diff --git a/.gitignore b/.gitignore
index eb2d875..735d1e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,3 +43,4 @@
 /freeipa-4.2.3.tar.gz
 /freeipa-4.3.0.tar.gz
 /freeipa-4.3.1.tar.gz
+/freeipa-4.3.2.tar.gz
diff --git a/freeipa.spec b/freeipa.spec
index f8310c4..2fd3d1d 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -30,13 +30,13 @@
 %global platform_module fedora
 %endif
 
-%global VERSION 4.3.1
+%global VERSION 4.3.2
 
 %define _hardened_build 1
 
 Name:           freeipa
 Version:        %{VERSION}
-Release:        2%{?dist}
+Release:        1%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
@@ -48,7 +48,7 @@ BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Patch0001:      0001-Workarounds-for-SELinux-execmem-violations-in-crypto.patch
 
 %if ! %{ONLY_CLIENT}
-BuildRequires:  389-ds-base-devel >= 1.3.4.4
+BuildRequires:  389-ds-base-devel >= 1.3.5
 BuildRequires:  svrcore-devel
 BuildRequires:  policycoreutils >= 2.1.12-5
 BuildRequires:  systemd-units
@@ -137,7 +137,7 @@ Requires: %{name}-client = %{version}-%{release}
 Requires: %{name}-admintools = %{version}-%{release}
 Requires: %{name}-common = %{version}-%{release}
 Requires: python2-ipaserver = %{version}-%{release}
-Requires: 389-ds-base >= 1.3.4.6
+Requires: 389-ds-base >= 1.3.5
 Requires: openldap-clients > 2.4.35-4
 Requires: nss >= 3.14.3-12.0
 Requires: nss-tools >= 3.14.3-12.0
@@ -147,7 +147,7 @@ Requires: cyrus-sasl-gssapi%{?_isa}
 Requires: ntp
 Requires: httpd >= 2.4.6-6
 Requires: mod_wsgi
-Requires: mod_auth_gssapi >= 1.3.0-2
+Requires: mod_auth_gssapi >= 1.4.0
 Requires: mod_nss >= 1.0.8-26
 Requires: python-ldap >= 2.4.15
 Requires: python-gssapi >= 1.1.2
@@ -161,15 +161,15 @@ Requires(post): systemd-units
 Requires: selinux-policy >= %{selinux_policy_version}
 Requires(post): selinux-policy-base >= %{selinux_policy_version}
 Requires: slapi-nis >= 0.55-1
-Requires: pki-ca >= 10.2.6-13
-Requires: pki-kra >= 10.2.6-13
+Requires: pki-ca >= 10.2.6-19
+Requires: pki-kra >= 10.2.6-19
 Requires(preun): python systemd-units
 Requires(postun): python systemd-units
 Requires: zip
 Requires: policycoreutils >= 2.1.12-5
 Requires: tar
 Requires(pre): certmonger >= 0.78
-Requires(pre): 389-ds-base >= 1.3.4.6
+Requires(pre): 389-ds-base >= 1.3.5
 Requires: fontawesome-fonts
 Requires: open-sans-fonts
 Requires: openssl
@@ -369,6 +369,7 @@ Requires: %{name}-client-common = %{version}-%{release}
 Requires: %{name}-common = %{version}-%{release}
 Requires: python2-ipalib = %{version}-%{release}
 Requires: python-dns >= 1.11.1
+Requires: pyusb
 
 %description -n python2-ipaclient
 IPA is an integrated solution to provide centrally managed Identity (users,
@@ -391,6 +392,7 @@ Requires: %{name}-client-common = %{version}-%{release}
 Requires: %{name}-common = %{version}-%{release}
 Requires: python3-ipalib = %{version}-%{release}
 Requires: python3-dns >= 1.11.1
+Requires: python3-pyusb
 
 %description -n python3-ipaclient
 IPA is an integrated solution to provide centrally managed Identity (users,
@@ -603,6 +605,7 @@ Requires: python-polib
 Requires: python-pytest-multihost >= 0.5
 Requires: python-pytest-sourceorder
 Requires: ldns-utils
+Requires: python-sssdconfig
 
 Provides: %{alt_name}-tests = %{version}
 Conflicts: %{alt_name}-tests
@@ -634,6 +637,7 @@ Requires: python3-polib
 Requires: python3-pytest-multihost >= 0.5
 Requires: python3-pytest-sourceorder
 Requires: ldns-utils
+Requires: python3-sssdconfig
 
 %description -n python3-ipatests
 IPA is an integrated solution to provide centrally managed Identity (users,
@@ -704,7 +708,11 @@ make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
 
 
 %check
+%if ! %{ONLY_CLIENT}
 make %{?_smp_mflags} check VERBOSE=yes
+%else
+make %{?_smp_mflags} client-check VERBOSE=yes
+%endif # ONLY_CLIENT
 
 
 %install
@@ -753,6 +761,11 @@ make client-install DESTDIR=%{buildroot}
 (cd ipaclient && %{__python3} setup.py install --root %{buildroot})
 %endif # with_python3
 
+# Switch shebang of /usr/bin/ipa
+# XXX: ipa cli is not stable enough for enabling py3 support, keep it in py2
+# in any case
+sed -i -e'1s/python\(3\|$\)/python2/' %{buildroot}%{_bindir}/ipa
+
 %find_lang %{gettext_domain}
 
 mkdir -p %{buildroot}%{_usr}/share/ipa
@@ -1137,6 +1150,7 @@ fi
 %defattr(-,root,root,-)
 %doc README Contributors.txt
 %license COPYING
+%{python_sitelib}/freeipa-*.egg-info
 %dir %{python_sitelib}/ipaserver
 %dir %{python_sitelib}/ipaserver/install
 %dir %{python_sitelib}/ipaserver/install/plugins
@@ -1375,7 +1389,6 @@ fi
 %{python_sitelib}/ipaplatform/*
 %{python_sitelib}/ipapython-*.egg-info
 %{python_sitelib}/ipalib-*.egg-info
-%{python_sitelib}/freeipa-*.egg-info
 %{python_sitelib}/ipaplatform-*.egg-info
 
 
@@ -1454,6 +1467,9 @@ fi
 %endif # ONLY_CLIENT
 
 %changelog
+* Fri Jul 22 2016 Petr Vobornik <pvoborni@redhat.com> - 4.3.2-1
+- Update to upstream 4.3.2 - see http://www.freeipa.org/page/Releases/4.3.2
+
 * Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.3.1-2
 - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
 
diff --git a/sources b/sources
index 74107c1..367bb4e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-ec222fd2c7dad6400df60f95222b1edd  freeipa-4.3.1.tar.gz
+419d87905223df25fb76e7829abd4c36  freeipa-4.3.2.tar.gz