diff --git a/0003-AD-add-missing-AD_AT_DOMAIN_NAME-for-sub-domain-sear.patch b/0003-AD-add-missing-AD_AT_DOMAIN_NAME-for-sub-domain-sear.patch
new file mode 100644
index 0000000..6d2d7f6
--- /dev/null
+++ b/0003-AD-add-missing-AD_AT_DOMAIN_NAME-for-sub-domain-sear.patch
@@ -0,0 +1,28 @@
+From e5dfa2a8c3cdb4db8749ae1b37cec8185070bc69 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Tue, 23 May 2023 12:36:28 +0200
+Subject: [PATCH] AD: add missing AD_AT_DOMAIN_NAME for sub-domain search
+
+Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
+Reviewed-by: Justin Stephenson <jstephen@redhat.com>
+(cherry picked from commit 39b6337f32b76842be65802b0b0aa86050c8aa95)
+---
+ src/providers/ad/ad_subdomains.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
+index db7f1c3c7..a8d1892cc 100644
+--- a/src/providers/ad/ad_subdomains.c
++++ b/src/providers/ad/ad_subdomains.c
+@@ -1216,7 +1216,7 @@ static void ad_get_slave_domain_connect_done(struct tevent_req *subreq)
+     int dp_error;
+     errno_t ret;
+     const char *attrs[] = { AD_AT_FLATNAME, AD_AT_TRUST_PARTNER,
+-                            AD_AT_SID, AD_AT_TRUST_TYPE,
++                            AD_AT_SID, AD_AT_TRUST_TYPE, AD_AT_DOMAIN_NAME,
+                             AD_AT_TRUST_ATTRS, AD_AT_TRUST_DIRECTION, NULL };
+ 
+     req = tevent_req_callback_data(subreq, struct tevent_req);
+-- 
+2.38.1
+
diff --git a/sssd.spec b/sssd.spec
index 01807be..1229b8d 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -19,7 +19,7 @@
 
 Name: sssd
 Version: 2.9.0
-Release: 2%{?dist}
+Release: 3%{?dist}
 Group: Applications/System
 Summary: System Security Services Daemon
 License: GPLv3+
@@ -29,6 +29,7 @@ Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{versio
 ### Patches ###
 Patch0001: 0001-FILE-WATCH-Callback-not-executed-on-link-or-relative.patch
 Patch0002: 0002-MAN-fix-issue-with-multithread-build.patch
+Patch0003: 0003-AD-add-missing-AD_AT_DOMAIN_NAME-for-sub-domain-sear.patch
 
 ### Downstream Patches ###
 
@@ -1212,6 +1213,9 @@ fi
 %systemd_postun_with_restart sssd.service
 
 %changelog
+* Thu May 25 2023 Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-3
+- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
+
 * Mon May 15 2023 Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
 - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
 - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)