rob,
thanks. You solved it for me - enabling idm:DL1 did the trick. Now I am upgrading to 4.8.4 as I type this. Though as far as I can remember I did not manually install IPA and it seems that it is provided trough Identity Management system module of CentOS 8 AppStream repo. No clue how it got disabled, never even checked it. Thanks again for reminding me to cover basics! rgD