their order.
>  --------
>  * 9258: Do not add TLS CA configuration to ldap.conf anymore
>  :: FreeIPA client installer does not add explicit TLS CA configuration
>  to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA
>  configuration is not required as OpenLDAP uses the default CA store
>  provided by OpenSSL and IPA CA is installed in the default store by
>  the installer already.
>  --------
>  '''END TODO'''
>
>  === Enhancements ===
>  * 8361: Add support for managing subuids and subgids in FreeIPA
>  :: IPA is now able to centrally store ID sub-ranges for users/groups.
>  More details can be found in the design document:
>  https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html
>  --------
>  
to be removed


>  === Known Issues ===
>
>
>  === Bug fixes ===
>  FreeIPA 4.9.11 is a stabilization release for the features delivered as a
>  part of 4.9 version series.
>
>  There are more than 50 bug-fixes since FreeIPA 4.9.10 release.
>  Details of the bug-fixes can be seen in the list of resolved tickets below.
>
>  == Upgrading ==
>  Upgrade instructions are available on [[Upgrade]] page.
>
>  == Feedback ==
>  Please provide comments, bugs and other feedback via the freeipa-users
>  mailing
>  list (
>  https://lists.fedoraproject.org/archives/list/[e-mail]...
>  )
>  or #freeipa channel on libera.chat.
>
>
>  == Resolved tickets ==
>  * [https://pagure.io/freeipa/issue/1539 #1539]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=782917 rhbz#782917])
>  [RFE] Add code to check password expiration on ldap bind
>  * [https://pagure.io/freeipa/issue/3226 #3226]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=871208 rhbz#871208])
>  [RFE] ipa sudorule-add-user should accept more types of characters
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8361 #8361] Add support for
>  managing subuids and subgids in FreeIPA
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8404 #8404] Detect and fail if
> not
>  enough memory is available for installation
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8452 #8452] update samba
>  configuration on IPA master to explicitly use 'server role' setting
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8501 #8501] Unify how FreeIPA
> gets
>  FQDN of current host
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8519 #8519] Fedora container
>  platform is incomplete
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8524 #8524]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1851835 rhbz#1851835])
>  Deploy & manage the ACME service topology wide from a single system
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8528 #8528] Use separate logs for
>  AD Trust and DNS installer
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8584 #8584] ACME communication
> with
>  dogtag REST endpoints should be using the cookie it creates
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8647 #8647]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1912556 rhbz#1912556])
>  Incorrect DNSKEY created when DNSSEC enabled for zone
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8655 #8655]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1860129 rhbz#1860129])
>  Allow to establish trust to Active Directory in FIPS mode
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8803 #8803] Add support for
>  managing IdP references
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8804 #8804] Extend supported user
>  authentication methods in IPA to allow IdP auth
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8805 #8805] Extend `ipa-otpd`
>  daemon to recognize IdP references
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8832 #8832]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1957768 rhbz#1957768])
>  ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8923 #8923]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1970168 rhbz#1970168])
>  Trust controller role should pull sssd-winbind-idmap package
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8951 #8951] Test for RFE
>  ipa-healthcheck tool can include check to see if the system is FIPS
>  enabled or not
>  * [https://pagure.io/freeipa/issue/8972 #8972]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1998129 rhbz#1998129])
>  AVC denied { read } comm="ipa-custodia" on aarch64 during installation
>  of ipa-server
>  
to be removed


>  * [https://pagure.io/freeipa/issue/8984 #8984]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=1999992 rhbz#1999992])
>  ipa migrate-ds command fails to warn when compat plugin is enabled
>  
to be removed


>  * [https://pagure.io/freeipa/issue/9062 #9062] [ipatests] SID
>  generation and test_xmlrpc/test_user_plugin.py
>  * [https://pagure.io/freeipa/issue/9127 #9127]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2062379 rhbz#2062379])
>  Use new getorigby{user|group}name() calls in extdom plugin
>  
to be removed


>  * [https://pagure.io/freeipa/issue/9150 #9150]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2063155 rhbz#2063155])
>  Remove 'Remove' button from subid page
>  
to be removed


>  * [https://pagure.io/freeipa/issue/9158 #9158] Internal error when
>  setting dnsconfig or dnsforwardzone forwarders.
>  * [https://pagure.io/freeipa/issue/9159 #9159]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2068088 rhbz#2068088])
>  [RFE] ipa-client-install should provide option to enable subid: sss in
>  /etc/nsswitch.conf
>  
to be removed


>  * [https://pagure.io/freeipa/issue/9160 #9160]
>  cryptography.utils.register_interface is scheduled for removal
>  * [https://pagure.io/freeipa/issue/9161 #9161] Nightly test failure in
>  test_selinuxusermap.py::test_selinuxusermap::test_misc
>  * [https://pagure.io/freeipa/issue/9178 #9178] idviews: use cached
>  ipaOriginalUid value when resolving ID override anchor
>  
to be removed


>  * [https://pagure.io/freeipa/issue/9183 #9183] Timeout issue in
>  test_installation.py when using interactive mode
>  * [https://pagure.io/freeipa/issue/9185 #9185] Fix missing parameter
>  for Suse ipaplatform task
>  * [https://pagure.io/freeipa/issue/9187 #9187]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2022028 rhbz#2022028])
>  [UX] Preserving a user account produces output saying it was deleted
>  * [https://pagure.io/freeipa/issue/9188 #9188]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2098187 rhbz#2098187])
>  Add warning for empty targetattr when creating ACI with RBAC
>  * [https://pagure.io/freeipa/issue/9189 #9189] ipatests: Fix
>  test_idp.py for downstream idm-ci
>  * [https://pagure.io/freeipa/issue/9190 #9190]
>  ipatests.test_ipaserver.test_secure_ajp_connector failing with python
>  3.6.8 with: TypeError: a bytes-like object is required, not 'str'
>  * [https://pagure.io/freeipa/issue/9192 #9192]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2094672 rhbz#2094672])
>  IdM WebUI Pagination Size should not allow empty value
>  * [https://pagure.io/freeipa/issue/9198 #9198] [Tracker] nightly
>  failure: after ipa trust-add, cred cache contains
>  cifs/master.ipa.test(a)IPA.TEST instead of admin principal
>  * [https://pagure.io/freeipa/issue/9204 #9204] [Tracker] In
>  ipa-server-upgrade ca_upgrade_schema() results in unnecessary pki
>  restarts
>  * [https://pagure.io/freeipa/issue/9206 #9206]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2109236 rhbz#2109236])
>  ldap bind occurs when admin user changes password with gracelimit=0
>  * [https://pagure.io/freeipa/issue/9207 #9207] Failure in
>  AzurePipeline.freeipa (GATING InstallDNSSECFirst_1_to_5)
>  * [https://pagure.io/freeipa/issue/9208 #9208] ap: Doc build fails
>  against Sphinx 5.1.0
>  * [https://pagure.io/freeipa/issue/9211 #9211]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2109243 rhbz#2109243])
>  RFE: Allow grace login limit to be set in IPA WebUI.
>  * [https://pagure.io/freeipa/issue/9212 #9212]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2115475 rhbz#2115475])
>  Nightly test failure in
>  test_user.py::test_user::test_password_expiration_notification
>  * [https://pagure.io/freeipa/issue/9214 #9214] Nightly failure in
>  webui test test_subid.py::test_subid::test_subid_range_deletion_not_allowed
>  * [https://pagure.io/freeipa/issue/9216 #9216] [Tracker] Nightly
>  failure: zone not signed
>  
to be removed

flo

* [https://pagure.io/freeipa/issue/9218 #9218]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2116966 rhbz#2116966])
>  Random failure in test-winsyncmigrate
>  * [https://pagure.io/freeipa/issue/9225 #9225] pytest library module
>  rename from quarkus to keycloak
>  * [https://pagure.io/freeipa/issue/9226 #9226]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547])
>  Infinite redirect loop in the WebUI for user root
>  * [https://pagure.io/freeipa/issue/9228 #9228] ipa-client-install does
>  not maintain server affinity during installation
>  * [https://pagure.io/freeipa/issue/9230 #9230] build failure against gcc
>  < 11
>  * [https://pagure.io/freeipa/issue/9231 #9231] /run/ipa/ccaches uses
>  all available tmpfs space
>  * [https://pagure.io/freeipa/issue/9237 #9237] Show order in sudo rule
>  list in web interface
>  * [https://pagure.io/freeipa/issue/9243 #9243]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2127833 rhbz#2127833])
>  Password Policy Grace login limit allows invalid maximum value
>  * [https://pagure.io/freeipa/issue/9245 #9245]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2117167 rhbz#2117167])
>  `extdom` plugin can return object from a wrong domain.
>  * [https://pagure.io/freeipa/issue/9246 #9246] Nightly test failure in
>  test_user_permissions.TestInstallClientNoAdmin
>  * [https://pagure.io/freeipa/issue/9248 #9248]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2124369 rhbz#2124369])
>  OTP token sync always returns OK even with random numbers
>  * [https://pagure.io/freeipa/issue/9249 #9249]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630])
>  Deprecated feature idnssoaserial in IdM appears when creating reverse
>  dns zones
>  * [https://pagure.io/freeipa/issue/9252 #9252]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2129895 rhbz#2129895])
>  [DDF] The Examples in the RHEL ipa(1) man page show "ipa help
>  commands" with content for "ipa halp topics" and "ipa hel
>  * [https://pagure.io/freeipa/issue/9254 #9254] Exclude installed
>  policy module file from RPM verification
>  * [https://pagure.io/freeipa/issue/9255 #9255] ipapython.dn_ctypes is
>  not compatible with libldap 2.6
>  * [https://pagure.io/freeipa/issue/9258 #9258]
>  ([https://bugzilla.redhat.com/show_bug.cgi?id=2094673 rhbz#2094673])
>  Do not add TLS CA configuration to ldap.conf anymore
>  == Detailed changelog since 4.9.10 ==
>  === Armando Neto (1) ===
>  * webui: Do not allow empty pagination size
>  [https://pagure.io/freeipa/c/991849cf58fa990ad4540a61214b5ab4fcd4baa1
>  commit] [https://pagure.io/freeipa/issue/9192 #9192]
>
>  === Alexander Bokovoy (3) ===
>  * ipaclient: do not set TLS CA options in ldap.conf anymore
>  [https://pagure.io/freeipa/c/d9a56b51bbb350219d0f5cb0ea6b3cc00230d437
>  commit] [https://pagure.io/freeipa/issue/9258 #9258]
>  * fix canonicalization issue in Web UI
>  [https://pagure.io/freeipa/c/109cd579e3b089b7fad4c92bf25594eba1af8a21
>  commit] [https://pagure.io/freeipa/issue/9226 #9226]
>  * ipa-otpd: initialize local pointers and handle gcc 10
>  [https://pagure.io/freeipa/c/9290aa5500f752d0eedabdfc92c9fe6c0ee743b8
>  commit] [https://pagure.io/freeipa/issue/9230 #9230]
>
>  === Anuja More (4) ===
>  * ipatests : Test query to AD specific attributes is successful.
>  [https://pagure.io/freeipa/c/21cb86a8e571ac7aa0304c57961881ca9c4aeacb
>  commit] [https://pagure.io/freeipa/issue/9127 #9127]
>  * ipatests: Fix install_master for test_idp.py
>  [https://pagure.io/freeipa/c/15f454f6f8d25275c9570e2cc3a97c4e030fc581
>  commit] [https://pagure.io/freeipa/issue/9189 #9189]
>  * ipatests: update prci definitions for test_idp.py
>  [https://pagure.io/freeipa/c/50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d
>  commit]
>  * Add end to end integration tests for external IdP
>  [https://pagure.io/freeipa/c/857713c5a9c8e0b62c06dd92e69c09eeb34b2e99
>  commit] [https://pagure.io/freeipa/issue/8803 #8803],
>  [https://pagure.io/freeipa/issue/8804 #8804],
>  [https://pagure.io/freeipa/issue/8805 #8805]
>
>  === Antonio Torres (1) ===
>  * Back to git snapshots
>  [https://pagure.io/freeipa/c/3e90842b3d94268f2ccd42c8decd0eecbcf88f1f
>  commit]
>
>  === Alexey Tikhonov (3) ===
>  * extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper()
>  returns object from a wrong domain (performance optimization)
>  [https://pagure.io/freeipa/c/a07cece0c006b3a89fc467284244f979d39f0209
>  commit]
>  * extdom: make sure result doesn't miss domain part
>  [https://pagure.io/freeipa/c/3de618f75416afd6c087c243fe35755739d229a4
>  commit] [https://pagure.io/freeipa/issue/9245 #9245]
>  * extdom: internal functions should be static
>  [https://pagure.io/freeipa/c/666357649f4dfb8254cb3707e97e12c69e6714f7
>  commit]
>
>  === Carla Martinez (7) ===
>  * Update API and VERSION
>  [https://pagure.io/freeipa/c/856edcc8d3c9fe64eff532db669536a0a78ba70d
>  commit] [https://pagure.io/freeipa/issue/9249 #9249]
>  * webui: Set 'SOA serial' field as read-only
>  [https://pagure.io/freeipa/c/9f8c9a4d96877bab1cb474615d77aca2fa586ece
>  commit] [https://pagure.io/freeipa/issue/9249 #9249]
>  * ipatest: Remove warning message for 'idnssoaserial'
>  [https://pagure.io/freeipa/c/76604df09d8b62795f4e2d1fbc99af9ed55ec5cd
>  commit] [https://pagure.io/freeipa/issue/9249 #9249]
>  * Set 'idnssoaserial' to deprecated
>  [https://pagure.io/freeipa/c/e9048daac53e24759a33e2031c8b4224a80a0e54
>  commit] [https://pagure.io/freeipa/issue/9249 #9249]
>  * webui: Show 'Sudo order' column
>  [https://pagure.io/freeipa/c/0513a83a4fcd5626168cb45132af8cd1b4a9ee03
>  commit] [https://pagure.io/freeipa/issue/9237 #9237]
>  * Set pkeys in test_selinuxusermap.py::test_misc::delete_record
>  [https://pagure.io/freeipa/c/cefa8f1e5f5b01e6863d07e9f3849dfd4c485f22
>  commit] [https://pagure.io/freeipa/issue/9161 #9161]
>  * webui: Allow grace login limit
>  [https://pagure.io/freeipa/c/ade5093b08f92b279c200f341e96972a74f644d8
>  commit] [https://pagure.io/freeipa/issue/9211 #9211]
>
>  === Jan Kuparinen (20) ===
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/841e0c673b222e686083cb96c210a55da6e09ff8
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/4d92e67a45b0caf72ce5028f8bbba06f4d63fb7f
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/e6accc7b3f39e0140e0d1dc3ee6bfcf6636d214d
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/20bcd69f38fb734dc80e5052cb2ed91c19b12994
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/49a41249e1d8cf6b349f895ba88c7490081ab462
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/20269ac630c451734dffef50298cba823ffe2624
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/1853d934d1e93dbf07d50799406ac12995a1d977
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/7037e5389006f1eeea0299918cbbae57893ef125
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/9df1672f479bee01efcd53c46e800e789762bc97
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/eb1a1f35849c1f2e43c282c555b62f7d12962e37
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/216cced00a1973f2103cf678ed94ef3b6c204190
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/e98691b491ae2a8d41c3eb6e7028f6e731dbdbae
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/4d306ee7ebe90275a47b4f182f66bc87bc397170
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/2203f3627f28ff4c81ab9fd24eed31669ae34ff5
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/15457a6d9fdb19466405f6882fbbc9e29510d40e
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/5dcb614691ed31a660edc936612b525b1be0ccae
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/c2061cf9c505c4821c7812a71c464afa367300b5
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/9d6d2e2dc9cfb7c1ef1e400ba90b27474866380f
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/6bdd02db7ace58cbb16d45d5c6dbfb1945e2bb43
>  commit]
>  * Added translation using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/6169eb47e1ea42c81ad6022ab02ef3222566f70f
>  commit]
>
>  === David Pascual (2) ===
>  * ipatest: fix prci checker target masked return code & add pylint
>  [https://pagure.io/freeipa/c/6483f33389c7bb1d185f2b39d68f407e131a282c
>  commit]
>  * ipatests: Checker script for prci definitions
>  [https://pagure.io/freeipa/c/f33266c2ba9d794a5a1e9994e5fa029d2fa5de70
>  commit]
>
>  === Erik (1) ===
>  * ipatests: healthcheck: test if system is FIPS enabled
>  [https://pagure.io/freeipa/c/f962a0c2832619100046c923d15f21e8c10fce96
>  commit] [https://pagure.io/freeipa/issue/8951 #8951]
>
>  === Florence Blanc-Renaud (11) ===
>  * Spec file: bump the selinux-policy version
>  [https://pagure.io/freeipa/c/58ad9f2eec0afe494c57015c4449ae39748117e4
>  commit] [https://pagure.io/freeipa/issue/9198 #9198]
>  * webui tests: fix test_subid suite
>  [https://pagure.io/freeipa/c/58e12bd93a9b7b1c9a39981ee0c6a724040e164f
>  commit] [https://pagure.io/freeipa/issue/9214 #9214]
>  * ipa man page: format the EXAMPLES section
>  [https://pagure.io/freeipa/c/64ef2b9c07ec0b1b316555739ff9f98229258838
>  commit] [https://pagure.io/freeipa/issue/9252 #9252]
>  * ipatests: add negative test for otptoken-sync
>  [https://pagure.io/freeipa/c/895a800e90a34f55f5d2789ece6e7bc8e6f5c0a6
>  commit] [https://pagure.io/freeipa/issue/9248 #9248]
>  * ipa otptoken-sync: return error when sync fails
>  [https://pagure.io/freeipa/c/4cc94cd3b929ee1878767d23f98ad5e755583c6b
>  commit] [https://pagure.io/freeipa/issue/9248 #9248]
>  * gitignore: add install/oddjob/org.freeipa.server.config-enable-sid
>  [https://pagure.io/freeipa/c/a7369944d8b68032eddcc4577b0cc5f9f603cda9
>  commit]
>  * ipatests: Fix expected object classes
>  [https://pagure.io/freeipa/c/2385d1d90aa91d34c4b36842a17e72aa2399a733
>  commit] [https://pagure.io/freeipa/issue/9062 #9062]
>  * check_repl_update: in progress is a boolean
>  [https://pagure.io/freeipa/c/05a298f56485222583cb7dd4f6a3a4c5c77fc8cf
>  commit] [https://pagure.io/freeipa/issue/9218 #9218]
>  * azure tests: disable TestInstallDNSSECFirst
>  [https://pagure.io/freeipa/c/d40fd287836dc8440f69314d77ccb461c7e6ccea
>  commit] [https://pagure.io/freeipa/issue/9216 #9216]
>  * xmlrpc tests: updated expected output for preserved user
>  [https://pagure.io/freeipa/c/4984ff210a169129e4e56b10e54e9c795520855c
>  commit] [https://pagure.io/freeipa/issue/9187 #9187]
>  * Preserve user: fix the confusing summary
>  [https://pagure.io/freeipa/c/ff4152539b96d309dcceaf854a3e0a49f435acff
>  commit] [https://pagure.io/freeipa/issue/9187 #9187]
>
>  === Fraser Tweedale (2) ===
>  * install: suggest --skip-mem-check when mem check fails
>  [https://pagure.io/freeipa/c/cbf2614d8acc11a1b41558a45dac8ec98b032732
>  commit] [https://pagure.io/freeipa/issue/8404 #8404]
>  * man: add --skip-mem-check to man pages
>  [https://pagure.io/freeipa/c/585cebb1a9673e2fc083dd3c9545a6c080e171e3
>  commit] [https://pagure.io/freeipa/issue/8404 #8404]
>
>  === Matthew Davis (1) ===
>  * Add missing parameter to Suse modify_nsswitch_pam_stack
>  [https://pagure.io/freeipa/c/4f15804270590fdf0f339fc53ed63bf440361b7b
>  commit] [https://pagure.io/freeipa/issue/9185 #9185]
>
>  === Jesse Sandberg (1) ===
>  * Fix ipa-ccache-sweeper activation timer and clean up service file
>  [https://pagure.io/freeipa/c/358924455d87b67db6cd743f3cfe15522b4c0d91
>  commit] [https://pagure.io/freeipa/issue/9231 #9231]
>
>  === Michal Polovka (3) ===
>  * ipatests: Healthcheck use subject base from IPA not REALM
>  [https://pagure.io/freeipa/c/afa94c7995f236c5eff516652f31c1a956466cf7
>  commit]
>  * ipatests: Healthcheck should ignore pki errors when CA is not
>  configured [
>  https://pagure.io/freeipa/c/206e08d811c43ba8295816e609d4cb7148a774a3
>  commit]
>  * ipatests: Increase expect timeout for interactive mode
>  [https://pagure.io/freeipa/c/a6a6781284658e77f36c07cb7fd35b43240946a2
>  commit] [https://pagure.io/freeipa/issue/9183 #9183]
>
>  === Marcin Stanclik (1) ===
>  * Translated using Weblate (Polish)
>  [https://pagure.io/freeipa/c/d198a35cb885b6cc1622bf99b8546675b98c8aed
>  commit]
>
>  === Nikola Knazekova (1) ===
>  * Exclude installed policy module file from RPM verification
>  [https://pagure.io/freeipa/c/c977cefa101e145b13b5c19ae5369e5ca7ef1ef8
>  commit] [https://pagure.io/freeipa/issue/9254 #9254]
>
>  === Piotr Drąg (1) ===
>  * Translated using Weblate (Polish)
>  [https://pagure.io/freeipa/c/3b0c1cafc16dc927449231a7a70b2876770ba962
>  commit]
>
>  === Hela Basa (3) ===
>  * Added translation using Weblate (Korean)
>  [https://pagure.io/freeipa/c/0a6246ea971282a2f1fc0b5fe3f09f7d656bbf2f
>  commit]
>  * Translated using Weblate (Sinhala)
>  [https://pagure.io/freeipa/c/696a72f7aef3df7c0f619f0d67e5fe259cc80c37
>  commit]
>  * Added translation using Weblate (Sinhala)
>  [https://pagure.io/freeipa/c/f9590de2e0bc1d2dde4f6a78c72b6a69f773bd99
>  commit]
>
>  === Rob Crittenden (11) ===
>  * Move client certificate request after krb5.conf is created
>  [https://pagure.io/freeipa/c/762d786bf7a3043fd56877949f02bccd077e2711
>  commit] [https://pagure.io/freeipa/issue/9246 #9246]
>  * Defer creating the final krb5.conf on clients
>  [https://pagure.io/freeipa/c/69413325158a3ea06d1491acd77ee6e0955ee89a
>  commit] [https://pagure.io/freeipa/issue/9228 #9228]
>  * Fix upper bound of password policy grace limit
>  [https://pagure.io/freeipa/c/91a02174a0a9694fd5611c071913ad4720be5ac9
>  commit] [https://pagure.io/freeipa/issue/9243 #9243]
>  * Set default on group pwpolicy with no grace limit in upgrade
>  [https://pagure.io/freeipa/c/a4ddaaf3048c4e8d78a1807af7266ee40ab3a30b
>  commit] [https://pagure.io/freeipa/issue/9212 #9212]
>  * Set default gracelimit on group password policies to -1
>  [https://pagure.io/freeipa/c/497a57e7a6872fa30d1855a1d91a455bfdbf9300
>  commit] [https://pagure.io/freeipa/issue/9212 #9212]
>  * doc: Update LDAP grace period design with default values
>  [https://pagure.io/freeipa/c/434620ee342ac4767beccec647a318bfa7743dfa
>  commit] [https://pagure.io/freeipa/issue/9212 #9212]
>  * upgrades: Don't restart the CA on ACME and profile schema change
>  [https://pagure.io/freeipa/c/aaf57185a2701b34948105e8b54075afe048ff18
>  commit] [https://pagure.io/freeipa/issue/9204 #9204]
>  * Disabling gracelimit does not prevent LDAP binds
>  [https://pagure.io/freeipa/c/1316cd8b2252c2543cf2ef2186956a8833037b1e
>  commit] [https://pagure.io/freeipa/issue/9206 #9206]
>  * Warn for permissions with read/write/search/compare and no attrs
>  [https://pagure.io/freeipa/c/b31631ad69f72fb42b5091375df8021580f8139a
>  commit] [https://pagure.io/freeipa/issue/9188 #9188]
>  * Only calculate LDAP password grace when the password is expired
>  [https://pagure.io/freeipa/c/3675bd1d7aca443832bb9bb2f521cc4d3a088aec
>  commit] [https://pagure.io/freeipa/issue/1539 #1539]
>  * Fix test_secure_ajp_connector.py failing with Python 3.6.8
>  [https://pagure.io/freeipa/c/de64d6724e028a1882c3a8be31c2752bebdd41fd
>  commit] [https://pagure.io/freeipa/issue/9190 #9190]
>
>  === Ricky Tigg (4) ===
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/91b63fcae0a588fc174cf865b4e0135c8c0e48ec
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/e6451fe15acf406aa741d4eed296ab6eff7e9313
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/3392f31afe04e5b6b0d49d4e2f2906bc90b3643c
>  commit]
>  * Translated using Weblate (Finnish)
>  [https://pagure.io/freeipa/c/a8a2b2cf97bbf8b2b80acce08d0903b6c91c5f98
>  commit]
>
>  === Sumit Bose (1) ===
>  * ipa-kdb: do not fail if certmap rule cannot be added
>  [https://pagure.io/freeipa/c/e51a0c927db4a4c9b3e1ab0c6dffca545532a2b4
>  commit]
>
>  === 김인수 (44) ===
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/b8c39cca34b75a4ed3ed77a468836778f670027b
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/2c555646dd71911d1bcf860e6c3acbcfd3050ad2
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/53e4e7212b5b6fe0dceb809aaddc83158f8dfef4
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/29dba19aa8862ea7b3185dcc0dba789b8e4af5b8
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/425894153a17de0cdb827a83fad599343e2d3656
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/7f9588f36a2b82df3fd9ef7dd286886021e0ffa6
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/c07e0ec7a5acedef693b0f79fdc68529e64aa023
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/e6e638aea7fda83beb47fa6c2f75772673d351c2
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/994c43513950b4c82dd9e1ed38b56232f3efffaa
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/fd538803cf6c098b2a3386ecc1f4b1e3a27b9a88
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/aef749b632fd636e6d6b920757e13d64303da9d4
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/64b2c0ebfeb7035b8c9d9e38c2a75e046e855f62
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/a24adeab5ca162b3c79358128fcdee22d0bd18f2
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/b70041d904926e9d33423fe1f7b48ca0c3791718
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/246604ec696255674e8716610c387f0f2ef93d73
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/07a1cc5424760a4ef43ffc6734c901f1cc446909
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/e98e21709e2205c8c019cc7006d3f9ded94432ae
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/fe60d1f6f386734b7cb052f34fb798341130052a
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/5bd77e606cb6be3b3a133294027e284f5604b447
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/2c0924f38694603777bcbdab804d9b3331efa239
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/067cae55eced1c1c7bcdbbb0dd56a16d7127488c
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/aa00e7c3cff81e79a1dfce2c1e5348af9f3a3438
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/b5d6616aed77a46de2db53b3395aeaf531537df3
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/7ca1befe7e8ca463052f8b24f6c9b37093dabbaa
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/b2cf29ae168661a12a426bf72e98f43d769fb132
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/8b3ceace34a55fadb560a758c02632efa87ec96f
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/7d12b30e2c6762eda93eb66a1dab2e52770d94aa
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/20006cc713c7666c373804cd7d6415f9af6a6d27
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/9e2f7d041c1c72b329fdacac232451e57a4d0516
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/cf9f35e3eb2c90cb3b07a2c5ed33fdd2f3bfa0b3
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/d6ff8af62ee12517d438d9f3ff02f25219166da4
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/1e65336b3513cf7c6579ac5714c50cb4a965fd96
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/548afe9eed0696ceb4e8abdc3331b3f1f0fad6f2
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/715043df4ea1d416e64ce50b0e141faf36f6c45d
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/18346d99b214f6060ab7f6c83e02f2c4d56ec799
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/9658dbd3c31ad22e175e613f3c51073eb196c72c
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/27dba4a7c3605a1ab03c55458ad4bb47b7c4dbc7
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/d5726f04b6b73d6c1de183ee5b6b7bd96d590db5
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/eac046fd82d02105d3388af1f04527813546e6f7
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/77feee852ed01502c0a0e48d4d4e546332827885
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/00eba1f70445a5faf27db461fb762a030b0b5789
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/101460521cb228f68a52a934acf97eddcbbb9928
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/23fb8a4709af35db3e760159de405adad343c042
>  commit]
>  * Translated using Weblate (Korean)
>  [https://pagure.io/freeipa/c/fd81a77d78423293dee4e117b58f2f9077cb0cbf
>  commit]
>
>  === Stanislav Levin (6) ===
>  * ipapython: Support openldap 2.6
>  [https://pagure.io/freeipa/c/7e93f46c589ba0a68c039d65ea3c0872644a0eb0
>  commit] [https://pagure.io/freeipa/issue/9255 #9255]
>  * x509: Replace removed register_interface with subclassing
>  [https://pagure.io/freeipa/c/89fe83b03ac3b046685389ee1059ca75c73e53b0
>  commit] [https://pagure.io/freeipa/issue/9160 #9160]
>  * ap: Constrain supported docutils
>  [https://pagure.io/freeipa/c/1ada42e3bce58a729e689377b1a41b6cfa90b508
>  commit] [https://pagure.io/freeipa/issue/9208 #9208]
>  * ap: Rearrange overloaded jobs
>  [https://pagure.io/freeipa/c/b59baf31bc097821ff7787ecd75affb27ea2a7c3
>  commit] [https://pagure.io/freeipa/issue/9207 #9207]
>  * ap: Disable azure's security daemon
>  [https://pagure.io/freeipa/c/98c6e96e8db3d5bdc0315094b8a7bf81d196479b
>  commit] [https://pagure.io/freeipa/issue/9207 #9207]
>  * ap: Raise dbus timeout
>  [https://pagure.io/freeipa/c/e77b0b08d78d4d5ae7632ef23aebc577848ea507
>  commit] [https://pagure.io/freeipa/issue/9207 #9207]
>
>  === Scott Poore (1) ===
>  * ipatests: Rename create_quarkus to create_keycloak
>  [https://pagure.io/freeipa/c/88ea19b9a53d9c209105af049a1df100d07e081a
>  commit] [https://pagure.io/freeipa/issue/9225 #9225]
>
>  === Sudhir Menon (2) ===
>  * ipatests: WebUI: do not allow subid range deletion
>  [https://pagure.io/freeipa/c/58b026716c973f422b1b98e27eb9536e59919d82
>  commit] [https://pagure.io/freeipa/issue/9150 #9150]
>  * ipatests: ipa-client-install --subid adds entry in nsswitch.conf
>  [https://pagure.io/freeipa/c/a5762621ef3ed1e699306a8d2eef634bc927a6fc
>  commit] [https://pagure.io/freeipa/issue/9159 #9159]
>
>  === Timo Aaltonen (2) ===
>  * ipaplatform/debian: Drop the path for ldap.so
>  [https://pagure.io/freeipa/c/56c827099708d8613e194052857e121612fbd768
>  commit]
>  * ipaplatform/debian: Use multiarch path for libsofthsm2.so
>  [https://pagure.io/freeipa/c/c39c2ee80db056296f6826746b5b7a5bf7ba7cc4
>  commit]
>
>  === Thomas Woerner (1) ===
>  * DNSResolver: Fix use of nameservers with ports
>  [https://pagure.io/freeipa/c/5e2e4664aec641886923c2bec61ce25b96edb62a
>  commit] [https://pagure.io/freeipa/issue/9158 #9158]
>
>  === Yuri Chornoivan (3) ===
>  * Translated using Weblate (Ukrainian)
>  [https://pagure.io/freeipa/c/61dea74b405d251ea2778e209b03a167064b1bf6
>  commit]
>  * Translated using Weblate (Ukrainian)
>  [https://pagure.io/freeipa/c/842a6457fda382d78a11bce626b2ef0ef3749aa0
>  commit]
>  * Translated using Weblate (Ukrainian)
>  [https://pagure.io/freeipa/c/6353e45b5dd446b7acc46244d8bb10c38c39f9ce
>  commit]
>  _______________________________________________
>  FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>

[Alexander Bokovoy]

On pe, 04 marras 2022, Florence Blanc-Renaud via FreeIPA-devel wrote:
> Hi Antonio,
>
> the automation for the release notes seems to pick references to issues
> fixed in previous releases already (maybe it's considering references to
> pagure tickets even if they just mention Related instead of Fixes). I added
> some inline comments for the ones I spotted, please see below 
This is how I typically run the script. release-4-9-10..ipa-4-9 is what
picks the right commits since the previous release. In my run I get
"more than 40 bug-fixes" rather than "more than 50" in Antonio's
output:

$ python release/release-notes.py --token-file ipa-pagure.token --repo
~/src/freeipa-clean/ 4.9.11 2022-11-18 4.9.10 4.9.0 release-4-9-10..ipa-4-9 "FreeIPA
4.9.11" --links --nomilestones

In my case I don't have 3226, 8361, 8528, etc.

> On Thu, Nov 3, 2022 at 12:04 PM Antonio Torres via FreeIPA-devel <
> freeipa-devel(a)lists.fedorahosted.org&gt; wrote:
>
> > {{ReleaseDate|2022-11-03}}
> > The FreeIPA team would like to announce FreeIPA 4.9.11 release!
> >
> > It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
> > for
> > Fedora distributions will be available from the official repository soon.
> >
> > == Highlights in 4.9.11 ==
> >
> > '''TODO RELEASE NOTES - put release notes (if any) to proper
> categories'''
> > * 1539: [RFE] Add code to check password expiration on ldap bind
> > :: User can no longer do LDAP BIND operation with expired password.
> >
>
>
> > --------
> > * 3226: [RFE] ipa sudorule-add-user should accept more types of characters
> >
> Already fixed in a long time ago.
>
>
> >
> >
> > --------
> > * 8361: Add support for managing subuids and subgids in FreeIPA
> > :: IPA is now able to centrally store ID sub-ranges for users/groups.
> > More details can be found in the design document:
> > https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html
>
> Already fixed in 4.9.9
>
>
> >
> > --------
> > * 8404: Detect and fail if not enough memory is available for installation
> > :: FreeIPA server now requires at least 1.2 GiB RAM for installation
> > to prevent performance degradation.
> >
> In the new update, we updated the man page to mention the option
> --skip-mem-check, but the option was also provided with 4.9.2. This one can
> be removed.
>
>
> > --------
> > * 8528: Use separate logs for AD Trust and DNS installer
> > :: ipa-adtrust-install and ipa-dns-install commands now log their
> > activity into separate log files.
> >
> Already fixed in 4.9.0
>
>
> > --------
> > * 8655: Allow to establish trust to Active Directory in FIPS mode
> > :: When IPA is deployed in FIPS mode, it is now possible to establish
> > trust to Active Directory forest.
> >
> Already fixed in 4.9.1
>
>
> > --------
> > * 8803: Add support for managing IdP references
> > :: FreeIPA can now authenticate users with the help of OAuth 2.0
> > identity providers supporting OAuth 2.0 Device Authorization Flow.
> > IdPs known to work are Keycloak, Microsoft Azure, Google, Github, and
> > Okta. Details on how to use Keycloak can be found in FreeIPA workshop:
> >
> > https://freeipa.readthedocs.io/en/latest/workshop/12-external-idp-support...
>
> Already in 4.9.10. 4.9.11 just adds tests.
>
>
> >
> > --------
> > * 9150: Remove 'Remove' button from subid page
> > :: subid ranges cannot be removed. A button in Web UI subid management
> > page to remove the range was removed to not confuse users
> >
> Already in 4.9.10. 4.9.11 just adds a test.
>
>
> > --------
> > * 9159: [RFE] ipa-client-install should provide option to enable
> > subid: sss in /etc/nsswitch.conf
> > :: IPA installers now provide the ability to configure SSSD as
> > datasource for subid
> >
> already in 4.9.10, 4.9.11 just adds a test
>
>
> > --------
> > * 9187: [UX] Preserving a user account produces output saying it was
> > deleted
> > :: Previously, the command to preserve a user account used to display
> > a confusing output "Deleted user: <user>" although the user was
> > preserved and not deleted. The command now displays "Preserved user:
> > <user>" for preserved users.
> > --------
> > * 9228: ipa-client-install does not maintain server affinity during
> > installation
> > :: ipa-client-install will use a single server for the duration of the
> > installation process, either one discovered or provided on the
> > command-line. Previously it would use a temporary configuration to do
> > enrollment, then switch to a final one for the remaining operations.
> > This could lead to the installer talking with multiple servers. If the
> > client installer is faster than replication this could lead to errors.
> > --------
> > * 9237: Show order in sudo rule list in web interface
> > :: In the 'sudo rules' page, the WebUI is now displaying a 'sudo
> > order' column so that the users can easily see which rules override
> > other rules based on their order.
> > --------
> > * 9258: Do not add TLS CA configuration to ldap.conf anymore
> > :: FreeIPA client installer does not add explicit TLS CA configuration
> > to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA
> > configuration is not required as OpenLDAP uses the default CA store
> > provided by OpenSSL and IPA CA is installed in the default store by
> > the installer already.
> > --------
> > '''END TODO'''
> >
> > === Enhancements ===
> > * 8361: Add support for managing subuids and subgids in FreeIPA
> > :: IPA is now able to centrally store ID sub-ranges for users/groups.
> > More details can be found in the design document:
> > https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html
> > --------
> >
> to be removed
>
>
> > === Known Issues ===
> >
> >
> > === Bug fixes ===
> > FreeIPA 4.9.11 is a stabilization release for the features delivered as a
> > part of 4.9 version series.
> >
> > There are more than 50 bug-fixes since FreeIPA 4.9.10 release.
> > Details of the bug-fixes can be seen in the list of resolved tickets below.
> >
> > == Upgrading ==
> > Upgrade instructions are available on [[Upgrade]] page.
> >
> > == Feedback ==
> > Please provide comments, bugs and other feedback via the freeipa-users
> > mailing
> > list (
> > https://lists.fedoraproject.org/archives/list/[e-mail]...
> > )
> > or #freeipa channel on libera.chat.
> >
> >
> > == Resolved tickets ==
> > * [https://pagure.io/freeipa/issue/1539 #1539]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=782917 rhbz#782917])
> > [RFE] Add code to check password expiration on ldap bind
> > * [https://pagure.io/freeipa/issue/3226 #3226]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=871208 rhbz#871208])
> > [RFE] ipa sudorule-add-user should accept more types of characters
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8361 #8361] Add support for
> > managing subuids and subgids in FreeIPA
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8404 #8404] Detect and fail if not
> > enough memory is available for installation
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8452 #8452] update samba
> > configuration on IPA master to explicitly use 'server role' setting
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8501 #8501] Unify how FreeIPA gets
> > FQDN of current host
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8519 #8519] Fedora container
> > platform is incomplete
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8524 #8524]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1851835 rhbz#1851835])
> > Deploy & manage the ACME service topology wide from a single system
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8528 #8528] Use separate logs for
> > AD Trust and DNS installer
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8584 #8584] ACME communication with
> > dogtag REST endpoints should be using the cookie it creates
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8647 #8647]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1912556 rhbz#1912556])
> > Incorrect DNSKEY created when DNSSEC enabled for zone
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8655 #8655]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1860129 rhbz#1860129])
> > Allow to establish trust to Active Directory in FIPS mode
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8803 #8803] Add support for
> > managing IdP references
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8804 #8804] Extend supported user
> > authentication methods in IPA to allow IdP auth
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8805 #8805] Extend `ipa-otpd`
> > daemon to recognize IdP references
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8832 #8832]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1957768 rhbz#1957768])
> > ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8923 #8923]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1970168 rhbz#1970168])
> > Trust controller role should pull sssd-winbind-idmap package
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8951 #8951] Test for RFE
> > ipa-healthcheck tool can include check to see if the system is FIPS
> > enabled or not
> > * [https://pagure.io/freeipa/issue/8972 #8972]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1998129 rhbz#1998129])
> > AVC denied { read } comm="ipa-custodia" on aarch64 during installation
> > of ipa-server
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/8984 #8984]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=1999992 rhbz#1999992])
> > ipa migrate-ds command fails to warn when compat plugin is enabled
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/9062 #9062] [ipatests] SID
> > generation and test_xmlrpc/test_user_plugin.py
> > * [https://pagure.io/freeipa/issue/9127 #9127]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2062379 rhbz#2062379])
> > Use new getorigby{user|group}name() calls in extdom plugin
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/9150 #9150]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2063155 rhbz#2063155])
> > Remove 'Remove' button from subid page
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/9158 #9158] Internal error when
> > setting dnsconfig or dnsforwardzone forwarders.
> > * [https://pagure.io/freeipa/issue/9159 #9159]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2068088 rhbz#2068088])
> > [RFE] ipa-client-install should provide option to enable subid: sss in
> > /etc/nsswitch.conf
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/9160 #9160]
> > cryptography.utils.register_interface is scheduled for removal
> > * [https://pagure.io/freeipa/issue/9161 #9161] Nightly test failure in
> > test_selinuxusermap.py::test_selinuxusermap::test_misc
> > * [https://pagure.io/freeipa/issue/9178 #9178] idviews: use cached
> > ipaOriginalUid value when resolving ID override anchor
> >
> to be removed
>
>
> > * [https://pagure.io/freeipa/issue/9183 #9183] Timeout issue in
> > test_installation.py when using interactive mode
> > * [https://pagure.io/freeipa/issue/9185 #9185] Fix missing parameter
> > for Suse ipaplatform task
> > * [https://pagure.io/freeipa/issue/9187 #9187]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2022028 rhbz#2022028])
> > [UX] Preserving a user account produces output saying it was deleted
> > * [https://pagure.io/freeipa/issue/9188 #9188]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2098187 rhbz#2098187])
> > Add warning for empty targetattr when creating ACI with RBAC
> > * [https://pagure.io/freeipa/issue/9189 #9189] ipatests: Fix
> > test_idp.py for downstream idm-ci
> > * [https://pagure.io/freeipa/issue/9190 #9190]
> > ipatests.test_ipaserver.test_secure_ajp_connector failing with python
> > 3.6.8 with: TypeError: a bytes-like object is required, not 'str'
> > * [https://pagure.io/freeipa/issue/9192 #9192]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2094672 rhbz#2094672])
> > IdM WebUI Pagination Size should not allow empty value
> > * [https://pagure.io/freeipa/issue/9198 #9198] [Tracker] nightly
> > failure: after ipa trust-add, cred cache contains
> > cifs/master.ipa.test(a)IPA.TEST instead of admin principal
> > * [https://pagure.io/freeipa/issue/9204 #9204] [Tracker] In
> > ipa-server-upgrade ca_upgrade_schema() results in unnecessary pki
> > restarts
> > * [https://pagure.io/freeipa/issue/9206 #9206]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2109236 rhbz#2109236])
> > ldap bind occurs when admin user changes password with gracelimit=0
> > * [https://pagure.io/freeipa/issue/9207 #9207] Failure in
> > AzurePipeline.freeipa (GATING InstallDNSSECFirst_1_to_5)
> > * [https://pagure.io/freeipa/issue/9208 #9208] ap: Doc build fails
> > against Sphinx 5.1.0
> > * [https://pagure.io/freeipa/issue/9211 #9211]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2109243 rhbz#2109243])
> > RFE: Allow grace login limit to be set in IPA WebUI.
> > * [https://pagure.io/freeipa/issue/9212 #9212]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2115475 rhbz#2115475])
> > Nightly test failure in
> > test_user.py::test_user::test_password_expiration_notification
> > * [https://pagure.io/freeipa/issue/9214 #9214] Nightly failure in
> > webui test test_subid.py::test_subid::test_subid_range_deletion_not_allowed
> > * [https://pagure.io/freeipa/issue/9216 #9216] [Tracker] Nightly
> > failure: zone not signed
> >
> to be removed
>
> flo
>
> * [https://pagure.io/freeipa/issue/9218 #9218]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2116966 rhbz#2116966])
> > Random failure in test-winsyncmigrate
> > * [https://pagure.io/freeipa/issue/9225 #9225] pytest library module
> > rename from quarkus to keycloak
> > * [https://pagure.io/freeipa/issue/9226 #9226]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547])
> > Infinite redirect loop in the WebUI for user root
> > * [https://pagure.io/freeipa/issue/9228 #9228] ipa-client-install does
> > not maintain server affinity during installation
> > * [https://pagure.io/freeipa/issue/9230 #9230] build failure against gcc
> > < 11
> > * [https://pagure.io/freeipa/issue/9231 #9231] /run/ipa/ccaches uses
> > all available tmpfs space
> > * [https://pagure.io/freeipa/issue/9237 #9237] Show order in sudo rule
> > list in web interface
> > * [https://pagure.io/freeipa/issue/9243 #9243]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2127833 rhbz#2127833])
> > Password Policy Grace login limit allows invalid maximum value
> > * [https://pagure.io/freeipa/issue/9245 #9245]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2117167 rhbz#2117167])
> > `extdom` plugin can return object from a wrong domain.
> > * [https://pagure.io/freeipa/issue/9246 #9246] Nightly test failure in
> > test_user_permissions.TestInstallClientNoAdmin
> > * [https://pagure.io/freeipa/issue/9248 #9248]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2124369 rhbz#2124369])
> > OTP token sync always returns OK even with random numbers
> > * [https://pagure.io/freeipa/issue/9249 #9249]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630])
> > Deprecated feature idnssoaserial in IdM appears when creating reverse
> > dns zones
> > * [https://pagure.io/freeipa/issue/9252 #9252]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2129895 rhbz#2129895])
> > [DDF] The Examples in the RHEL ipa(1) man page show "ipa help
> > commands" with content for "ipa halp topics" and "ipa hel
> > * [https://pagure.io/freeipa/issue/9254 #9254] Exclude installed
> > policy module file from RPM verification
> > * [https://pagure.io/freeipa/issue/9255 #9255] ipapython.dn_ctypes is
> > not compatible with libldap 2.6
> > * [https://pagure.io/freeipa/issue/9258 #9258]
> > ([https://bugzilla.redhat.com/show_bug.cgi?id=2094673 rhbz#2094673])
> > Do not add TLS CA configuration to ldap.conf anymore
> > == Detailed changelog since 4.9.10 ==
> > === Armando Neto (1) ===
> > * webui: Do not allow empty pagination size
> > [https://pagure.io/freeipa/c/991849cf58fa990ad4540a61214b5ab4fcd4baa1
> > commit] [https://pagure.io/freeipa/issue/9192 #9192]
> >
> > === Alexander Bokovoy (3) ===
> > * ipaclient: do not set TLS CA options in ldap.conf anymore
> > [https://pagure.io/freeipa/c/d9a56b51bbb350219d0f5cb0ea6b3cc00230d437
> > commit] [https://pagure.io/freeipa/issue/9258 #9258]
> > * fix canonicalization issue in Web UI
> > [https://pagure.io/freeipa/c/109cd579e3b089b7fad4c92bf25594eba1af8a21
> > commit] [https://pagure.io/freeipa/issue/9226 #9226]
> > * ipa-otpd: initialize local pointers and handle gcc 10
> > [https://pagure.io/freeipa/c/9290aa5500f752d0eedabdfc92c9fe6c0ee743b8
> > commit] [https://pagure.io/freeipa/issue/9230 #9230]
> >
> > === Anuja More (4) ===
> > * ipatests : Test query to AD specific attributes is successful.
> > [https://pagure.io/freeipa/c/21cb86a8e571ac7aa0304c57961881ca9c4aeacb
> > commit] [https://pagure.io/freeipa/issue/9127 #9127]
> > * ipatests: Fix install_master for test_idp.py
> > [https://pagure.io/freeipa/c/15f454f6f8d25275c9570e2cc3a97c4e030fc581
> > commit] [https://pagure.io/freeipa/issue/9189 #9189]
> > * ipatests: update prci definitions for test_idp.py
> > [https://pagure.io/freeipa/c/50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d
> > commit]
> > * Add end to end integration tests for external IdP
> > [https://pagure.io/freeipa/c/857713c5a9c8e0b62c06dd92e69c09eeb34b2e99
> > commit] [https://pagure.io/freeipa/issue/8803 #8803],
> > [https://pagure.io/freeipa/issue/8804 #8804],
> > [https://pagure.io/freeipa/issue/8805 #8805]
> >
> > === Antonio Torres (1) ===
> > * Back to git snapshots
> > [https://pagure.io/freeipa/c/3e90842b3d94268f2ccd42c8decd0eecbcf88f1f
> > commit]
> >
> > === Alexey Tikhonov (3) ===
> > * extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper()
> > returns object from a wrong domain (performance optimization)
> > [https://pagure.io/freeipa/c/a07cece0c006b3a89fc467284244f979d39f0209
> > commit]
> > * extdom: make sure result doesn't miss domain part
> > [https://pagure.io/freeipa/c/3de618f75416afd6c087c243fe35755739d229a4
> > commit] [https://pagure.io/freeipa/issue/9245 #9245]
> > * extdom: internal functions should be static
> > [https://pagure.io/freeipa/c/666357649f4dfb8254cb3707e97e12c69e6714f7
> > commit]
> >
> > === Carla Martinez (7) ===
> > * Update API and VERSION
> > [https://pagure.io/freeipa/c/856edcc8d3c9fe64eff532db669536a0a78ba70d
> > commit] [https://pagure.io/freeipa/issue/9249 #9249]
> > * webui: Set 'SOA serial' field as read-only
> > [https://pagure.io/freeipa/c/9f8c9a4d96877bab1cb474615d77aca2fa586ece
> > commit] [https://pagure.io/freeipa/issue/9249 #9249]
> > * ipatest: Remove warning message for 'idnssoaserial'
> > [https://pagure.io/freeipa/c/76604df09d8b62795f4e2d1fbc99af9ed55ec5cd
> > commit] [https://pagure.io/freeipa/issue/9249 #9249]
> > * Set 'idnssoaserial' to deprecated
> > [https://pagure.io/freeipa/c/e9048daac53e24759a33e2031c8b4224a80a0e54
> > commit] [https://pagure.io/freeipa/issue/9249 #9249]
> > * webui: Show 'Sudo order' column
> > [https://pagure.io/freeipa/c/0513a83a4fcd5626168cb45132af8cd1b4a9ee03
> > commit] [https://pagure.io/freeipa/issue/9237 #9237]
> > * Set pkeys in test_selinuxusermap.py::test_misc::delete_record
> > [https://pagure.io/freeipa/c/cefa8f1e5f5b01e6863d07e9f3849dfd4c485f22
> > commit] [https://pagure.io/freeipa/issue/9161 #9161]
> > * webui: Allow grace login limit
> > [https://pagure.io/freeipa/c/ade5093b08f92b279c200f341e96972a74f644d8
> > commit] [https://pagure.io/freeipa/issue/9211 #9211]
> >
> > === Jan Kuparinen (20) ===
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/841e0c673b222e686083cb96c210a55da6e09ff8
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/4d92e67a45b0caf72ce5028f8bbba06f4d63fb7f
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/e6accc7b3f39e0140e0d1dc3ee6bfcf6636d214d
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/20bcd69f38fb734dc80e5052cb2ed91c19b12994
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/49a41249e1d8cf6b349f895ba88c7490081ab462
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/20269ac630c451734dffef50298cba823ffe2624
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/1853d934d1e93dbf07d50799406ac12995a1d977
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/7037e5389006f1eeea0299918cbbae57893ef125
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/9df1672f479bee01efcd53c46e800e789762bc97
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/eb1a1f35849c1f2e43c282c555b62f7d12962e37
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/216cced00a1973f2103cf678ed94ef3b6c204190
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/e98691b491ae2a8d41c3eb6e7028f6e731dbdbae
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/4d306ee7ebe90275a47b4f182f66bc87bc397170
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/2203f3627f28ff4c81ab9fd24eed31669ae34ff5
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/15457a6d9fdb19466405f6882fbbc9e29510d40e
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/5dcb614691ed31a660edc936612b525b1be0ccae
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/c2061cf9c505c4821c7812a71c464afa367300b5
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/9d6d2e2dc9cfb7c1ef1e400ba90b27474866380f
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/6bdd02db7ace58cbb16d45d5c6dbfb1945e2bb43
> > commit]
> > * Added translation using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/6169eb47e1ea42c81ad6022ab02ef3222566f70f
> > commit]
> >
> > === David Pascual (2) ===
> > * ipatest: fix prci checker target masked return code & add pylint
> > [https://pagure.io/freeipa/c/6483f33389c7bb1d185f2b39d68f407e131a282c
> > commit]
> > * ipatests: Checker script for prci definitions
> > [https://pagure.io/freeipa/c/f33266c2ba9d794a5a1e9994e5fa029d2fa5de70
> > commit]
> >
> > === Erik (1) ===
> > * ipatests: healthcheck: test if system is FIPS enabled
> > [https://pagure.io/freeipa/c/f962a0c2832619100046c923d15f21e8c10fce96
> > commit] [https://pagure.io/freeipa/issue/8951 #8951]
> >
> > === Florence Blanc-Renaud (11) ===
> > * Spec file: bump the selinux-policy version
> > [https://pagure.io/freeipa/c/58ad9f2eec0afe494c57015c4449ae39748117e4
> > commit] [https://pagure.io/freeipa/issue/9198 #9198]
> > * webui tests: fix test_subid suite
> > [https://pagure.io/freeipa/c/58e12bd93a9b7b1c9a39981ee0c6a724040e164f
> > commit] [https://pagure.io/freeipa/issue/9214 #9214]
> > * ipa man page: format the EXAMPLES section
> > [https://pagure.io/freeipa/c/64ef2b9c07ec0b1b316555739ff9f98229258838
> > commit] [https://pagure.io/freeipa/issue/9252 #9252]
> > * ipatests: add negative test for otptoken-sync
> > [https://pagure.io/freeipa/c/895a800e90a34f55f5d2789ece6e7bc8e6f5c0a6
> > commit] [https://pagure.io/freeipa/issue/9248 #9248]
> > * ipa otptoken-sync: return error when sync fails
> > [https://pagure.io/freeipa/c/4cc94cd3b929ee1878767d23f98ad5e755583c6b
> > commit] [https://pagure.io/freeipa/issue/9248 #9248]
> > * gitignore: add install/oddjob/org.freeipa.server.config-enable-sid
> > [https://pagure.io/freeipa/c/a7369944d8b68032eddcc4577b0cc5f9f603cda9
> > commit]
> > * ipatests: Fix expected object classes
> > [https://pagure.io/freeipa/c/2385d1d90aa91d34c4b36842a17e72aa2399a733
> > commit] [https://pagure.io/freeipa/issue/9062 #9062]
> > * check_repl_update: in progress is a boolean
> > [https://pagure.io/freeipa/c/05a298f56485222583cb7dd4f6a3a4c5c77fc8cf
> > commit] [https://pagure.io/freeipa/issue/9218 #9218]
> > * azure tests: disable TestInstallDNSSECFirst
> > [https://pagure.io/freeipa/c/d40fd287836dc8440f69314d77ccb461c7e6ccea
> > commit] [https://pagure.io/freeipa/issue/9216 #9216]
> > * xmlrpc tests: updated expected output for preserved user
> > [https://pagure.io/freeipa/c/4984ff210a169129e4e56b10e54e9c795520855c
> > commit] [https://pagure.io/freeipa/issue/9187 #9187]
> > * Preserve user: fix the confusing summary
> > [https://pagure.io/freeipa/c/ff4152539b96d309dcceaf854a3e0a49f435acff
> > commit] [https://pagure.io/freeipa/issue/9187 #9187]
> >
> > === Fraser Tweedale (2) ===
> > * install: suggest --skip-mem-check when mem check fails
> > [https://pagure.io/freeipa/c/cbf2614d8acc11a1b41558a45dac8ec98b032732
> > commit] [https://pagure.io/freeipa/issue/8404 #8404]
> > * man: add --skip-mem-check to man pages
> > [https://pagure.io/freeipa/c/585cebb1a9673e2fc083dd3c9545a6c080e171e3
> > commit] [https://pagure.io/freeipa/issue/8404 #8404]
> >
> > === Matthew Davis (1) ===
> > * Add missing parameter to Suse modify_nsswitch_pam_stack
> > [https://pagure.io/freeipa/c/4f15804270590fdf0f339fc53ed63bf440361b7b
> > commit] [https://pagure.io/freeipa/issue/9185 #9185]
> >
> > === Jesse Sandberg (1) ===
> > * Fix ipa-ccache-sweeper activation timer and clean up service file
> > [https://pagure.io/freeipa/c/358924455d87b67db6cd743f3cfe15522b4c0d91
> > commit] [https://pagure.io/freeipa/issue/9231 #9231]
> >
> > === Michal Polovka (3) ===
> > * ipatests: Healthcheck use subject base from IPA not REALM
> > [https://pagure.io/freeipa/c/afa94c7995f236c5eff516652f31c1a956466cf7
> > commit]
> > * ipatests: Healthcheck should ignore pki errors when CA is not
> > configured [
> > https://pagure.io/freeipa/c/206e08d811c43ba8295816e609d4cb7148a774a3
> > commit]
> > * ipatests: Increase expect timeout for interactive mode
> > [https://pagure.io/freeipa/c/a6a6781284658e77f36c07cb7fd35b43240946a2
> > commit] [https://pagure.io/freeipa/issue/9183 #9183]
> >
> > === Marcin Stanclik (1) ===
> > * Translated using Weblate (Polish)
> > [https://pagure.io/freeipa/c/d198a35cb885b6cc1622bf99b8546675b98c8aed
> > commit]
> >
> > === Nikola Knazekova (1) ===
> > * Exclude installed policy module file from RPM verification
> > [https://pagure.io/freeipa/c/c977cefa101e145b13b5c19ae5369e5ca7ef1ef8
> > commit] [https://pagure.io/freeipa/issue/9254 #9254]
> >
> > === Piotr Drąg (1) ===
> > * Translated using Weblate (Polish)
> > [https://pagure.io/freeipa/c/3b0c1cafc16dc927449231a7a70b2876770ba962
> > commit]
> >
> > === Hela Basa (3) ===
> > * Added translation using Weblate (Korean)
> > [https://pagure.io/freeipa/c/0a6246ea971282a2f1fc0b5fe3f09f7d656bbf2f
> > commit]
> > * Translated using Weblate (Sinhala)
> > [https://pagure.io/freeipa/c/696a72f7aef3df7c0f619f0d67e5fe259cc80c37
> > commit]
> > * Added translation using Weblate (Sinhala)
> > [https://pagure.io/freeipa/c/f9590de2e0bc1d2dde4f6a78c72b6a69f773bd99
> > commit]
> >
> > === Rob Crittenden (11) ===
> > * Move client certificate request after krb5.conf is created
> > [https://pagure.io/freeipa/c/762d786bf7a3043fd56877949f02bccd077e2711
> > commit] [https://pagure.io/freeipa/issue/9246 #9246]
> > * Defer creating the final krb5.conf on clients
> > [https://pagure.io/freeipa/c/69413325158a3ea06d1491acd77ee6e0955ee89a
> > commit] [https://pagure.io/freeipa/issue/9228 #9228]
> > * Fix upper bound of password policy grace limit
> > [https://pagure.io/freeipa/c/91a02174a0a9694fd5611c071913ad4720be5ac9
> > commit] [https://pagure.io/freeipa/issue/9243 #9243]
> > * Set default on group pwpolicy with no grace limit in upgrade
> > [https://pagure.io/freeipa/c/a4ddaaf3048c4e8d78a1807af7266ee40ab3a30b
> > commit] [https://pagure.io/freeipa/issue/9212 #9212]
> > * Set default gracelimit on group password policies to -1
> > [https://pagure.io/freeipa/c/497a57e7a6872fa30d1855a1d91a455bfdbf9300
> > commit] [https://pagure.io/freeipa/issue/9212 #9212]
> > * doc: Update LDAP grace period design with default values
> > [https://pagure.io/freeipa/c/434620ee342ac4767beccec647a318bfa7743dfa
> > commit] [https://pagure.io/freeipa/issue/9212 #9212]
> > * upgrades: Don't restart the CA on ACME and profile schema change
> > [https://pagure.io/freeipa/c/aaf57185a2701b34948105e8b54075afe048ff18
> > commit] [https://pagure.io/freeipa/issue/9204 #9204]
> > * Disabling gracelimit does not prevent LDAP binds
> > [https://pagure.io/freeipa/c/1316cd8b2252c2543cf2ef2186956a8833037b1e
> > commit] [https://pagure.io/freeipa/issue/9206 #9206]
> > * Warn for permissions with read/write/search/compare and no attrs
> > [https://pagure.io/freeipa/c/b31631ad69f72fb42b5091375df8021580f8139a
> > commit] [https://pagure.io/freeipa/issue/9188 #9188]
> > * Only calculate LDAP password grace when the password is expired
> > [https://pagure.io/freeipa/c/3675bd1d7aca443832bb9bb2f521cc4d3a088aec
> > commit] [https://pagure.io/freeipa/issue/1539 #1539]
> > * Fix test_secure_ajp_connector.py failing with Python 3.6.8
> > [https://pagure.io/freeipa/c/de64d6724e028a1882c3a8be31c2752bebdd41fd
> > commit] [https://pagure.io/freeipa/issue/9190 #9190]
> >
> > === Ricky Tigg (4) ===
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/91b63fcae0a588fc174cf865b4e0135c8c0e48ec
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/e6451fe15acf406aa741d4eed296ab6eff7e9313
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/3392f31afe04e5b6b0d49d4e2f2906bc90b3643c
> > commit]
> > * Translated using Weblate (Finnish)
> > [https://pagure.io/freeipa/c/a8a2b2cf97bbf8b2b80acce08d0903b6c91c5f98
> > commit]
> >
> > === Sumit Bose (1) ===
> > * ipa-kdb: do not fail if certmap rule cannot be added
> > [https://pagure.io/freeipa/c/e51a0c927db4a4c9b3e1ab0c6dffca545532a2b4
> > commit]
> >
> > === 김인수 (44) ===
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/b8c39cca34b75a4ed3ed77a468836778f670027b
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/2c555646dd71911d1bcf860e6c3acbcfd3050ad2
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/53e4e7212b5b6fe0dceb809aaddc83158f8dfef4
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/29dba19aa8862ea7b3185dcc0dba789b8e4af5b8
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/425894153a17de0cdb827a83fad599343e2d3656
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/7f9588f36a2b82df3fd9ef7dd286886021e0ffa6
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/c07e0ec7a5acedef693b0f79fdc68529e64aa023
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/e6e638aea7fda83beb47fa6c2f75772673d351c2
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/994c43513950b4c82dd9e1ed38b56232f3efffaa
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/fd538803cf6c098b2a3386ecc1f4b1e3a27b9a88
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/aef749b632fd636e6d6b920757e13d64303da9d4
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/64b2c0ebfeb7035b8c9d9e38c2a75e046e855f62
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/a24adeab5ca162b3c79358128fcdee22d0bd18f2
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/b70041d904926e9d33423fe1f7b48ca0c3791718
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/246604ec696255674e8716610c387f0f2ef93d73
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/07a1cc5424760a4ef43ffc6734c901f1cc446909
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/e98e21709e2205c8c019cc7006d3f9ded94432ae
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/fe60d1f6f386734b7cb052f34fb798341130052a
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/5bd77e606cb6be3b3a133294027e284f5604b447
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/2c0924f38694603777bcbdab804d9b3331efa239
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/067cae55eced1c1c7bcdbbb0dd56a16d7127488c
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/aa00e7c3cff81e79a1dfce2c1e5348af9f3a3438
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/b5d6616aed77a46de2db53b3395aeaf531537df3
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/7ca1befe7e8ca463052f8b24f6c9b37093dabbaa
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/b2cf29ae168661a12a426bf72e98f43d769fb132
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/8b3ceace34a55fadb560a758c02632efa87ec96f
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/7d12b30e2c6762eda93eb66a1dab2e52770d94aa
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/20006cc713c7666c373804cd7d6415f9af6a6d27
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/9e2f7d041c1c72b329fdacac232451e57a4d0516
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/cf9f35e3eb2c90cb3b07a2c5ed33fdd2f3bfa0b3
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/d6ff8af62ee12517d438d9f3ff02f25219166da4
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/1e65336b3513cf7c6579ac5714c50cb4a965fd96
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/548afe9eed0696ceb4e8abdc3331b3f1f0fad6f2
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/715043df4ea1d416e64ce50b0e141faf36f6c45d
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/18346d99b214f6060ab7f6c83e02f2c4d56ec799
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/9658dbd3c31ad22e175e613f3c51073eb196c72c
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/27dba4a7c3605a1ab03c55458ad4bb47b7c4dbc7
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/d5726f04b6b73d6c1de183ee5b6b7bd96d590db5
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/eac046fd82d02105d3388af1f04527813546e6f7
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/77feee852ed01502c0a0e48d4d4e546332827885
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/00eba1f70445a5faf27db461fb762a030b0b5789
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/101460521cb228f68a52a934acf97eddcbbb9928
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/23fb8a4709af35db3e760159de405adad343c042
> > commit]
> > * Translated using Weblate (Korean)
> > [https://pagure.io/freeipa/c/fd81a77d78423293dee4e117b58f2f9077cb0cbf
> > commit]
> >
> > === Stanislav Levin (6) ===
> > * ipapython: Support openldap 2.6
> > [https://pagure.io/freeipa/c/7e93f46c589ba0a68c039d65ea3c0872644a0eb0
> > commit] [https://pagure.io/freeipa/issue/9255 #9255]
> > * x509: Replace removed register_interface with subclassing
> > [https://pagure.io/freeipa/c/89fe83b03ac3b046685389ee1059ca75c73e53b0
> > commit] [https://pagure.io/freeipa/issue/9160 #9160]
> > * ap: Constrain supported docutils
> > [https://pagure.io/freeipa/c/1ada42e3bce58a729e689377b1a41b6cfa90b508
> > commit] [https://pagure.io/freeipa/issue/9208 #9208]
> > * ap: Rearrange overloaded jobs
> > [https://pagure.io/freeipa/c/b59baf31bc097821ff7787ecd75affb27ea2a7c3
> > commit] [https://pagure.io/freeipa/issue/9207 #9207]
> > * ap: Disable azure's security daemon
> > [https://pagure.io/freeipa/c/98c6e96e8db3d5bdc0315094b8a7bf81d196479b
> > commit] [https://pagure.io/freeipa/issue/9207 #9207]
> > * ap: Raise dbus timeout
> > [https://pagure.io/freeipa/c/e77b0b08d78d4d5ae7632ef23aebc577848ea507
> > commit] [https://pagure.io/freeipa/issue/9207 #9207]
> >
> > === Scott Poore (1) ===
> > * ipatests: Rename create_quarkus to create_keycloak
> > [https://pagure.io/freeipa/c/88ea19b9a53d9c209105af049a1df100d07e081a
> > commit] [https://pagure.io/freeipa/issue/9225 #9225]
> >
> > === Sudhir Menon (2) ===
> > * ipatests: WebUI: do not allow subid range deletion
> > [https://pagure.io/freeipa/c/58b026716c973f422b1b98e27eb9536e59919d82
> > commit] [https://pagure.io/freeipa/issue/9150 #9150]
> > * ipatests: ipa-client-install --subid adds entry in nsswitch.conf
> > [https://pagure.io/freeipa/c/a5762621ef3ed1e699306a8d2eef634bc927a6fc
> > commit] [https://pagure.io/freeipa/issue/9159 #9159]
> >
> > === Timo Aaltonen (2) ===
> > * ipaplatform/debian: Drop the path for ldap.so
> > [https://pagure.io/freeipa/c/56c827099708d8613e194052857e121612fbd768
> > commit]
> > * ipaplatform/debian: Use multiarch path for libsofthsm2.so
> > [https://pagure.io/freeipa/c/c39c2ee80db056296f6826746b5b7a5bf7ba7cc4
> > commit]
> >
> > === Thomas Woerner (1) ===
> > * DNSResolver: Fix use of nameservers with ports
> > [https://pagure.io/freeipa/c/5e2e4664aec641886923c2bec61ce25b96edb62a
> > commit] [https://pagure.io/freeipa/issue/9158 #9158]
> >
> > === Yuri Chornoivan (3) ===
> > * Translated using Weblate (Ukrainian)
> > [https://pagure.io/freeipa/c/61dea74b405d251ea2778e209b03a167064b1bf6
> > commit]
> > * Translated using Weblate (Ukrainian)
> > [https://pagure.io/freeipa/c/842a6457fda382d78a11bce626b2ef0ef3749aa0
> > commit]
> > * Translated using Weblate (Ukrainian)
> > [https://pagure.io/freeipa/c/6353e45b5dd446b7acc46244d8bb10c38c39f9ce
> > commit]
> > _______________________________________________
> > FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it:
> > https://pagure.io/fedora-infrastructure/new_issue
> > 



-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Alexander Bokovoy]

On pe, 04 marras 2022, Florence Blanc-Renaud via FreeIPA-devel wrote:
> Hi Antonio,
>
> the automation for the release notes seems to pick references to issues
> fixed in previous releases already (maybe it's considering references to
> pagure tickets even if they just mention Related instead of Fixes). I added
> some inline comments for the ones I spotted, please see below 
This is how I typically run the script. release-4-9-10..ipa-4-9 is what
picks the right commits since the previous release. In my run I get
"more than 40 bug-fixes" rather than "more than 50" in Antonio's
output:

$ python release/release-notes.py --token-file ipa-pagure.token --repo
~/src/freeipa-clean/ 4.9.11 2022-11-18 4.9.10 4.9.0 release-4-9-10..ipa-4-9 "FreeIPA
4.9.11" --links --nomilestones

In my case I don't have 3226, 8361, 8528, etc.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Antonio Torres]

I ran it like this:

$ python3 release/release-notes.py 4.9.11 2022-11-03 4.9.10 4.9
release-4-9-10..origin/ipa-4-9 "FreeIPA 4.9" --links --token-file
~/.ipa/pagure.token --repo=~/dev/freeipa-clean/

Re-running it using the --nomilestones flag is what removed those
tickets. I will add it to upstream release documentation.

On Fri, Nov 4, 2022 at 6:59 PM Alexander Bokovoy <abokovoy(a)redhat.com&gt; wrote:
>  On pe, 04 marras 2022, Florence Blanc-Renaud via FreeIPA-devel wrote:
>  >Hi Antonio,
>  >
>  >the automation for the release notes seems to pick references to issues
>  >fixed in previous releases already (maybe it's considering references to
>  >pagure tickets even if they just mention Related instead of Fixes). I added
>  >some inline comments for the ones I spotted, please see below
>
>  This is how I typically run the script. release-4-9-10..ipa-4-9 is what
>  picks the right commits since the previous release. In my run I get
>  "more than 40 bug-fixes" rather than "more than 50" in Antonio's
> output:
>
>  $ python release/release-notes.py --token-file ipa-pagure.token --repo
> ~/src/freeipa-clean/ 4.9.11 2022-11-18 4.9.10 4.9.0 release-4-9-10..ipa-4-9 "FreeIPA
> 4.9.11" --links --nomilestones
>
>  In my case I don't have 3226, 8361, 8528, etc.
>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>