17 changed files with 1636 additions and 2095 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,116 @@
-SOURCES/sssd-2.9.4.tar.gz
+sssd-1.2.91.tar.gz
+/sssd-1.3.0.tar.gz
+/sssd-1.4.0.tar.gz
+/sssd-1.4.1.tar.gz
+/sssd-1.5.0.tar.gz
+/sssd-1.5.1.tar.gz
+/sssd-1.5.2.tar.gz
+/sssd-1.5.3.tar.gz
+/sssd-1.5.4.tar.gz
+/sssd-1.5.5.tar.gz
+/sssd-1.5.6.tar.gz
+/sssd-1.5.6.1.tar.gz
+/sssd-1.5.7.tar.gz
+/sssd-1.5.8.tar.gz
+/sssd-1.5.9.tar.gz
+/sssd-1.5.10.tar.gz
+/sssd-1.5.11.tar.gz
+/sssd-1.6.0.tar.gz
+/sssd-1.6.1.tar.gz
+/sssd-1.6.2.tar.gz
+/sssd-1.6.3.tar.gz
+/sssd-1.6.4.tar.gz
+/sssd-1.7.0.tar.gz
+/sssd-1.8.0beta1.tar.gz
+/sssd-1.8.0beta2.tar.gz
+/sssd-1.8.0beta3.tar.gz
+/sssd-1.8.0.tar.gz
+/sssd-1.8.1.tar.gz
+/sssd-1.8.2.tar.gz
+/sssd-1.8.3.tar.gz
+/sssd-1.9.0beta1.tar.gz
+/sssd-1.9.0beta2.tar.gz
+/sssd-1.9.0beta3.tar.gz
+/sssd-1.9.0beta4.tar.gz
+/sssd-1.9.0beta5.tar.gz
+/sssd-1.9.0beta6.tar.gz
+/sssd-1.9.0beta7.tar.gz
+/sssd-1.9.0rc1.tar.gz
+/sssd-1.9.0.tar.gz
+/sssd-1.9.1.tar.gz
+/sssd-1.9.2.tar.gz
+/sssd-1.9.3.tar.gz
+/sssd-1.9.4.tar.gz
+/sssd-1.10.0alpha1.tar.gz
+/sssd-1.10.0beta1.tar.gz
+/sssd-1.10.0beta2.tar.gz
+/sssd-1.10.0.tar.gz
+/sssd-1.10.1.tar.gz
+/sssd-1.11.0beta2.tar.gz
+/sssd-1.11.0.tar.gz
+/sssd-1.11.1.tar.gz
+/sssd-1.11.2.tar.gz
+/sssd-1.11.3.tar.gz
+/sssd-1.11.4.tar.gz
+/sssd-1.11.5.tar.gz
+/sssd-1.11.5.1.tar.gz
+/sssd-1.12.0beta1.tar.gz
+/sssd-1.12.0beta2.tar.gz
+/sssd-1.12.0.tar.gz
+/sssd-1.12.1.tar.gz
+/sssd-1.12.2.tar.gz
+/sssd-1.12.3.tar.gz
+/sssd-1.12.4.tar.gz
+/sssd-1.12.5.tar.gz
+/sssd-1.13.0alpha.tar.gz
+/sssd-1.13.0.tar.gz
+/sssd-1.13.1.tar.gz
+/sssd-1.13.2.tar.gz
+/sssd-1.13.3.tar.gz
+/sssd-1.13.4.tar.gz
+/sssd-1.14.0alpha.tar.gz
+/sssd-1.14.0beta1.tar.gz
+/sssd-1.14.0.tar.gz
+/sssd-1.14.1.tar.gz
+/sssd-1.14.2.tar.gz
+/sssd-1.15.0.tar.gz
+/sssd-1.15.1.tar.gz
+/sssd-1.15.2.tar.gz
+/sssd-1.15.3.tar.gz
+/sssd-1.16.0.tar.gz
+/sssd-1.16.1.tar.gz
+/sssd-1.16.2.tar.gz
+/sssd-2.0.0.tar.gz
+/sssd-2.1.0.tar.gz
+/sssd-2.2.0.tar.gz
+/sssd-2.2.1.tar.gz
+/sssd-2.2.2.tar.gz
+/sssd-2.2.3.tar.gz
+/sssd-2.3.0.tar.gz
+/sssd-2.3.1.tar.gz
+/sssd-2.4.0.tar.gz
+/sssd-2.4.1.tar.gz
+/sssd-2.4.2.tar.gz
+/sssd-2.5.0.tar.gz
+/sssd-2.5.1.tar.gz
+/sssd-2.5.2.tar.gz
+/sssd-2.6.0.tar.gz
+/sssd-2.6.1.tar.gz
+/sssd-2.6.2.tar.gz
+/sssd-2.6.3.tar.gz
+/sssd-2.7.0.tar.gz
+/sssd-2.7.1.tar.gz
+/sssd-2.7.3.tar.gz
+/sssd-2.7.4.tar.gz
+/sssd-2.8.0.tar.gz
+/sssd-2.8.1.tar.gz
+/sssd-2.8.2.tar.gz
+/sssd-2.9.0.tar.gz
+/sssd-2.9.1.tar.gz
+/sssd-2.9.2.tar.gz
+/sssd-2.9.3.tar.gz
+/sssd-2.9.4.tar.gz
+/sssd-2.10.0~beta1.tar.gz
+/sssd-2.10.0-beta1.tar.gz
+/sssd-2.10.0-beta2.tar.gz
+/sssd-2.10.0.tar.gz
--- a/.sssd.metadata
+++ b/.sssd.metadata
@ -1 +0,0 @@
-574f6cec9ee12dd943e4305286845343ab7bb891 SOURCES/sssd-2.9.4.tar.gz
--- a/0001-BUILD-configure-logrotate-to-work-with-non-root-grou.patch
+++ b/0001-BUILD-configure-logrotate-to-work-with-non-root-grou.patch
@ -0,0 +1,68 @@
+From e4ae4d6129e85fe99bbb82438ed90352400ecdf3 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Fri, 26 Jul 2024 15:55:01 +0200
+Subject: [PATCH] BUILD: configure logrotate to work with non-root-group
+ writable folder
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Otherwise logrotate complains:
+```
+error: skipping "/var/log/sssd/sssd_kcm.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
+```
+
+See https://bugzilla.redhat.com/show_bug.cgi?id=2299733 for details
+
+Reviewed-by: Jakub Vávra <jvavra@redhat.com>
+Reviewed-by: Justin Stephenson <jstephen@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+---
+ Makefile.am                              | 1 +
+ configure.ac                             | 1 +
+ src/examples/{logrotate => logrotate.in} | 1 +
+ 3 files changed, 3 insertions(+)
+ rename src/examples/{logrotate => logrotate.in} (90%)
+
+diff --git a/Makefile.am b/Makefile.am
+index f4cadee6f..82e0c5882 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -5706,6 +5706,7 @@ endif
+ 	rm -f $(builddir)/src/sysv/systemd/sssd-kcm.socket
+ 	rm -f $(builddir)/src/sysv/systemd/sssd-kcm.service
+ 	rm -f $(builddir)/src/tools/wrappers/sss_debuglevel
+	rm -Rf $(builddir)/src/examples
+ 	rm -Rf $(builddir)/contrib
+ 
+ CLEANFILES += *.X */*.X */*/*.X
+diff --git a/configure.ac b/configure.ac
+index 105d77a4d..380c16ba8 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -563,6 +563,7 @@ AC_DEFINE_UNQUOTED([ABS_SRC_DIR], ["$my_srcdir"], [Absolute path to the source d
+ AC_CONFIG_FILES([Makefile contrib/sssd.spec src/examples/rwtab src/doxy.config
+                  contrib/sssd-pcsc.rules contrib/90-sssd-token-access.rules
+                  contrib/sssd-tmpfiles.conf
+                 src/examples/logrotate
+                  src/sysv/sssd src/sysv/gentoo/sssd src/sysv/gentoo/sssd-kcm
+                  po/Makefile.in src/man/Makefile src/tests/cwrap/Makefile
+                  src/tests/intg/Makefile src/tests/test_CA/Makefile
+diff --git a/src/examples/logrotate b/src/examples/logrotate.in
+similarity index 90%
+rename from src/examples/logrotate
+rename to src/examples/logrotate.in
+index 6e769451c..0421946a2 100644
+--- a/src/examples/logrotate
+++ b/src/examples/logrotate.in
+@@ -6,6 +6,7 @@
+     rotate 2
+     compress
+     delaycompress
+    su @SSSD_USER@ @SSSD_USER@
+     postrotate
+         /bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null || true
+         /bin/pkill -HUP sssd_kcm 2> /dev/null || true
+-- 
+2.45.2
+
--- a/0001-ldap-add-exop_force-value-for-ldap_pwmodify_mode.patch
+++ b/0001-ldap-add-exop_force-value-for-ldap_pwmodify_mode.patch
@ -0,0 +1,230 @@
+From d523261c312c1ccab0253ddf14b54daba44ed268 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Fri, 13 Sep 2024 15:45:59 +0200
+Subject: [PATCH] ldap: add 'exop_force' value for ldap_pwmodify_mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In case the LDAP server allows to run the extended operation to change a
+password even if an authenticated bind fails due to missing grace logins
+the new option 'exop_force' can be used to run the extended operation to
+change the password anyways.
+
+:config: Added `exop_force` value for configuration option
+  `ldap_pwmodify_mode`. This can be used to force a password change even
+  if no grace logins are left. Depending on the configuration of the
+  LDAP server it might be expected that the password change will fail.
+
+Reviewed-by: Justin Stephenson <jstephen@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+(cherry picked from commit 7184541976608d357a5da48d09a7fa08862477d8)
+---
+ src/man/sssd-ldap.5.xml                    | 11 +++++++++
+ src/providers/ipa/ipa_auth.c               |  3 ++-
+ src/providers/ldap/ldap_auth.c             |  5 +++-
+ src/providers/ldap/ldap_options.c          |  2 ++
+ src/providers/ldap/sdap.h                  |  5 ++--
+ src/providers/ldap/sdap_async.h            |  3 ++-
+ src/providers/ldap/sdap_async_connection.c | 27 +++++++++++++++++-----
+ 7 files changed, 45 insertions(+), 11 deletions(-)
+
+diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
+index a6f9b1c97..d50aa65b2 100644
+--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
+@@ -234,6 +234,17 @@
+                                         userPassword (not recommended).
+                                     </para>
+                                 </listitem>
+                                <listitem>
+                                    <para>
+                                        exop_force - Try Password Modify
+                                        Extended Operation (RFC 3062) even if
+                                        there are no grace logins left.
+                                        Depending on the type and configuration
+                                        of the LDAP server the password change
+                                        might fail because an authenticated bind
+                                        is not possible.
+                                    </para>
+                                </listitem>
+                             </itemizedlist>
+                         </para>
+                         <para>
+diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
+index e238d0623..db1cd6ad3 100644
+--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
+@@ -397,7 +397,8 @@ static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq)
+                                   SDAP_USE_PPOLICY);
+ 
+     subreq = sdap_auth_send(state, state->ev, sh, NULL, NULL, dn,
+-                            state->pd->authtok, timeout, use_ppolicy);
+                            state->pd->authtok, timeout, use_ppolicy,
+                            state->auth_ctx->sdap_auth_ctx->opts->pwmodify_mode);
+     if (subreq == NULL) {
+         goto done;
+     }
+diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
+index 9ccbdabdb..370cdf171 100644
+--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
+@@ -914,7 +914,8 @@ static void auth_do_bind(struct tevent_req *req)
+     subreq = sdap_auth_send(state, state->ev, state->sh,
+                             NULL, NULL, state->dn,
+                             state->authtok,
+-                            timeout, use_ppolicy);
+                            timeout, use_ppolicy,
+                            state->ctx->opts->pwmodify_mode);
+     if (!subreq) {
+         tevent_req_error(req, ENOMEM);
+         return;
+@@ -1208,6 +1209,7 @@ sdap_pam_change_password_send(TALLOC_CTX *mem_ctx,
+ 
+     switch (opts->pwmodify_mode) {
+     case SDAP_PWMODIFY_EXOP:
+    case SDAP_PWMODIFY_EXOP_FORCE:
+         use_ppolicy = dp_opt_get_bool(opts->basic, SDAP_USE_PPOLICY);
+         subreq = sdap_exop_modify_passwd_send(state, ev, sh, user_dn,
+                                               password, new_password,
+@@ -1252,6 +1254,7 @@ static void sdap_pam_change_password_done(struct tevent_req *subreq)
+ 
+     switch (state->mode) {
+     case SDAP_PWMODIFY_EXOP:
+    case SDAP_PWMODIFY_EXOP_FORCE:
+         ret = sdap_exop_modify_passwd_recv(subreq, state,
+                                            &state->user_error_message);
+         break;
+diff --git a/src/providers/ldap/ldap_options.c b/src/providers/ldap/ldap_options.c
+index 277bcb529..72a95300d 100644
+--- a/src/providers/ldap/ldap_options.c
+++ b/src/providers/ldap/ldap_options.c
+@@ -294,6 +294,8 @@ int ldap_get_options(TALLOC_CTX *memctx,
+         opts->pwmodify_mode = SDAP_PWMODIFY_EXOP;
+     } else if (strcasecmp(pwmodify, "ldap_modify") == 0) {
+         opts->pwmodify_mode = SDAP_PWMODIFY_LDAP;
+    } else if (strcasecmp(pwmodify, "exop_force") == 0) {
+        opts->pwmodify_mode = SDAP_PWMODIFY_EXOP_FORCE;
+     } else {
+         DEBUG(SSSDBG_FATAL_FAILURE, "Unrecognized pwmodify mode: %s\n", pwmodify);
+         ret = EINVAL;
+diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
+index d66ca156a..35a4d5e1c 100644
+--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
+@@ -550,8 +550,9 @@ struct sdap_options {
+ 
+     /* password modify mode */
+     enum pwmodify_mode {
+-        SDAP_PWMODIFY_EXOP = 1,     /* pwmodify extended operation */
+-        SDAP_PWMODIFY_LDAP = 2      /* ldap_modify of userPassword */
+        SDAP_PWMODIFY_EXOP = 1,      /* pwmodify extended operation */
+        SDAP_PWMODIFY_LDAP = 2,      /* ldap_modify of userPassword */
+        SDAP_PWMODIFY_EXOP_FORCE = 3 /* forced pwmodify extended operation */
+     } pwmodify_mode;
+ 
+     /* The search bases for the domain or its subdomain */
+diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
+index a78a1157c..700cd6f9c 100644
+--- a/src/providers/ldap/sdap_async.h
+++ b/src/providers/ldap/sdap_async.h
+@@ -147,7 +147,8 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
+                                   const char *user_dn,
+                                   struct sss_auth_token *authtok,
+                                   int simple_bind_timeout,
+-                                  bool use_ppolicy);
+                                  bool use_ppolicy,
+                                  enum pwmodify_mode pwmodify_mode);
+ 
+ errno_t sdap_auth_recv(struct tevent_req *req,
+                        TALLOC_CTX *memctx,
+diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
+index a6d4ee443..67c09835b 100644
+--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
+@@ -646,6 +646,7 @@ struct simple_bind_state {
+     struct tevent_context *ev;
+     struct sdap_handle *sh;
+     const char *user_dn;
+    enum pwmodify_mode pwmodify_mode;
+ 
+     struct sdap_op *op;
+ 
+@@ -663,7 +664,8 @@ static struct tevent_req *simple_bind_send(TALLOC_CTX *memctx,
+                                            int timeout,
+                                            const char *user_dn,
+                                            struct berval *pw,
+-                                           bool use_ppolicy)
+                                           bool use_ppolicy,
+                                           enum pwmodify_mode pwmodify_mode)
+ {
+     struct tevent_req *req;
+     struct simple_bind_state *state;
+@@ -686,6 +688,7 @@ static struct tevent_req *simple_bind_send(TALLOC_CTX *memctx,
+     state->ev = ev;
+     state->sh = sh;
+     state->user_dn = user_dn;
+    state->pwmodify_mode = pwmodify_mode;
+ 
+     if (use_ppolicy) {
+         ret = sss_ldap_control_create(LDAP_CONTROL_PASSWORDPOLICYREQUEST,
+@@ -872,7 +875,12 @@ static void simple_bind_done(struct sdap_op *op,
+                      * Grace Authentications". */
+                     DEBUG(SSSDBG_TRACE_LIBS,
+                           "Password expired, grace logins exhausted.\n");
+-                    ret = ERR_AUTH_FAILED;
+                    if (state->pwmodify_mode == SDAP_PWMODIFY_EXOP_FORCE) {
+                        DEBUG(SSSDBG_TRACE_LIBS, "Password change forced.\n");
+                        ret = ERR_PASSWORD_EXPIRED;
+                    } else {
+                        ret = ERR_AUTH_FAILED;
+                    }
+                 }
+             } else if (strcmp(response_controls[c]->ldctl_oid,
+                               LDAP_CONTROL_PWEXPIRED) == 0) {
+@@ -885,7 +893,12 @@ static void simple_bind_done(struct sdap_op *op,
+                 if (result == LDAP_INVALID_CREDENTIALS) {
+                     DEBUG(SSSDBG_TRACE_LIBS,
+                           "Password expired, grace logins exhausted.\n");
+-                    ret = ERR_AUTH_FAILED;
+                    if (state->pwmodify_mode == SDAP_PWMODIFY_EXOP_FORCE) {
+                        DEBUG(SSSDBG_TRACE_LIBS, "Password change forced.\n");
+                        ret = ERR_PASSWORD_EXPIRED;
+                    } else {
+                        ret = ERR_AUTH_FAILED;
+                    }
+                 } else {
+                     DEBUG(SSSDBG_TRACE_LIBS,
+                           "Password expired, user must set a new password.\n");
+@@ -1365,7 +1378,8 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
+                                   const char *user_dn,
+                                   struct sss_auth_token *authtok,
+                                   int simple_bind_timeout,
+-                                  bool use_ppolicy)
+                                  bool use_ppolicy,
+                                  enum pwmodify_mode pwmodify_mode)
+ {
+     struct tevent_req *req, *subreq;
+     struct sdap_auth_state *state;
+@@ -1404,7 +1418,7 @@ struct tevent_req *sdap_auth_send(TALLOC_CTX *memctx,
+         pw.bv_len = pwlen;
+ 
+         state->is_sasl = false;
+-        subreq = simple_bind_send(state, ev, sh, simple_bind_timeout, user_dn, &pw, use_ppolicy);
+        subreq = simple_bind_send(state, ev, sh, simple_bind_timeout, user_dn, &pw, use_ppolicy, pwmodify_mode);
+         if (!subreq) {
+             tevent_req_error(req, ENOMEM);
+             return tevent_req_post(req, ev);
+@@ -1981,7 +1995,8 @@ static void sdap_cli_auth_step(struct tevent_req *req)
+                             dp_opt_get_int(state->opts->basic,
+                                            SDAP_OPT_TIMEOUT),
+                             dp_opt_get_bool(state->opts->basic,
+-                                            SDAP_USE_PPOLICY));
+                                            SDAP_USE_PPOLICY),
+                            state->opts->pwmodify_mode);
+     talloc_free(authtok);
+     if (!subreq) {
+         tevent_req_error(req, ENOMEM);
+-- 
+2.46.1
+
--- a/0002-TS_CACHE-never-try-to-upgrade-timestamps-cache.patch
+++ b/0002-TS_CACHE-never-try-to-upgrade-timestamps-cache.patch
@ -0,0 +1,207 @@
+From fc2a26c306e51b66680aef85aa0d2c41d8049a7f Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Tue, 16 Jul 2024 13:08:02 +0200
+Subject: [PATCH 2/3] TS_CACHE: never try to upgrade timestamps cache
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's easier and more consistent to recreate it instead.
+
+This is a natural extension of 3b67fc6488ac10ca13561d9032f59951f82203e6
+
+Reviewed-by: Alejandro López <allopez@redhat.com>
+Reviewed-by: Sumit Bose <sbose@redhat.com>
+Reviewed-by: Tomáš Halman <thalman@redhat.com>
+---
+ src/db/sysdb_init.c    | 103 +----------------------------------------
+ src/db/sysdb_upgrade.c |  45 ------------------
+ 2 files changed, 1 insertion(+), 147 deletions(-)
+
+diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
+index 85db5f9e1..ecf16fd11 100644
+--- a/src/db/sysdb_init.c
+++ b/src/db/sysdb_init.c
+@@ -348,57 +348,6 @@ static errno_t sysdb_cache_create_empty(struct ldb_context *ldb,
+     return EOK;
+ }
+ 
+-static errno_t sysdb_ts_cache_upgrade(TALLOC_CTX *mem_ctx,
+-                                      struct sysdb_ctx *sysdb,
+-                                      struct ldb_context *ldb,
+-                                      struct sss_domain_info *domain,
+-                                      const char *cur_version,
+-                                      const char **_new_version)
+-{
+-    errno_t ret;
+-    TALLOC_CTX *tmp_ctx;
+-    const char *version;
+-    struct ldb_context *save_ldb;
+-
+-    tmp_ctx = talloc_new(NULL);
+-    if (tmp_ctx == NULL) {
+-        return ENOMEM;
+-    }
+-
+-    /* The upgrade process depends on having ldb around, yet the upgrade
+-     * function shouldn't set the ldb pointer, only the connect function
+-     * should after it's successful. To avoid hard refactoring, save the
+-     * ldb pointer here and restore in the 'done' handler
+-     */
+-    save_ldb = sysdb->ldb;
+-    sysdb->ldb = ldb;
+-
+-    version = talloc_strdup(tmp_ctx, cur_version);
+-    if (version == NULL) {
+-        ret = ENOMEM;
+-        goto done;
+-    }
+-
+-    DEBUG(SSSDBG_CONF_SETTINGS,
+-          "Upgrading timstamp cache of DB [%s] from version: %s\n",
+-          domain->name, version);
+-
+-    if (strcmp(version, SYSDB_TS_VERSION_0_1) == 0) {
+-        ret = sysdb_ts_upgrade_01(sysdb, &version);
+-        if (ret != EOK) {
+-            goto done;
+-        }
+-    }
+-
+-    ret = EOK;
+-
+-done:
+-    sysdb->ldb = save_ldb;
+-    *_new_version = version;
+-    talloc_free(tmp_ctx);
+-    return ret;
+-}
+-
+ static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
+                                           struct sysdb_ctx *sysdb,
+                                           struct sysdb_dom_upgrade_ctx *upgrade_ctx,
+@@ -856,56 +805,6 @@ static int sysdb_timestamp_cache_connect(struct sysdb_ctx *sysdb,
+     }
+ 
+     ret = sysdb_ts_cache_connect(tmp_ctx, sysdb, domain, &ldb, &version);
+-    switch (ret) {
+-    case ERR_SYSDB_VERSION_TOO_OLD:
+-        if (upgrade_ctx == NULL) {
+-            DEBUG(SSSDBG_FATAL_FAILURE,
+-                  "DB version too old [%s], expected [%s] for domain %s!\n",
+-                   version, SYSDB_VERSION, domain->name);
+-            break;
+-        }
+-
+-        ret = sysdb_ts_cache_upgrade(tmp_ctx, sysdb, ldb, domain, version,
+-                                     &version);
+-        if (ret != EOK) {
+-            DEBUG(SSSDBG_MINOR_FAILURE,
+-                  "Could not upgrade the timestamp ldb file (%d) (%s)\n",
+-                  ret, sss_strerror(ret));
+-            break;
+-        }
+-
+-        /* The version should now match SYSDB_VERSION.
+-         * If not, it means we didn't match any of the
+-         * known older versions. The DB might be
+-         * corrupt or generated by a newer version of
+-         * SSSD.
+-         */
+-        ret = sysdb_version_check(SYSDB_TS_VERSION, version);
+-        if (ret == EOK) {
+-            /* The cache has been upgraded.
+-             * We need to reopen the LDB to ensure that
+-             * any changes made above take effect.
+-             */
+-            ret = sysdb_ldb_reconnect(tmp_ctx,
+-                                      sysdb->ldb_ts_file,
+-                                      LDB_FLG_NOSYNC,
+-                                      &ldb);
+-            if (ret != EOK) {
+-                DEBUG(SSSDBG_MINOR_FAILURE,
+-                      "Could not reopen the timestamp ldb file (%d) (%s)\n",
+-                      ret, sss_strerror(ret));
+-            }
+-        }
+-        break;
+-    case ERR_SYSDB_VERSION_TOO_NEW:
+-        DEBUG(SSSDBG_MINOR_FAILURE,
+-              "DB version too new [%s], expected [%s] for domain %s!\n",
+-              version, SYSDB_TS_VERSION, domain->name);
+-        break;
+-    default:
+-        break;
+-    }
+-
+     if (ret != EOK) {
+         DEBUG(SSSDBG_MINOR_FAILURE,
+               "The timestamps cache could not be opened. "
+@@ -925,7 +824,7 @@ static int sysdb_timestamp_cache_connect(struct sysdb_ctx *sysdb,
+         ret = sysdb_ts_cache_connect(tmp_ctx, sysdb, domain, &ldb, &version);
+         if (ret != EOK) {
+             DEBUG(SSSDBG_MINOR_FAILURE,
+-                  "Could not delete the timestamp ldb file (%d) (%s)\n",
+                  "sysdb_ts_cache_connect() failed after cache deletion [%d]: %s\n",
+                   ret, sss_strerror(ret));
+         }
+     }
+diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
+index 8fb17c6bb..05142d972 100644
+--- a/src/db/sysdb_upgrade.c
+++ b/src/db/sysdb_upgrade.c
+@@ -2820,51 +2820,6 @@ done:
+     return ret;
+ }
+ 
+-int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver)
+-{
+-    struct upgrade_ctx *ctx;
+-    errno_t ret;
+-    struct ldb_message *msg = NULL;
+-
+-    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_TS_VERSION_0_2, &ctx);
+-    if (ret) {
+-        return ret;
+-    }
+-
+-    /* Remove @IDXONE from index */
+-    talloc_free(msg);
+-    msg = ldb_msg_new(ctx);
+-    if (msg == NULL) {
+-        ret = ENOMEM;
+-        goto done;
+-    }
+-
+-    msg->dn = ldb_dn_new(msg, sysdb->ldb, "@INDEXLIST");
+-    if (msg->dn == NULL) {
+-        ret = ENOMEM;
+-        goto done;
+-    }
+-
+-    ret = ldb_msg_add_empty(msg, "@IDXONE", LDB_FLAG_MOD_DELETE, NULL);
+-    if (ret != LDB_SUCCESS) {
+-        ret = ENOMEM;
+-        goto done;
+-    }
+-
+-    ret = ldb_modify(sysdb->ldb, msg);
+-    if (ret != LDB_SUCCESS) {
+-        ret = sysdb_error_to_errno(ret);
+-        goto done;
+-    }
+-
+-    /* conversion done, update version number */
+-    ret = update_version(ctx);
+-
+-done:
+-    ret = finish_upgrade(ret, &ctx, ver);
+-    return ret;
+-}
+-
+ /*
+  * Example template for future upgrades.
+  * Copy and change version numbers as appropriate.
+-- 
+2.45.2
+
--- a/0003-SYSDB-remove-index-on-dataExpireTimestamp.patch
+++ b/0003-SYSDB-remove-index-on-dataExpireTimestamp.patch
@ -0,0 +1,146 @@
+From f0d45464cee1d2a6a2719dbffe5bbf6189d0554a Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Fri, 21 Jun 2024 19:09:29 +0200
+Subject: [PATCH 3/3] SYSDB: remove index on `dataExpireTimestamp`
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This index was only used in cleanup tasks that don't run often.
+On the other hand, this index is huge and degrades performance of libldb
+in general.
+
+Reviewed-by: Alejandro López <allopez@redhat.com>
+Reviewed-by: Sumit Bose <sbose@redhat.com>
+Reviewed-by: Tomáš Halman <thalman@redhat.com>
+---
+ src/db/sysdb_init.c    |  8 ++++++++
+ src/db/sysdb_private.h |  9 +++++----
+ src/db/sysdb_upgrade.c | 27 +++++++++++++++++++++++++++
+ 3 files changed, 40 insertions(+), 4 deletions(-)
+
+diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
+index ecf16fd11..507a97f63 100644
+--- a/src/db/sysdb_init.c
+++ b/src/db/sysdb_init.c
+@@ -531,6 +531,13 @@ static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
+         }
+     }
+ 
+    if (strcmp(version, SYSDB_VERSION_0_24) == 0) {
+        ret = sysdb_upgrade_24(sysdb, &version);
+        if (ret != EOK) {
+            goto done;
+        }
+    }
+
+     ret = EOK;
+ done:
+     sysdb->ldb = save_ldb;
+@@ -737,6 +744,7 @@ static int sysdb_domain_cache_connect(struct sysdb_ctx *sysdb,
+         ret = sysdb_domain_cache_upgrade(tmp_ctx, sysdb, upgrade_ctx,
+                                          ldb, domain, version, &version);
+         if (ret != EOK) {
+            DEBUG(SSSDBG_TRACE_FUNC, "sysdb_domain_cache_upgrade() failed\n");
+             goto done;
+         }
+ 
+diff --git a/src/db/sysdb_private.h b/src/db/sysdb_private.h
+index 2d7d6f62d..32d3f1c7e 100644
+--- a/src/db/sysdb_private.h
+++ b/src/db/sysdb_private.h
+@@ -23,6 +23,7 @@
+ #ifndef __INT_SYS_DB_H__
+ #define __INT_SYS_DB_H__
+ 
+#define SYSDB_VERSION_0_25 "0.25"
+ #define SYSDB_VERSION_0_24 "0.24"
+ #define SYSDB_VERSION_0_23 "0.23"
+ #define SYSDB_VERSION_0_22 "0.22"
+@@ -48,7 +49,7 @@
+ #define SYSDB_VERSION_0_2 "0.2"
+ #define SYSDB_VERSION_0_1 "0.1"
+ 
+-#define SYSDB_VERSION SYSDB_VERSION_0_24
+#define SYSDB_VERSION SYSDB_VERSION_0_25
+ 
+ #define SYSDB_BASE_LDIF \
+      "dn: @ATTRIBUTES\n" \
+@@ -73,7 +74,6 @@
+      "@IDXATTR: uidNumber\n" \
+      "@IDXATTR: gidNumber\n" \
+      "@IDXATTR: lastUpdate\n" \
+-     "@IDXATTR: dataExpireTimestamp\n" \
+      "@IDXATTR: originalDN\n" \
+      "@IDXATTR: nameAlias\n" \
+      "@IDXATTR: servicePort\n" \
+@@ -106,10 +106,11 @@
+      "\n"
+ 
+ /* The timestamp cache has its own versioning */
+#define SYSDB_TS_VERSION_0_3 "0.3"
+ #define SYSDB_TS_VERSION_0_2 "0.2"
+ #define SYSDB_TS_VERSION_0_1 "0.1"
+ 
+-#define SYSDB_TS_VERSION SYSDB_TS_VERSION_0_2
+#define SYSDB_TS_VERSION SYSDB_TS_VERSION_0_3
+ 
+ #define SYSDB_TS_BASE_LDIF \
+      "dn: @ATTRIBUTES\n" \
+@@ -117,7 +118,6 @@
+      "\n" \
+      "dn: @INDEXLIST\n" \
+      "@IDXATTR: lastUpdate\n" \
+-     "@IDXATTR: dataExpireTimestamp\n" \
+      "\n" \
+      "dn: cn=sysdb\n" \
+      "cn: sysdb\n" \
+@@ -196,6 +196,7 @@ int sysdb_upgrade_20(struct sysdb_ctx *sysdb, const char **ver);
+ int sysdb_upgrade_21(struct sysdb_ctx *sysdb, const char **ver);
+ int sysdb_upgrade_22(struct sysdb_ctx *sysdb, const char **ver);
+ int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver);
+int sysdb_upgrade_24(struct sysdb_ctx *sysdb, const char **ver);
+ 
+ int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver);
+ 
+diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
+index 05142d972..c0c8e13ee 100644
+--- a/src/db/sysdb_upgrade.c
+++ b/src/db/sysdb_upgrade.c
+@@ -2820,6 +2820,33 @@ done:
+     return ret;
+ }
+ 
+int sysdb_upgrade_24(struct sysdb_ctx *sysdb, const char **ver)
+{
+    struct upgrade_ctx *ctx;
+    errno_t ret;
+
+    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_VERSION_0_25, &ctx);
+    if (ret) {
+        return ret;
+    }
+
+    ret = sysdb_ldb_mod_index(sysdb, SYSDB_IDX_DELETE, sysdb->ldb, "dataExpireTimestamp");
+    if (ret == ENOENT) { /*nothing to delete */
+        ret = EOK;
+    }
+    if (ret != EOK) {
+        DEBUG(SSSDBG_TRACE_FUNC, "sysdb_ldb_mod_index() failed [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto done;
+    }
+
+    ret = update_version(ctx);
+
+done:
+    ret = finish_upgrade(ret, &ctx, ver);
+    return ret;
+}
+
+ /*
+  * Example template for future upgrades.
+  * Copy and change version numbers as appropriate.
+-- 
+2.45.2
+
--- a/0004-SPEC-merge-sssd-polkit-rules-into-sssd-common.patch
+++ b/0004-SPEC-merge-sssd-polkit-rules-into-sssd-common.patch
@ -0,0 +1,70 @@
+From a7d0bbeb5a8a41e80fec91d7d38b5dcb35eebe8f Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Tue, 23 Jul 2024 18:07:09 +0200
+Subject: [PATCH] SPEC: merge 'sssd-polkit-rules' into 'sssd-common'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+'p11_child' runs under non-privileged user and thus requires
+polkit-rules by default.
+
+Reviewed-by: Scott Poore <spoore@redhat.com>
+Reviewed-by: Sumit Bose <sbose@redhat.com>
+Reviewed-by: Tomáš Halman <thalman@redhat.com>
+---
+ contrib/sssd.spec.in | 20 ++++----------------
+ 1 file changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
+index c65be0d27..4edabce56 100644
+--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
+@@ -210,6 +210,9 @@ License: GPL-3.0-or-later
+ Obsoletes: libsss_simpleifp < 2.9.0
+ Obsoletes: libsss_simpleifp-debuginfo < 2.9.0
+ %endif
+%if %{use_sssd_user}
+Obsoletes: sssd-polkit-rules < 2.10.0
+%endif
+ # Requires
+ # due to ABI changes in 1.1.30/1.2.0
+ Requires: libldb >= %{ldb_version}
+@@ -470,19 +473,6 @@ Requires: sssd-common = %{version}-%{release}
+ Provides the D-Bus responder of the SSSD, called the InfoPipe, that allows
+ the information from the SSSD to be transmitted over the system bus.
+ 
+-%if %{use_sssd_user}
+-%package polkit-rules
+-Summary: Rules for polkit integration for SSSD
+-Group: Applications/System
+-License: GPL-3.0-or-later
+-Requires: polkit >= 0.106
+-Requires: sssd-common = %{version}-%{release}
+-
+-%description polkit-rules
+-Provides rules for polkit integration with SSSD. This is required
+-for smartcard support.
+-%endif
+-
+ %if 0%{?rhel} == 9
+ %package -n libsss_simpleifp
+ Summary: The SSSD D-Bus responder helper library
+@@ -885,13 +875,11 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
+ %if %{use_sysusers}
+ %{_sysusersdir}/sssd.conf
+ %endif
+-
+-
+ %if %{use_sssd_user}
+-%files polkit-rules
+ %{_datadir}/polkit-1/rules.d/*
+ %endif
+ 
+
+ %files ldap -f sssd_ldap.lang
+ %license COPYING
+ %{_libdir}/%{name}/libsss_ldap.so
+-- 
+2.45.2
+
--- a/SOURCES/0001-sssd-adding-mail-as-case-insensitive.patch
+++ b/SOURCES/0001-sssd-adding-mail-as-case-insensitive.patch
@ -1,144 +0,0 @@
-From dd0f63246aa75d5f53b44cbc185e88833e79976e Mon Sep 17 00:00:00 2001
-From: Andre Boscatto <andreboscatto@gmail.com>
-Date: Wed, 7 Feb 2024 12:28:28 +0100
-Subject: [PATCH] sssd: adding mail as case insensitive
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Resolves: https://github.com/SSSD/sssd/issues/7173
-
-Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
-Reviewed-by: Tomáš Halman <thalman@redhat.com>
-(cherry picked from commit 945cebcf72ef53ea0368f19c09e710f7fff11b51)
---
- src/db/sysdb_init.c    |  7 ++++++
- src/db/sysdb_private.h |  5 +++-
- src/db/sysdb_upgrade.c | 56 ++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 67 insertions(+), 1 deletion(-)
-
-diff --git a/src/db/sysdb_init.c b/src/db/sysdb_init.c
-index c2ea6c369..38a9cd64a 100644
--- a/src/db/sysdb_init.c
-+++ b/src/db/sysdb_init.c
-@@ -603,6 +603,13 @@ static errno_t sysdb_domain_cache_upgrade(TALLOC_CTX *mem_ctx,
-         }
-     }
- 
-+    if (strcmp(version, SYSDB_VERSION_0_23) == 0) {
-+        ret = sysdb_upgrade_23(sysdb, &version);
-+        if (ret != EOK) {
-+            goto done;
-+        }
-+    }
-+
-     ret = EOK;
- done:
-     sysdb->ldb = save_ldb;
-diff --git a/src/db/sysdb_private.h b/src/db/sysdb_private.h
-index 1f55007bc..63f7b5601 100644
--- a/src/db/sysdb_private.h
-+++ b/src/db/sysdb_private.h
-@@ -23,6 +23,7 @@
- #ifndef __INT_SYS_DB_H__
- #define __INT_SYS_DB_H__
- 
-+#define SYSDB_VERSION_0_24 "0.24"
- #define SYSDB_VERSION_0_23 "0.23"
- #define SYSDB_VERSION_0_22 "0.22"
- #define SYSDB_VERSION_0_21 "0.21"
-@@ -47,7 +48,7 @@
- #define SYSDB_VERSION_0_2 "0.2"
- #define SYSDB_VERSION_0_1 "0.1"
- 
-#define SYSDB_VERSION SYSDB_VERSION_0_23
-+#define SYSDB_VERSION SYSDB_VERSION_0_24
- 
- #define SYSDB_BASE_LDIF \
-      "dn: @ATTRIBUTES\n" \
-@@ -60,6 +61,7 @@
-      "objectclass: CASE_INSENSITIVE\n" \
-      "ipHostNumber: CASE_INSENSITIVE\n" \
-      "ipNetworkNumber: CASE_INSENSITIVE\n" \
-+     "mail: CASE_INSENSITIVE\n" \
-      "\n" \
-      "dn: @INDEXLIST\n" \
-      "@IDXATTR: cn\n" \
-@@ -191,6 +193,7 @@ int sysdb_upgrade_19(struct sysdb_ctx *sysdb, const char **ver);
- int sysdb_upgrade_20(struct sysdb_ctx *sysdb, const char **ver);
- int sysdb_upgrade_21(struct sysdb_ctx *sysdb, const char **ver);
- int sysdb_upgrade_22(struct sysdb_ctx *sysdb, const char **ver);
-+int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver);
- 
- int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver);
- 
-diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
-index 346a1cb0b..56083e6be 100644
--- a/src/db/sysdb_upgrade.c
-+++ b/src/db/sysdb_upgrade.c
-@@ -2718,6 +2718,62 @@ done:
-     return ret;
- }
- 
-+int sysdb_upgrade_23(struct sysdb_ctx *sysdb, const char **ver)
-+{
-+    TALLOC_CTX *tmp_ctx;
-+    int ret;
-+    struct ldb_message *msg;
-+    struct upgrade_ctx *ctx;
-+
-+    tmp_ctx = talloc_new(NULL);
-+    if (!tmp_ctx) {
-+        return ENOMEM;
-+    }
-+
-+    ret = commence_upgrade(sysdb, sysdb->ldb, SYSDB_VERSION_0_24, &ctx);
-+    if (ret) {
-+        return ret;
-+    }
-+
-+    /* Add new indexes */
-+    msg = ldb_msg_new(tmp_ctx);
-+    if (!msg) {
-+        ret = ENOMEM;
-+        goto done;
-+    }
-+    msg->dn = ldb_dn_new(tmp_ctx, sysdb->ldb, "@ATTRIBUTES");
-+    if (!msg->dn) {
-+        ret = ENOMEM;
-+        goto done;
-+    }
-+
-+    /* Case insensitive search for mail */
-+    ret = ldb_msg_add_empty(msg, SYSDB_USER_EMAIL, LDB_FLAG_MOD_ADD, NULL);
-+    if (ret != LDB_SUCCESS) {
-+        ret = ENOMEM;
-+        goto done;
-+    }
-+    ret = ldb_msg_add_string(msg, SYSDB_USER_EMAIL, "CASE_INSENSITIVE");
-+    if (ret != LDB_SUCCESS) {
-+        ret = ENOMEM;
-+        goto done;
-+    }
-+
-+    ret = ldb_modify(sysdb->ldb, msg);
-+    if (ret != LDB_SUCCESS) {
-+        ret = sysdb_error_to_errno(ret);
-+        goto done;
-+    }
-+
-+    /* conversion done, update version number */
-+    ret = update_version(ctx);
-+
-+done:
-+    ret = finish_upgrade(ret, &ctx, ver);
-+    talloc_free(tmp_ctx);
-+    return ret;
-+}
-+
- int sysdb_ts_upgrade_01(struct sysdb_ctx *sysdb, const char **ver)
- {
-     struct upgrade_ctx *ctx;
-- 
-2.41.0
-
--- a/SOURCES/0002-sdap-add-search_bases-option-to-groups_by_user_send.patch
+++ b/SOURCES/0002-sdap-add-search_bases-option-to-groups_by_user_send.patch
@ -1,154 +0,0 @@
-From a7621a5b464af7a3c8409dcbde038b35fee2c895 Mon Sep 17 00:00:00 2001
-From: Sumit Bose <sbose@redhat.com>
-Date: Tue, 23 Jan 2024 13:47:53 +0100
-Subject: [PATCH 2/3] sdap: add search_bases option to groups_by_user_send()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-AD handles users and computer objects very similar and so does SSSD's
-GPO code when lookup up the host's group-memberships. But users and
-computers might be stored in different sub-tree of the AD LDAP tree and
-if a dedicated user search base is given with the ldap_user_search_base
-option in sssd.conf the host object might be in a different sub-tree. To
-make sure the host can still be found this patch uses the base DN of
-the LDAP tree when searching for hosts in the GPO code.
-
-Resolves: https://github.com/SSSD/sssd/issues/5708
-
-Reviewed-by: Alejandro López <allopez@redhat.com>
-Reviewed-by: Tomáš Halman <thalman@redhat.com>
-(cherry picked from commit 29a77c6e79020d7e8cb474b4d3b394d390eba196)
---
- src/providers/ad/ad_gpo.c                  | 10 ++++++++++
- src/providers/ldap/ldap_common.h           |  1 +
- src/providers/ldap/ldap_id.c               |  6 +++++-
- src/providers/ldap/sdap_async.h            |  1 +
- src/providers/ldap/sdap_async_initgroups.c |  4 +++-
- 5 files changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
-index 94959c36b..b0ee3e616 100644
--- a/src/providers/ad/ad_gpo.c
-+++ b/src/providers/ad/ad_gpo.c
-@@ -2091,6 +2091,7 @@ ad_gpo_connect_done(struct tevent_req *subreq)
-     char *server_uri;
-     LDAPURLDesc *lud;
-     struct sdap_domain *sdom;
-+    struct sdap_search_base **search_bases;
- 
-     req = tevent_req_callback_data(subreq, struct tevent_req);
-     state = tevent_req_data(req, struct ad_gpo_access_state);
-@@ -2184,9 +2185,18 @@ ad_gpo_connect_done(struct tevent_req *subreq)
-         goto done;
-     }
- 
-+    ret = common_parse_search_base(state, sdom->basedn, state->ldb_ctx,
-+                                   "AD_HOSTS", NULL, &search_bases);
-+    if (ret != EOK) {
-+        DEBUG(SSSDBG_OP_FAILURE,
-+              "Failed to create dedicated search base for host lookups, "
-+              "trying with user search base.");
-+    }
-+
-     subreq = groups_by_user_send(state, state->ev,
-                                  state->access_ctx->ad_id_ctx->sdap_id_ctx,
-                                  sdom, state->conn,
-+                                 search_bases,
-                                  state->host_fqdn,
-                                  BE_FILTER_NAME,
-                                  NULL,
-diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h
-index 7159d6356..2c984ef50 100644
--- a/src/providers/ldap/ldap_common.h
-+++ b/src/providers/ldap/ldap_common.h
-@@ -304,6 +304,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
-                                        struct sdap_id_ctx *ctx,
-                                        struct sdap_domain *sdom,
-                                        struct sdap_id_conn_ctx *conn,
-+                                       struct sdap_search_base **search_bases,
-                                        const char *filter_value,
-                                        int filter_type,
-                                        const char *extra_value,
-diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
-index da54816bd..b3ea2333f 100644
--- a/src/providers/ldap/ldap_id.c
-+++ b/src/providers/ldap/ldap_id.c
-@@ -1139,6 +1139,7 @@ struct groups_by_user_state {
-     struct sdap_id_op *op;
-     struct sysdb_ctx *sysdb;
-     struct sss_domain_info *domain;
-+    struct sdap_search_base **search_bases;
- 
-     const char *filter_value;
-     int filter_type;
-@@ -1160,6 +1161,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
-                                        struct sdap_id_ctx *ctx,
-                                        struct sdap_domain *sdom,
-                                        struct sdap_id_conn_ctx *conn,
-+                                       struct sdap_search_base **search_bases,
-                                        const char *filter_value,
-                                        int filter_type,
-                                        const char *extra_value,
-@@ -1192,6 +1194,7 @@ struct tevent_req *groups_by_user_send(TALLOC_CTX *memctx,
-     state->extra_value = extra_value;
-     state->domain = sdom->dom;
-     state->sysdb = sdom->dom->sysdb;
-+    state->search_bases = search_bases;
- 
-     if (state->domain->type == DOM_TYPE_APPLICATION || set_non_posix) {
-         state->non_posix = true;
-@@ -1254,6 +1257,7 @@ static void groups_by_user_connect_done(struct tevent_req *subreq)
-                                   sdap_id_op_handle(state->op),
-                                   state->ctx,
-                                   state->conn,
-+                                  state->search_bases,
-                                   state->filter_value,
-                                   state->filter_type,
-                                   state->extra_value,
-@@ -1449,7 +1453,7 @@ sdap_handle_acct_req_send(TALLOC_CTX *mem_ctx,
-         }
- 
-         subreq = groups_by_user_send(state, be_ctx->ev, id_ctx,
-                                     sdom, conn,
-+                                     sdom, conn, NULL,
-                                      ar->filter_value,
-                                      ar->filter_type,
-                                      ar->extra_value,
-diff --git a/src/providers/ldap/sdap_async.h b/src/providers/ldap/sdap_async.h
-index 5458d21f1..89245f41f 100644
--- a/src/providers/ldap/sdap_async.h
-+++ b/src/providers/ldap/sdap_async.h
-@@ -158,6 +158,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
-                                         struct sdap_handle *sh,
-                                         struct sdap_id_ctx *id_ctx,
-                                         struct sdap_id_conn_ctx *conn,
-+                                        struct sdap_search_base **search_bases,
-                                         const char *name,
-                                         int filter_type,
-                                         const char *extra_value,
-diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
-index 97be594a3..fb3d8fe24 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
-+++ b/src/providers/ldap/sdap_async_initgroups.c
-@@ -2732,6 +2732,7 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
-                                         struct sdap_handle *sh,
-                                         struct sdap_id_ctx *id_ctx,
-                                         struct sdap_id_conn_ctx *conn,
-+                                        struct sdap_search_base **search_bases,
-                                         const char *filter_value,
-                                         int filter_type,
-                                         const char *extra_value,
-@@ -2764,7 +2765,8 @@ struct tevent_req *sdap_get_initgr_send(TALLOC_CTX *memctx,
-     state->orig_user = NULL;
-     state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT);
-     state->user_base_iter = 0;
-    state->user_search_bases = sdom->user_search_bases;
-+    state->user_search_bases = (search_bases == NULL) ? sdom->user_search_bases
-+                                                      : search_bases;
-     if (!state->user_search_bases) {
-         DEBUG(SSSDBG_CRIT_FAILURE,
-               "Initgroups lookup request without a user search base\n");
-- 
-2.41.0
-
--- a/SOURCES/0003-sdap-add-naming_context-as-new-member-of-struct-sdap.patch
+++ b/SOURCES/0003-sdap-add-naming_context-as-new-member-of-struct-sdap.patch
@ -1,194 +0,0 @@
-From 6a8e60df84d5d2565bec36be19c2def25a6ece1f Mon Sep 17 00:00:00 2001
-From: Sumit Bose <sbose@redhat.com>
-Date: Wed, 24 Jan 2024 14:21:12 +0100
-Subject: [PATCH 3/3] sdap: add naming_context as new member of struct
- sdap_domain
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The naming_context could be a more reliable source than basedn for the
-actual base DN because basedn is set very early from the domain name
-given in sssd.conf. Although it is recommended to use the fully
-qualified DNS domain name here it is not required. As a result basedn
-might not reflect the actual based DN of the LDAP server. Also pure LDAP
-server (i.e. not AD or FreeIPA) might use different schemes to set the
-base DN which will not be based on the DNS domain of the LDAP server.
-
-Resolves: https://github.com/SSSD/sssd/issues/5708
-
-Reviewed-by: Alejandro López <allopez@redhat.com>
-Reviewed-by: Tomáš Halman <thalman@redhat.com>
-(cherry picked from commit a153f13f296401247a862df2b99048bb1bbb8e2e)
---
- src/providers/ad/ad_gpo.c |  6 ++++--
- src/providers/ldap/sdap.c | 36 +++++++++++++-----------------------
- src/providers/ldap/sdap.h | 11 +++++++++++
- 3 files changed, 28 insertions(+), 25 deletions(-)
-
-diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
-index b0ee3e616..3d1ad39c7 100644
--- a/src/providers/ad/ad_gpo.c
-+++ b/src/providers/ad/ad_gpo.c
-@@ -2185,8 +2185,10 @@ ad_gpo_connect_done(struct tevent_req *subreq)
-         goto done;
-     }
- 
-    ret = common_parse_search_base(state, sdom->basedn, state->ldb_ctx,
-                                   "AD_HOSTS", NULL, &search_bases);
-+    ret = common_parse_search_base(state,
-+                                   sdom->naming_context == NULL ? sdom->basedn
-+                                                                : sdom->naming_context,
-+                                   state->ldb_ctx, "AD_HOSTS", NULL, &search_bases);
-     if (ret != EOK) {
-         DEBUG(SSSDBG_OP_FAILURE,
-               "Failed to create dedicated search base for host lookups, "
-diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
-index f5637c5fb..956eba93a 100644
--- a/src/providers/ldap/sdap.c
-+++ b/src/providers/ldap/sdap.c
-@@ -1252,19 +1252,10 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-                                              struct sdap_domain *sdom)
- {
-     int ret;
-    char *naming_context = NULL;
- 
-    if (!sdom->search_bases
-            || !sdom->user_search_bases
-            || !sdom->group_search_bases
-            || !sdom->netgroup_search_bases
-            || !sdom->host_search_bases
-            || !sdom->sudo_search_bases
-            || !sdom->iphost_search_bases
-            || !sdom->ipnetwork_search_bases
-            || !sdom->autofs_search_bases) {
-        naming_context = get_naming_context(opts->basic, rootdse);
-        if (naming_context == NULL) {
-+    if (!sdom->naming_context) {
-+        sdom->naming_context = get_naming_context(sdom, rootdse);
-+        if (sdom->naming_context == NULL) {
-             DEBUG(SSSDBG_CRIT_FAILURE, "get_naming_context failed.\n");
- 
-             /* This has to be non-fatal, since some servers offer
-@@ -1280,7 +1271,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1288,7 +1279,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->user_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_USER_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1296,7 +1287,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->group_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_GROUP_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1304,7 +1295,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->netgroup_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_NETGROUP_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1312,7 +1303,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->host_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_HOST_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1320,7 +1311,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->sudo_search_bases) {
-        ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_SUDO_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1328,7 +1319,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->service_search_bases) {
-        ret = sdap_set_search_base(opts, sdom,
-                                   SDAP_SERVICE_SEARCH_BASE,
-                                  naming_context);
-+                                  sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1336,7 +1327,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->autofs_search_bases) {
-        ret = sdap_set_search_base(opts, sdom,
-                                   SDAP_AUTOFS_SEARCH_BASE,
-                                  naming_context);
-+                                  sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1344,7 +1335,7 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->iphost_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_IPHOST_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-@@ -1352,14 +1343,13 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
-     if (!sdom->ipnetwork_search_bases) {
-         ret = sdap_set_search_base(opts, sdom,
-                                    SDAP_IPNETWORK_SEARCH_BASE,
-                                   naming_context);
-+                                   sdom->naming_context);
-         if (ret != EOK) goto done;
-     }
- 
-     ret = EOK;
- 
- done:
-    talloc_free(naming_context);
-     return ret;
- }
- 
-diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
-index 161bc5c26..103d50ed4 100644
--- a/src/providers/ldap/sdap.h
-+++ b/src/providers/ldap/sdap.h
-@@ -454,6 +454,17 @@ struct sdap_domain {
- 
-     char *basedn;
- 
-+    /* The naming_context could be a more reliable source than basedn for the
-+     * actual base DN because basedn is set very early from the domain name
-+     * given in sssd.conf. Although it is recommended to use the fully
-+     * qualified DNS domain name here it is not required. As a result basedn
-+     * might not reflect the actual based DN of the LDAP server. Also pure
-+     * LDAP server (i.e. not AD or FreeIPA) might use different schemes to set
-+     * the base DN which will not be based on the DNS domain of the LDAP
-+     * server. naming_context might be NULL even after connection to an LDAP
-+     * server. */
-+    char *naming_context;
-+
-     struct sdap_search_base **search_bases;
-     struct sdap_search_base **user_search_bases;
-     struct sdap_search_base **group_search_bases;
-- 
-2.41.0
-
--- a/SOURCES/0004-pam-fix-SC-auth-with-multiple-certs-and-missing-logi.patch
+++ b/SOURCES/0004-pam-fix-SC-auth-with-multiple-certs-and-missing-logi.patch
@ -1,233 +0,0 @@
-From 50077c3255177fe1b01837fbe31a7f8fd47dee74 Mon Sep 17 00:00:00 2001
-From: Sumit Bose <sbose@redhat.com>
-Date: Thu, 18 Jan 2024 13:08:17 +0100
-Subject: [PATCH] pam: fix SC auth with multiple certs and missing login name
-
-While introducing the local_auth_policy option a quite specific use-case
-was not covered correctly. If there are multiple matching certificates
-on the Smartcard, 'local_auth_policy = only' is set and GDM's Smartcard
-mode was used for login, i.e. there is no user name given and the user
-has to be derived from the certificate used for login, authentication
-failed. The main reason for the failure is that in this case the
-Smartcard interaction and the user mapping has to be done first to
-determine the user before local_auth_policy is evaluated. As a result
-when checking if the authentication can be finished the request was in
-an unexpected state because the indicator for local Smartcard
-authentication was not enabled.
-
-Resolves: https://github.com/SSSD/sssd/issues/7109
-
-Reviewed-by: Justin Stephenson <jstephen@redhat.com>
-Reviewed-by: Scott Poore <spoore@redhat.com>
-(cherry picked from commit 44ec3e4638b0c6f7f45a3390a28c2e8745d52bc3)
---
- src/responder/pam/pamsrv.h           | 10 ++++
- src/responder/pam/pamsrv_cmd.c       | 17 +++++--
- src/tests/intg/Makefile.am           |  2 +
- src/tests/intg/test_pam_responder.py | 74 +++++++++++++++++++++++++++-
- 4 files changed, 96 insertions(+), 7 deletions(-)
-
-diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h
-index 7013a8edd..618836189 100644
--- a/src/responder/pam/pamsrv.h
-+++ b/src/responder/pam/pamsrv.h
-@@ -93,7 +93,17 @@ struct pam_auth_req {
-     struct ldb_message *user_obj;
-     struct cert_auth_info *cert_list;
-     struct cert_auth_info *current_cert;
-+    /* Switched to 'true' if the backend indicates that it cannot handle
-+     * Smartcard authentication, but Smartcard authentication is
-+     * possible and local Smartcard authentication is allowed. */
-     bool cert_auth_local;
-+    /* Switched to 'true' if authentication (not pre-authentication) was
-+     * started without a login name and the name had to be lookup up with the
-+     * certificate used for authentication. Since reading the certificate from
-+     * the Smartcard already involves the PIN validation in this case there
-+     * would be no need for an additional Smartcard interaction if only local
-+     * Smartcard authentication is possible. */
-+    bool initial_cert_auth_successful;
- 
-     bool passkey_data_exists;
-     uint32_t client_id_num;
-diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
-index c23ea7ba4..a7c181733 100644
--- a/src/responder/pam/pamsrv_cmd.c
-+++ b/src/responder/pam/pamsrv_cmd.c
-@@ -2200,8 +2200,8 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
-                 ret = ENOENT;
-                 goto done;
-             }
-
-            if (cert_count > 1) {
-+            /* Multiple certificates are only expected during pre-auth */
-+            if (cert_count > 1 && preq->pd->cmd == SSS_PAM_PREAUTH) {
-                 for (preq->current_cert = preq->cert_list;
-                      preq->current_cert != NULL;
-                      preq->current_cert = sss_cai_get_next(preq->current_cert)) {
-@@ -2285,7 +2285,9 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
-             }
- 
-             /* If logon_name was not given during authentication add a
-             * SSS_PAM_CERT_INFO message to send the name to the caller. */
-+             * SSS_PAM_CERT_INFO message to send the name to the caller.
-+             * Additionally initial_cert_auth_successful is set to
-+             * indicate that the user is already authenticated. */
-             if (preq->pd->cmd == SSS_PAM_AUTHENTICATE
-                     && preq->pd->logon_name == NULL) {
-                 ret = add_pam_cert_response(preq->pd,
-@@ -2297,6 +2299,8 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)
-                     preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL;
-                     goto done;
-                 }
-+
-+                preq->initial_cert_auth_successful = true;
-             }
- 
-             /* cert_user will be returned to the PAM client as user name, so
-@@ -2851,12 +2855,15 @@ static void pam_dom_forwarder(struct pam_auth_req *preq)
-         if (found) {
-             if (local_policy != NULL && strcasecmp(local_policy, "only") == 0) {
-                 talloc_free(tmp_ctx);
-                DEBUG(SSSDBG_IMPORTANT_INFO, "Local auth only set, skipping online auth\n");
-+                DEBUG(SSSDBG_IMPORTANT_INFO,
-+                      "Local auth only set and matching certificate was found, "
-+                      "skipping online auth\n");
-                 if (preq->pd->cmd == SSS_PAM_PREAUTH) {
-                     preq->pd->pam_status = PAM_SUCCESS;
-                 } else if (preq->pd->cmd == SSS_PAM_AUTHENTICATE
-                                 && IS_SC_AUTHTOK(preq->pd->authtok)
-                                && preq->cert_auth_local) {
-+                                && (preq->cert_auth_local
-+                                        || preq->initial_cert_auth_successful)) {
-                     preq->pd->pam_status = PAM_SUCCESS;
-                     preq->callback = pam_reply;
-                 }
-diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
-index 3866d3ca6..0cfd268dc 100644
--- a/src/tests/intg/Makefile.am
-+++ b/src/tests/intg/Makefile.am
-@@ -199,6 +199,7 @@ clean-local:
- 
- PAM_CERT_DB_PATH="$(abs_builddir)/../test_CA/SSSD_test_CA.pem"
- SOFTHSM2_CONF="$(abs_builddir)/../test_CA/softhsm2_one.conf"
-+SOFTHSM2_TWO_CONF="$(abs_builddir)/../test_CA/softhsm2_two.conf"
- 
- intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service pam_sss_sc_required pam_sss_try_sc pam_sss_allow_missing_name pam_sss_domains sss_netgroup_thread_test
- 	pipepath="$(DESTDIR)$(pipepath)"; \
-@@ -233,6 +234,7 @@ intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service
- 	PAM_CERT_DB_PATH=$(PAM_CERT_DB_PATH) \
- 	ABS_SRCDIR=$(abs_srcdir) \
- 	SOFTHSM2_CONF=$(SOFTHSM2_CONF) \
-+	SOFTHSM2_TWO_CONF=$(SOFTHSM2_TWO_CONF) \
- 	KCM_RENEW=$(KCM_RENEW) \
- 	FILES_PROVIDER=$(FILES_PROVIDER) \
- 	DBUS_SOCK_DIR="$(DESTDIR)$(runstatedir)/dbus/" \
-diff --git a/src/tests/intg/test_pam_responder.py b/src/tests/intg/test_pam_responder.py
-index 1fc3937e6..0fbf8065e 100644
--- a/src/tests/intg/test_pam_responder.py
-+++ b/src/tests/intg/test_pam_responder.py
-@@ -168,7 +168,7 @@ def format_pam_cert_auth_conf(config, provider):
-         {provider.p}
- 
-         [certmap/auth_only/user1]
-        matchrule = <SUBJECT>.*CN=SSSD test cert 0001.*
-+        matchrule = <SUBJECT>.*CN=SSSD test cert 000[12].*
-     """).format(**locals())
- 
- 
-@@ -201,7 +201,7 @@ def format_pam_cert_auth_conf_name_format(config, provider):
-         {provider.p}
- 
-         [certmap/auth_only/user1]
-        matchrule = <SUBJECT>.*CN=SSSD test cert 0001.*
-+        matchrule = <SUBJECT>.*CN=SSSD test cert 000[12].*
-     """).format(**locals())
- 
- 
-@@ -380,6 +380,28 @@ def simple_pam_cert_auth_no_cert(request, passwd_ops_setup):
-     return None
- 
- 
-+@pytest.fixture
-+def simple_pam_cert_auth_two_certs(request, passwd_ops_setup):
-+    """Setup SSSD with pam_cert_auth=True"""
-+    config.PAM_CERT_DB_PATH = os.environ['PAM_CERT_DB_PATH']
-+
-+    old_softhsm2_conf = os.environ['SOFTHSM2_CONF']
-+    softhsm2_two_conf = os.environ['SOFTHSM2_TWO_CONF']
-+    os.environ['SOFTHSM2_CONF'] = softhsm2_two_conf
-+
-+    conf = format_pam_cert_auth_conf(config, provider_switch(request.param))
-+    create_conf_fixture(request, conf)
-+    create_sssd_fixture(request)
-+
-+    os.environ['SOFTHSM2_CONF'] = old_softhsm2_conf
-+
-+    passwd_ops_setup.useradd(**USER1)
-+    passwd_ops_setup.useradd(**USER2)
-+    sync_files_provider(USER2['name'])
-+
-+    return None
-+
-+
- @pytest.fixture
- def simple_pam_cert_auth_name_format(request, passwd_ops_setup):
-     """Setup SSSD with pam_cert_auth=True and full_name_format"""
-@@ -522,6 +544,54 @@ def test_sc_auth(simple_pam_cert_auth, env_for_sssctl):
-     assert err.find("pam_authenticate for user [user1]: Success") != -1
- 
- 
-+@pytest.mark.parametrize('simple_pam_cert_auth_two_certs', provider_list(), indirect=True)
-+def test_sc_auth_two(simple_pam_cert_auth_two_certs, env_for_sssctl):
-+
-+    sssctl = subprocess.Popen(["sssctl", "user-checks", "user1",
-+                               "--action=auth", "--service=pam_sss_service"],
-+                              universal_newlines=True,
-+                              env=env_for_sssctl, stdin=subprocess.PIPE,
-+                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-+
-+    try:
-+        out, err = sssctl.communicate(input="2\n123456")
-+    except Exception:
-+        sssctl.kill()
-+        out, err = sssctl.communicate()
-+
-+    sssctl.stdin.close()
-+    sssctl.stdout.close()
-+
-+    if sssctl.wait() != 0:
-+        raise Exception("sssctl failed")
-+
-+    assert err.find("pam_authenticate for user [user1]: Success") != -1
-+
-+
-+@pytest.mark.parametrize('simple_pam_cert_auth_two_certs', provider_list(), indirect=True)
-+def test_sc_auth_two_missing_name(simple_pam_cert_auth_two_certs, env_for_sssctl):
-+
-+    sssctl = subprocess.Popen(["sssctl", "user-checks", "",
-+                               "--action=auth", "--service=pam_sss_allow_missing_name"],
-+                              universal_newlines=True,
-+                              env=env_for_sssctl, stdin=subprocess.PIPE,
-+                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-+
-+    try:
-+        out, err = sssctl.communicate(input="2\n123456")
-+    except Exception:
-+        sssctl.kill()
-+        out, err = sssctl.communicate()
-+
-+    sssctl.stdin.close()
-+    sssctl.stdout.close()
-+
-+    if sssctl.wait() != 0:
-+        raise Exception("sssctl failed")
-+
-+    assert err.find("pam_authenticate for user [user1]: Success") != -1
-+
-+
- @pytest.mark.parametrize('simple_pam_cert_auth', ['proxy_password'], indirect=True)
- def test_sc_proxy_password_fallback(simple_pam_cert_auth, env_for_sssctl):
-     """
-- 
-2.41.0
-
--- a/SOURCES/0005-ad-gpo-use-hash-to-store-intermediate-results.patch
+++ b/SOURCES/0005-ad-gpo-use-hash-to-store-intermediate-results.patch
@ -1,218 +0,0 @@
-From e1bfbc2493c4194988acc3b2413df3dde0735ae3 Mon Sep 17 00:00:00 2001
-From: Sumit Bose <sbose@redhat.com>
-Date: Wed, 8 Nov 2023 14:50:24 +0100
-Subject: [PATCH] ad-gpo: use hash to store intermediate results
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Currently after the evaluation of a single GPO file the intermediate
-results are stored in the cache and this cache entry is updated until
-all applicable GPO files are evaluated. Finally the data in the cache is
-used to make the decision of access is granted or rejected.
-
-If there are two or more access-control request running in parallel one
-request might overwrite the cache object with intermediate data while
-another request reads the cached data for the access decision and as a
-result will do this decision based on intermediate data.
-
-To avoid this the intermediate results are not stored in the cache
-anymore but in hash tables which are specific to the request. Only the
-final result is written to the cache to have it available for offline
-authentication.
-
-Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
-Reviewed-by: Tomáš Halman <thalman@redhat.com>
-(cherry picked from commit d7db7971682da2dbf7642ac94940d6b0577ec35a)
---
- src/providers/ad/ad_gpo.c | 116 +++++++++++++++++++++++++++++++++-----
- 1 file changed, 102 insertions(+), 14 deletions(-)
-
-diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
-index 3d1ad39c7..b879b0a08 100644
--- a/src/providers/ad/ad_gpo.c
-+++ b/src/providers/ad/ad_gpo.c
-@@ -1431,6 +1431,33 @@ ad_gpo_extract_policy_setting(TALLOC_CTX *mem_ctx,
-     return ret;
- }
- 
-+static errno_t
-+add_result_to_hash(hash_table_t *hash, const char *key, char *value)
-+{
-+    int hret;
-+    hash_key_t k;
-+    hash_value_t v;
-+
-+    if (hash == NULL || key == NULL || value == NULL) {
-+        return EINVAL;
-+    }
-+
-+    k.type = HASH_KEY_CONST_STRING;
-+    k.c_str = key;
-+
-+    v.type = HASH_VALUE_PTR;
-+    v.ptr = value;
-+
-+    hret = hash_enter(hash, &k, &v);
-+    if (hret != HASH_SUCCESS) {
-+        DEBUG(SSSDBG_OP_FAILURE, "Failed to add [%s][%s] to hash: [%s].\n",
-+                                 key, value, hash_error_string(hret));
-+        return EIO;
-+    }
-+
-+    return EOK;
-+}
-+
- /*
-  * This function parses the cse-specific (GP_EXT_GUID_SECURITY) filename,
-  * and stores the allow_key and deny_key of all of the gpo_map_types present
-@@ -1438,6 +1465,7 @@ ad_gpo_extract_policy_setting(TALLOC_CTX *mem_ctx,
-  */
- static errno_t
- ad_gpo_store_policy_settings(struct sss_domain_info *domain,
-+                             hash_table_t *allow_maps, hash_table_t *deny_maps,
-                              const char *filename)
- {
-     struct ini_cfgfile *file_ctx = NULL;
-@@ -1571,14 +1599,14 @@ ad_gpo_store_policy_settings(struct sss_domain_info *domain,
-                 goto done;
-             } else if (ret != ENOENT) {
-                 const char *value = allow_value ? allow_value : empty_val;
-                ret = sysdb_gpo_store_gpo_result_setting(domain,
-                                                         allow_key,
-                                                         value);
-+                ret = add_result_to_hash(allow_maps, allow_key,
-+                                         talloc_strdup(allow_maps, value));
-                 if (ret != EOK) {
-                    DEBUG(SSSDBG_CRIT_FAILURE,
-                          "sysdb_gpo_store_gpo_result_setting failed for key:"
-                          "'%s' value:'%s' [%d][%s]\n", allow_key, allow_value,
-                          ret, sss_strerror(ret));
-+                    DEBUG(SSSDBG_CRIT_FAILURE, "Failed to add key: [%s] "
-+                                               "value: [%s] to allow maps "
-+                                               "[%d][%s].\n",
-+                                               allow_key, value, ret,
-+                                               sss_strerror(ret));
-                     goto done;
-                 }
-             }
-@@ -1598,14 +1626,14 @@ ad_gpo_store_policy_settings(struct sss_domain_info *domain,
-                 goto done;
-             } else if (ret != ENOENT) {
-                 const char *value = deny_value ? deny_value : empty_val;
-                ret = sysdb_gpo_store_gpo_result_setting(domain,
-                                                         deny_key,
-                                                         value);
-+                ret = add_result_to_hash(deny_maps, deny_key,
-+                                         talloc_strdup(deny_maps, value));
-                 if (ret != EOK) {
-                    DEBUG(SSSDBG_CRIT_FAILURE,
-                          "sysdb_gpo_store_gpo_result_setting failed for key:"
-                          "'%s' value:'%s' [%d][%s]\n", deny_key, deny_value,
-                          ret, sss_strerror(ret));
-+                    DEBUG(SSSDBG_CRIT_FAILURE, "Failed to add key: [%s] "
-+                                               "value: [%s] to deny maps "
-+                                               "[%d][%s].\n",
-+                                               deny_key, value, ret,
-+                                               sss_strerror(ret));
-                     goto done;
-                 }
-             }
-@@ -1902,6 +1930,8 @@ struct ad_gpo_access_state {
-     int num_cse_filtered_gpos;
-     int cse_gpo_index;
-     const char *ad_domain;
-+    hash_table_t *allow_maps;
-+    hash_table_t *deny_maps;
- };
- 
- static void ad_gpo_connect_done(struct tevent_req *subreq);
-@@ -2023,6 +2053,19 @@ ad_gpo_access_send(TALLOC_CTX *mem_ctx,
-         goto immediately;
-     }
- 
-+    ret = sss_hash_create(state, 0, &state->allow_maps);
-+    if (ret != EOK) {
-+        DEBUG(SSSDBG_FATAL_FAILURE, "Could not create allow maps "
-+              "hash table [%d]: %s\n", ret, sss_strerror(ret));
-+        goto immediately;
-+    }
-+
-+    ret = sss_hash_create(state, 0, &state->deny_maps);
-+    if (ret != EOK) {
-+        DEBUG(SSSDBG_FATAL_FAILURE, "Could not create deny maps "
-+              "hash table [%d]: %s\n", ret, sss_strerror(ret));
-+        goto immediately;
-+    }
- 
-     subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
-     if (subreq == NULL) {
-@@ -2713,6 +2756,43 @@ ad_gpo_cse_step(struct tevent_req *req)
-     return EAGAIN;
- }
- 
-+static errno_t
-+store_hash_maps_in_cache(struct sss_domain_info *domain,
-+                         hash_table_t *allow_maps, hash_table_t *deny_maps)
-+{
-+    int ret;
-+    struct hash_iter_context_t *iter;
-+    hash_entry_t *entry;
-+    size_t c;
-+    hash_table_t *hash_list[] = { allow_maps, deny_maps, NULL};
-+
-+
-+    for (c = 0; hash_list[c] != NULL; c++) {
-+        iter = new_hash_iter_context(hash_list[c]);
-+        if (iter == NULL) {
-+            DEBUG(SSSDBG_OP_FAILURE, "Failed to create hash iterator.\n");
-+            return EINVAL;
-+        }
-+
-+        while ((entry = iter->next(iter)) != NULL) {
-+            ret = sysdb_gpo_store_gpo_result_setting(domain,
-+                                                     entry->key.c_str,
-+                                                     entry->value.ptr);
-+            if (ret != EOK) {
-+                free(iter);
-+                DEBUG(SSSDBG_OP_FAILURE,
-+                      "sysdb_gpo_store_gpo_result_setting failed for key:"
-+                      "[%s] value:[%s] [%d][%s]\n", entry->key.c_str,
-+                      (char *) entry->value.ptr, ret, sss_strerror(ret));
-+                return ret;
-+            }
-+        }
-+        talloc_free(iter);
-+    }
-+
-+    return EOK;
-+}
-+
- /*
-  * This cse-specific function (GP_EXT_GUID_SECURITY) increments the
-  * cse_gpo_index until the policy settings for all applicable GPOs have been
-@@ -2754,6 +2834,7 @@ ad_gpo_cse_done(struct tevent_req *subreq)
-      * (as part of the GPO Result object in the sysdb cache).
-      */
-     ret = ad_gpo_store_policy_settings(state->host_domain,
-+                                       state->allow_maps, state->deny_maps,
-                                        cse_filtered_gpo->policy_filename);
-     if (ret != EOK && ret != ENOENT) {
-         DEBUG(SSSDBG_OP_FAILURE,
-@@ -2767,6 +2848,13 @@ ad_gpo_cse_done(struct tevent_req *subreq)
- 
-     if (ret == EOK) {
-         /* ret is EOK only after all GPO policy files have been downloaded */
-+        ret = store_hash_maps_in_cache(state->host_domain,
-+                                       state->allow_maps, state->deny_maps);
-+        if (ret != EOK) {
-+            DEBUG(SSSDBG_OP_FAILURE, "Failed to store evaluated GPO maps "
-+                                     "[%d][%s].\n", ret, sss_strerror(ret));
-+            goto done;
-+        }
-         ret = ad_gpo_perform_hbac_processing(state,
-                                              state->gpo_mode,
-                                              state->gpo_map_type,
-- 
-2.44.0
-
--- a/SOURCES/0006-ad-refresh-root-domain-when-read-directly.patch
+++ b/SOURCES/0006-ad-refresh-root-domain-when-read-directly.patch
@ -1,81 +0,0 @@
-From db27a51f274640e1aa2f13476c80955a3ec9e91c Mon Sep 17 00:00:00 2001
-From: Sumit Bose <sbose@redhat.com>
-Date: Fri, 1 Mar 2024 10:50:07 +0100
-Subject: [PATCH] ad: refresh root domain when read directly
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-If the domain object of the forest root domain cannot be found in the
-LDAP tree of the local AD domain SSSD tries to read the request data
-from an LDAP server of the forest root domain directly. After reading
-this data the information is stored in the cache but currently the
-information about the domain store in memory is not updated with the
-additional data. As a result e.g. the domain SID is missing in this data
-and only becomes available after a restart where it is read from the
-cache.
-
-With this patch an unconditional refresh is triggered at the end of the
-fallback code path.
-
-Resolves: https://github.com/SSSD/sssd/issues/7250
-
-Reviewed-by: Dan Lavu <dlavu@redhat.com>
-Reviewed-by: Tomáš Halman <thalman@redhat.com>
-(cherry picked from commit 0de6c33047ac7a2b5316ec5ec936d6b675671c53)
---
- src/providers/ad/ad_subdomains.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
-index a8d1892cc..d8f3738ce 100644
--- a/src/providers/ad/ad_subdomains.c
-+++ b/src/providers/ad/ad_subdomains.c
-@@ -1395,7 +1395,7 @@ struct ad_get_root_domain_state {
- static void ad_get_root_domain_done(struct tevent_req *subreq);
- static void ad_check_root_domain_done(struct tevent_req *subreq);
- static errno_t
-ad_get_root_domain_refresh(struct ad_get_root_domain_state *state);
-+ad_get_root_domain_refresh(struct ad_get_root_domain_state *state, bool refresh);
- 
- struct tevent_req *
- ad_check_domain_send(TALLOC_CTX *mem_ctx,
-@@ -1582,7 +1582,7 @@ static void ad_get_root_domain_done(struct tevent_req *subreq)
-         return;
-     }
- 
-    ret = ad_get_root_domain_refresh(state);
-+    ret = ad_get_root_domain_refresh(state, false);
-     if (ret != EOK) {
-         DEBUG(SSSDBG_OP_FAILURE, "ad_get_root_domain_refresh() failed.\n");
-     }
-@@ -1682,7 +1682,7 @@ static void ad_check_root_domain_done(struct tevent_req *subreq)
- 
-     state->reply_count = 1;
- 
-    ret = ad_get_root_domain_refresh(state);
-+    ret = ad_get_root_domain_refresh(state, true);
-     if (ret != EOK) {
-         DEBUG(SSSDBG_OP_FAILURE, "ad_get_root_domain_refresh() failed.\n");
-     }
-@@ -1697,7 +1697,7 @@ done:
- }
- 
- static errno_t
-ad_get_root_domain_refresh(struct ad_get_root_domain_state *state)
-+ad_get_root_domain_refresh(struct ad_get_root_domain_state *state, bool refresh)
- {
-     struct sss_domain_info *root_domain;
-     bool has_changes;
-@@ -1713,7 +1713,7 @@ ad_get_root_domain_refresh(struct ad_get_root_domain_state *state)
-         goto done;
-     }
- 
-    if (has_changes) {
-+    if (has_changes || refresh) {
-         ret = ad_subdom_reinit(state->sd_ctx);
-         if (ret != EOK) {
-             DEBUG(SSSDBG_OP_FAILURE, "Could not reinitialize subdomains\n");
-- 
-2.45.0
-
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,8 @@
+# recipients: sssd-qe
+--- !Policy
+product_versions:
+  - rhel-10
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: idm-ci.brew-build.tier1.functional}
+
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA512 (sssd-2.10.0.tar.gz) = d237ff135fb21bcd1040787d6dfe8fa383290fbae1f15c6917284beb38dd95ecf6418335302e26be40c65e44e8b44135499eec0b98119ea53a38098ac0bc1e2c
--- a/SPECS/sssd.spec
+++ b/SPECS/sssd.spec
--- a/sssd.sysusers
+++ b/sssd.sysusers
@ -0,0 +1 @@
+u     sssd   -   "User for sssd"     /run/sssd/      /sbin/nologin
				`@ -1 +0,0 @@`
				`574f6cec9ee12dd943e4305286845343ab7bb891 SOURCES/sssd-2.9.4.tar.gz`
				`@ -0,0 +1 @@`
				`SHA512 (sssd-2.10.0.tar.gz) = d237ff135fb21bcd1040787d6dfe8fa383290fbae1f15c6917284beb38dd95ecf6418335302e26be40c65e44e8b44135499eec0b98119ea53a38098ac0bc1e2c`
				`@ -0,0 +1 @@`
				`u sssd - "User for sssd" /run/sssd/ /sbin/nologin`