From 4d5e968afc26915b5c85e23486b602d485df965c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jakub.hrozek@posteo.se>
Date: Aug 10 2017 09:54:48 +0000
Subject: Re-add upstream 1.13 release notes


---

diff --git a/users/releases.rst b/users/releases.rst
index 6a18864..734dbff 100644
--- a/users/releases.rst
+++ b/users/releases.rst
@@ -20,9 +20,17 @@ for a longer time than other releases.
 
 1.13.x Series (LTM)
 ^^^^^^^^^^^^^^^^^^^
-+---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+-------------+--------------------------------------------------------------+
-|`sssd-1.13.4.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.4.tar.gz>`_ |`sssd-1.13.4.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.4.tar.gz.asc>`_ |SHA1SUM: ``8332501d752ab82f994170d11d31d5d15912b2e9``|Date: 2016-04-13|Release Notes|`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.4/man/>`_|
-+---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+-------------+--------------------------------------------------------------+
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-1.13.4.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.4.tar.gz>`_ |`sssd-1.13.4.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.4.tar.gz.asc>`_ |SHA1SUM: ``8332501d752ab82f994170d11d31d5d15912b2e9``|Date: 2016-04-13|:doc:`Release notes <relnotes/notes_1_13_4>` |`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.4/man/>`_|
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-1.13.3.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.3.tar.gz>`_ |`sssd-1.13.3.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.3.tar.gz.asc>`_ |SHA1SUM: ``333bccc6c037f6153dcfea9f7ebfefa9fd853512``|Date: 2015-12-15|:doc:`Release notes <relnotes/notes_1_13_3>` |`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.3/man/>`_|
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-1.13.2.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.2.tar.gz>`_ |`sssd-1.13.2.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.2.tar.gz.asc>`_ |SHA1SUM: ``30bfc03448140983ee49fa7ef363612bd31a156f``|Date: 2015-11-19|:doc:`Release notes <relnotes/notes_1_13_2>` |`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.2/man/>`_|
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-1.13.1.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.1.tar.gz>`_ |`sssd-1.13.1.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.1.tar.gz.asc>`_ |SHA1SUM: ``ae2b202abe9d62c24294f4d174717638dc24bce2``|Date: 2015-09-30|:doc:`Release notes <relnotes/notes_1_13_1>` |`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.1/man/>`_|
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
+|`sssd-1.13.0.tar.gz <https://releases.pagure.org/SSSD/sssd/sssd-1.13.0.tar.gz>`_ |`sssd-1.13.0.tar.gz.asc <https://releases.pagure.org/SSSD/sssd/sssd-1.13.0.tar.gz.asc>`_ |SHA1SUM: ``f9c57cfb91d8e0e35d565a1d5b165e8f669989d2``|Date: 2015-07-06|:doc:`Release notes <relnotes/notes_1_13_0>` |`Manpages <http://jhrozek.fedorapeople.org/sssd/1.13.0/man/>`_|
++---------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-----------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+
 
 List of all release notes
 ^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/users/relnotes/notes_1_13_0.rst b/users/relnotes/notes_1_13_0.rst
new file mode 100644
index 0000000..bbb4bd5
--- /dev/null
+++ b/users/relnotes/notes_1_13_0.rst
@@ -0,0 +1,463 @@
+SSSD 1.13.0
+===========
+
+Highlights
+----------
+
+-  Support for separate prompts when using two-factor authentication was
+   added
+-  Added support for one-way trusts between an IPA and Active Directory
+   environment. Please note that this SSSD functionality depends on IPA
+   code that will be released in the IPA 4.2 version
+-  The fast memory cache now also supports the initgroups operation.
+-  The PAM responder is now capable of caching authentication for
+   configurable period, which might reduce server load in cases where
+   accounts authenticate very frequently. Please refer to the
+   ``cached_auth_timeout`` option in the ``sssd.conf`` manual page.
+-  The Active Directory provider has changed the default value of the
+   ``ad_gpo_access_control`` option from ``permissive`` to
+   ``enforcing``. As a consequence, the GPO access control now affects
+   all clients that set ``access_provider`` to ``ad``. In order to
+   restore the previous behaviour, set ``ad_gpo_access_control`` to
+   ``permissive`` or use a different ``access_provider`` type.
+-  Group Policy objects defined in a different AD domain that the
+   computer object is defined in are now supported.
+-  Credential caching and Offline authentication are also available when
+   using two-factor authentication
+-  Many enhancements to the InfoPipe D-Bus API. Notably, the SSSD users
+   and groups are now exposed as first-class objects. The users and
+   groups can also be marked as cached and would subsequently show up in
+   the Introspection output
+-  The DBus interface is now also able to look up User objects by
+   certificate. This is a first part of work that will eventually allow
+   smart-card authentication in SSSD.
+-  The LDAP cleanup task is now disabled by default, unless enumeration
+   is enabled. Please refer to the ``ldap_purge_cache_timeout`` option
+   in case your environment requires the cleanup task
+-  The Python bindings are now built for both Python2 and Python3
+-  The LDAP bind timeout, StartTLS timeout and password change timeout
+   are now configurable using the ``ldap_opt_timeout`` option
+
+Packaging Changes
+-----------------
+
+-  A new directory ``/var/lib/sss/keytabs`` is present and owned by the
+   ``sssd-ipa`` subpackage. The SSSD stores keytabs for one-way trust
+   relationships in this directory. Downstreams should make sure that
+   the directory is only readable to the user who runs the SSSD service.
+-  Several packaging changes are present in this release to support the
+   Python3 bindings, notably new ``python-sss`` and
+   ``python-sss-murmur`` subpackages are introduced in upstream RPM
+   packaging
+-  All python bindings now have a Python3 and a Python2 version in the
+   upstream RPM packaging scheme
+-  The OpenSSL development library such as ``openssl-devel`` on
+   RHEL/Fedora or
+   `Debian/Ubuntu? <https://docs.pagure.org/sssd-test2/Debian/Ubuntu.html>`__
+   ``libssl-dev`` is now required to support certificate operations
+-  A new internal library ``libsss_cert.so`` is present in this release.
+-  The fast initgroups memcache is represented by a new file
+   ``/var/lib/sss/mc/initgroups``
+
+Documentation Changes
+---------------------
+
+-  The ``ad_gpo_access_control`` option default has changed from
+   ``permissive`` to ``enforcing``
+-  The default value of ``ldap_purge_cache_timeout`` changed to 0, thus
+   effectivelly disabling the cleanup task.
+-  A new option ``cache_credentials_minimal_first_factor_length`` was
+   added. This option sets constraints on the password length if
+   One-Time passwords are used and credentials are to be cached. Please
+   see the ``sssd.conf(5)`` man page for more details
+-  The cached authentication is controlled by new option
+   ``cached_auth_timeout``. By default the cached authentication is
+   disabled.
+
+Tickets Fixed
+-------------
+
+.. raw:: html
+
+   <div>
+
+`#897 </sssd/ticket/897>`__
+    sssd should pass -d to nsupdate when running with high log level
+`#1501 </sssd/ticket/1501>`__
+    Make the LDAP bind operation timeout configurable
+`#2150 </sssd/ticket/2150>`__
+    [RFE] Expose listing calls over D-BUS
+`#2224 </sssd/ticket/2224>`__
+    nsupdate stderr is not captured
+`#2236 </sssd/ticket/2236>`__
+    The cleanup task has no DEBUG statements
+`#2326 </sssd/ticket/2326>`__
+    SBUS: Flush the UID cache when we receive NameOwnerChanged
+`#2338 </sssd/ticket/2338>`__
+    [RFE] Implement object caching on the bus
+`#2339 </sssd/ticket/2339>`__
+    IFP: support multiple interfaces for object
+`#2540 </sssd/ticket/2540>`__
+    SSSD does not update Dynamic DNS records if the IPA domain differs
+    from machine hostname's domain
+`#2569 </sssd/ticket/2569>`__
+    In ipa-ad trust, with 'default\_domain\_suffix' set to AD domain,
+    IPA user are not able to log unless use\_fully\_qualified\_names is
+    set
+`#2574 </sssd/ticket/2574>`__
+    SSSD should be able to build python2 and python3 bindings in a one
+    build
+`#2583 </sssd/ticket/2583>`__
+    [RFE] Homedir is always overwritten with subdomain\_homedir value in
+    server mode
+`#2593 </sssd/ticket/2593>`__
+    Does sssd-ad use the most suitable attribute for group name?
+`#2596 </sssd/ticket/2596>`__
+    Add a way to lookup users based on CAC identity certificates
+`#2603 </sssd/ticket/2603>`__
+    Make SSSD's HBAC validation more permissive if deny rules are not
+    used
+`#2609 </sssd/ticket/2609>`__
+    [bug] sssd always appends default\_domain\_suffix when checking for
+    host keys
+`#2618 </sssd/ticket/2618>`__
+    Man sssd-ad(5) lists Group Policy Management Editor naming for some
+    policies but not for all
+`#2620 </sssd/ticket/2620>`__
+    id\_provider=proxy with auth\_provider=ldap does not work reliably
+`#2625 </sssd/ticket/2625>`__
+    Sudo responder does not respect filter\_users and filter\_groups
+`#2627 </sssd/ticket/2627>`__
+    Disable the cleanup task by default
+`#2636 </sssd/ticket/2636>`__
+    RFE: Fetch keytabs for one-way trusts in IPA subdomain code
+`#2638 </sssd/ticket/2638>`__
+    RFE: Change ad\_id\_ctx instantiation in the IPA subdomain code to
+    support one-way trusts
+`#2645 </sssd/ticket/2645>`__
+    [RFE] Support GPOs from different domain controllers
+`#2661 </sssd/ticket/2661>`__
+    RFE: Change AD GPO default to enforcing
+`#2666 </sssd/ticket/2666>`__
+    sssd with ldap backend throws error domain log
+
+.. raw:: html
+
+   </div>
+
+.. raw:: html
+
+   <div>
+
+`#1807 </sssd/ticket/1807>`__
+    [RFE] authenticate against cache in SSSD
+`#2017 </sssd/ticket/2017>`__
+    [RFE] Python 3 support
+`#2485 </sssd/ticket/2485>`__
+    [RFE] The fast memory cache should cache initgroups
+`#2590 </sssd/ticket/2590>`__
+    SSSD doesn't re-read resolv.conf if the file doesn't exist during
+    boot
+`#2641 </sssd/ticket/2641>`__
+    Add a IS\_DEFAULT\_VIEW macro
+`#2701 </sssd/ticket/2701>`__
+    Kerberos-based providers other than krb5 do not queue requests
+
+.. raw:: html
+
+   </div>
+
+Detailed Changelog
+------------------
+
+Jakub Hrozek (73):
+
+-  MAN: Fix a typo
+-  SYSDB: Reduce code duplication in sysdb\_gpo.c
+-  UTIL: Make two child\_common.c functions static
+-  TESTS: Cover child\_common.c with unit tests
+-  LDAP: Use child\_io\_destructor instead of child\_cleanup in a custom
+   desctructor
+-  UTIL: Remove child\_cleanup
+-  UTIL: Unify the fd\_nonblocking implementation
+-  RESOLV: Remove obsolete in-tree implementation of SRV and TXT parsing
+-  PAM: print the pam status as string, too
+-  KRB5: More debugging for create\_ccache()
+-  SDAP: Make simple bind timeout configurable
+-  SDAP: Make password change timeout configurable with
+   ldap\_opt\_timeout
+-  SDAP: Make StartTLS bind configurable with ldap\_opt\_timeout
+-  SDAP: Decorate the sdap\_op functions with DEBUG messages
+-  IPA: Remove the ipa\_hbac\_treat\_deny\_as option
+-  MAN: Clarify debug\_level a bit
+-  SSH: Ignore the default\_domain\_suffix
+-  LDAP: Set sdap handle as explicitly connected in LDAP auth
+-  tests: Revert strcmp condition
+-  ncache: Fix sss\_ncache\_reset\_permanent
+-  ncache: Silence critical error from filter\_users when
+   default\_domain\_suffix is set
+-  ncache: Add sss\_ncache\_reset\_repopulate\_permanent
+-  responders: reset ncache after domains are discovered during startup
+-  NSS: Reset negcache after checking domains
+-  MAN: Clarify how are GPO mappings called in GPO editor
+-  UTIL: Add a simple function to get the fd of debug\_file
+-  dyndns: Log nsupdate stderr with a high debug level
+-  nsupdate: Append -d/-D to nsupdate with a high debug level
+-  subdom: Remove unused function get\_flat\_name\_from\_subdomain\_name
+-  nss: Use negcache for getbysid requests
+-  tests: Add NSS responder tests for bysid requests
+-  LDAP: disable the cleanup task by default
+-  TESTS: Use the right testcase
+-  TESTS: Add test for get\_next\_domain
+-  LDAP: Do not print verbose DEBUG messages from providers that don't
+   set UUID
+-  SYSDB: Store trust direction for subdomains
+-  UTIL/SYSDB: Move new\_subdomain() to sysdb\_subdomains.c and make it
+   private
+-  TESTS: Add a test for sysdb\_subdomains.c
+-  SYSDB: Add realm to sysdb\_master\_domain\_add\_info
+-  SYSDB: Add a forest root attribute to sss\_domain\_info
+-  IPA: Add ipa\_subdomains\_handler\_get\_{start,cont} wrappers
+-  IPA: Check master domain record before subdomain records
+-  IPA: Fold ipa\_subdom\_enumerates into ipa\_subdom\_store
+-  IPA: Also update master domain when initializing subdom handler
+-  IPA: Move server-mode functions to a separate module
+-  IPA: Split two functions to new module ipa\_subdomains\_utils.c
+-  IPA: Include ipaNTTrustDirection in the attribute set for trusted
+   domains
+-  IPA: Read forest name for trusted forest roots as well
+-  IPA: Make constructing an IPA server mode context async
+-  TESTS: Split off keytab creation into a common module
+-  TESTS: Add a common mock\_be\_ctx function
+-  TESTS: Add a common function to set up sdap\_id\_ctx
+-  TESTS: Move krb5\_try\_kdcip to nested group test
+-  TESTS: Add unit test for the subdomain\_server.c module
+-  IPA: Fetch keytab for 1way trusts
+-  AD: Rename ad\_set\_ad\_id\_options to ad\_set\_sdap\_options
+-  AD: Rename ad\_create\_default\_options to
+   ad\_create\_2way\_trust\_options
+-  AD: Split off ad\_create\_default\_options
+-  IPA/AD: Set up AD domain in ad\_create\_2way\_trust\_options
+-  IPA: Do not set AD\_KRB5\_REALM twice
+-  AD: Add ad\_create\_1way\_trust\_options
+-  IPA: Utility function for setting up one-way trust context
+-  LDAP: Do not set keytab through environment variable
+-  LDAP: Consolidate SDAP\_SASL\_REALM/SDAP\_KRB5\_REALM behaviour
+-  CONFIG: Add SSS\_STATEDIR as VARDIR/lib/sss
+-  BUILD: Store keytabs in /var/lib/sss/keytabs
+-  Updating the translations for the 1.13 Alpha release
+-  Updating the version.m4 file for the 1.13 Beta release
+-  tests: Reduce duplication with new function test\_ev\_done
+-  KRB5: Add and use krb5\_auth\_queue\_send to queue requests by
+   default
+-  PAM: Only cache first-factor
+-  Updating the translations for the 1.13.0 release
+-  Updating the version for the 1.13.0 release
+
+John Dickerson (1):
+
+-  MAN: Amend the description of ignore\_group\_members
+
+Lukas Slebodnik (67):
+
+-  MAN: Remove indentation in element programlistening
+-  Fix warning: for loop has empty body
+-  Bump version to track 1.13 development
+-  SPEC: Use libnl3 for epel6
+-  MAKE: Don't include autoconf generated file to tarball
+-  TESTS: Mock return value of sdap\_get\_generic\_recv
+-  test\_nested\_groups: Additional unit tests
+-  Fix warning: equality comparison with extraneous parentheses
+-  LDAP: Conditional jump depends on uninitialised value
+-  BUILD: Remove unused libraries for pysss.so
+-  BUILD: Remove unused variables
+-  BUILD: Remove detection of type Py\_ssize\_t
+-  UTIL: Remove python wrapper sss\_python\_set\_new
+-  UTIL: Remove python wrapper sss\_python\_set\_add
+-  UTIL: Remove python wrapper sss\_python\_set\_check
+-  UTIL: Remove compatibility macro PyModule\_AddIntMacro
+-  UTIL: Remove python wrapper sss\_python\_unicode\_from\_string
+-  BUILD: Use python-config for detection \*FLAGS
+-  SPEC: Use new convention for python packages
+-  SPEC: Move python bindings to separate packages
+-  BUILD: Add possibility to build python{2,3} bindings
+-  TESTS: Run python tests with all supported python versions
+-  SPEC: Replace python\_ macros with python2\_
+-  SPEC: Build python3 bindings on available platforms
+-  BUILD: Uninstall also symbolic links to python bindings
+-  Remove unused argument from be\_nsupdate\_create\_fwd\_msg
+-  IPA: Remove unused argument from ipa\_id\_get\_group\_uuids
+-  Remove useless assignment to function parameter
+-  PAC: Fix memory leak
+-  responder\_cache: Fix warning may be used uninitialized
+-  debug-tests: Fix test with new line in debug message
+-  BUILD: Add missing header file to tarball
+-  pam\_client: fix casting to const pointer
+-  test\_expire: Use right assertion macro for standard functions
+-  test\_ldap\_auth: Use right assertion for integer comparison
+-  test\_resolv\_fake: Fix alignment warning
+-  PAC: Remove unused function
+-  KRB5: Unify prototype and definition
+-  util-tests: Initialize boolean variable to default value
+-  SPEC: Drop workaround for old libtool
+-  SPEC: Drop workarounds for old rpmbuild
+-  SPEC: Remove unused option
+-  SPEC: Few cosmetic changes
+-  simple\_access-tests: Simplify assertion
+-  sysdb-tests: Add missing assertions
+-  sysdb-tests: test return value before output arguments
+-  ad\_opts: Use different default attribute for group name
+-  BUILD: Write hints about optional python bindings
+-  sss\_client: Fix mixed enums
+-  LDAP: Remove dead assignment
+-  sss\_client: Fix warning "\_" redefined
+-  SSSDConfigTest: Use unique temporary directory
+-  util-tests: Add validation of internal error messages
+-  SDAP: Check return value before using output arguments
+-  SDAP: Log failure from sysdb\_handle\_original\_uuid
+-  test\_ipa\_subdomains\_server: Run clean-up after success
+-  IFP: Fix warnings with enabled optimisation
+-  SDAP: Remove user from cache for missing user in LDAP
+-  test\_ipa\_subdom\_server: Add missing assert
+-  test\_ipa\_subdomains\_server: Fix build with --coverage
+-  nss: Store entries in responder to initgr mmap cache
+-  mmap\_cache: Invalidate entry in right memory cache
+-  nss: Invalidate entry in initgr mmap cache
+-  sss\_client: Use initgr mmap cache in client code
+-  sss\_cache: Clear also initgroups fast cache
+-  sss\_client: Use unique lock for memory cache
+-  sss\_client: Re-check memcache after acquiring the lock
+
+Michal Zidek (5):
+
+-  Use FQDN if default domain was set
+-  MAN: default\_domain\_suffix with use\_fully\_qualified\_names.
+-  views: Add is\_default\_view helper function
+-  MONITOR: Poll for resolv.conf if not available during boot
+-  MONITOR: Do not report missing file as fatal in monitor\_config\_file
+
+Nikolai Kondrashov (3):
+
+-  BUILD: Add AM\_PYTHON2\_MODULE macro
+-  Add integration tests
+-  BUILD: Fix variable substitution in cwrap.m4
+
+Pavel Březina (53):
+
+-  tests: refactor create\_dom\_test\_ctx()
+-  tests: add create\_multidom\_test\_ctx()
+-  tests: add test\_multidom\_suite\_cleanup()
+-  tests: remove code duplication in single domain cleanup
+-  responders: new interface for cache request
+-  responders: enable views in cache request
+-  IFP: use new cache interface
+-  server-tests: use strtouint32 instead strtol
+-  sbus: add new iface via sbus\_conn\_register\_iface()
+-  sbus: move iface and object path code to separate file
+-  sbus: use 'path/\*' to represent a D-Bus fallback
+-  sbus: support multiple interfaces on single path
+-  sbus: add object path to sbus request
+-  sbus: add sbus\_opath\_hash\_lookup\_supported()
+-  sbus: support org.freedesktop.DBus.Introspectable
+-  sbus: support org.freedesktop.DBus.Properties
+-  sbus: unify naming of handler data variable
+-  sbus: move common opath functions from ifp to sbus code
+-  sbus: add sbus\_opath\_get\_object\_name()
+-  ifp: fix potential memory leak in
+   check\_and\_get\_component\_from\_path()
+-  sbus: use hard coded getters instead of generated
+-  sbus: remove unused 'reply as' functions
+-  IFP: move interface definitions from ifpsrv.c into separate file
+-  IFP: unify generated interfaces names
+-  sbus codegen: do not prefix getters with iface name
+-  IFP: simplify object path constant names
+-  sbus: add constant to represent subtree
+-  be\_refresh: get rid of callback pointers
+-  sysdb: use sysdb\_user/group\_dn
+-  cache\_req tests: rename test\_user to test\_user\_by\_name
+-  cache\_req tests: define user name constant
+-  cache\_req: preparations for different input type
+-  cache\_req: add support for user by uid
+-  cache\_req: add support for group by name
+-  cache\_req: remove default branch from switches
+-  cache\_req: add support for group by id
+-  cmocka: include mock\_parse\_inp in header file
+-  cache\_req: parse input name if needed
+-  cache\_req: return ERR\_INTERNAL if more than one entry is found
+-  sbus: provide custom error names
+-  sbus: add sbus\_opath\_decompose[\_exact]
+-  sbus: add a{sas} get invoker
+-  IFP: add org.freedesktop.sssd.infopipe.Users
+-  IFP: add org.freedesktop.sssd.infopipe.Users.User
+-  IFP: add org.freedesktop.sssd.infopipe.Groups
+-  IFP: add org.freedesktop.sssd.infopipe.Groups.Group
+-  IFP: deprecate
+   `GetUserAttr? <https://docs.pagure.org/sssd-test2/GetUserAttr.html>`__
+-  IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object]
+-  SBUS: Use default
+   `GetAll? <https://docs.pagure.org/sssd-test2/GetAll.html>`__ invoker
+   if none is set
+-  SBUS: Add support for <node /> in introspection
+-  IFP: Export nodes
+-  sbus: add support for incoming signals
+-  sbus: listen to
+   `NameOwnerChanged? <https://docs.pagure.org/sssd-test2/NameOwnerChanged.html>`__
+
+Pavel Reichl (20):
+
+-  add missing '\\n' in debug messages
+-  PROXY: add missing space in debug message
+-  BUILD: fix chmake not to generate warning
+-  SDAP: log expired accounts at lower severity level
+-  KRB5: add debug hint
+-  TESTS: test expiration
+-  ldap: refactor check\_pwexpire\_kerberos to use util func
+-  ldap: refactor nds\_check\_expired to use util func
+-  Fix a few typos in comments
+-  sbus: sbus\_opath\_hash\_add\_iface free tmp talloc ctx
+-  krb5: remove field run\_as\_user
+-  localauth plugin: fix coverity warning
+-  dyndns: remove dupl declaration of ipa\_dyndns\_update
+-  dyndns: don't pass zone directive to nsupdate
+-  dyndns: ipa\_dyndns.h missed declaration of used data
+-  krb: remove duplicit decl. of write\_krb5info\_file
+-  IPA: Don't override homedir with subdomain\_homedir
+-  sysdb: new attribute lastOnlineAuthWithCurrentToken
+-  PAM: authenticate agains cache
+-  Minor code improvements
+
+Stephen Gallagher (5):
+
+-  LDAP: Support returning referral information
+-  AD GPO: Support processing referrals
+-  AD GPO: Change default to "enforcing"
+-  Add Vagrant configuration for SSSD
+-  GPO: Fix incorrect strerror on GPO access denial
+
+Sumit Bose (22):
+
+-  Add leak check and command line option to test\_authtok
+-  utils: add sss\_authtok\_[gs]et\_2fa
+-  pam: handle 2FA authentication token in the responder
+-  Add pre-auth request
+-  krb5-child: add preauth and split 2fa token support
+-  IPA: create preauth indicator file at startup
+-  pam\_sss: add pre-auth and 2fa support
+-  Add cache\_credentials\_minimal\_first\_factor\_length config option
+-  sysdb: add sysdb\_cache\_password\_ex()
+-  krb5: save hash of the first authentication factor to the cache
+-  krb5: try delayed online authentication only for single factor auth
+-  2FA offline auth
+-  pam\_sss: move message encoding into separate file
+-  PAM: add PAM responder unit test
+-  adding ldap\_user\_auth\_type where missing
+-  LDAP: add ldap\_user\_certificate option
+-  certs: add PEM/DER conversion utilities
+-  sysdb: add sysdb\_search\_user\_by\_cert() and
+   sysdb\_search\_object\_by\_cert()
+-  LDAP/IPA: add user lookup by certificate
+-  ncache: add calls for certificate based searches
+-  utils: add get\_last\_x\_chars()
+-  IFP: add
+   `FindByCertificate? <https://docs.pagure.org/sssd-test2/FindByCertificate.html>`__
+   method for User objects
diff --git a/users/relnotes/notes_1_13_1.rst b/users/relnotes/notes_1_13_1.rst
new file mode 100644
index 0000000..6a22a68
--- /dev/null
+++ b/users/relnotes/notes_1_13_1.rst
@@ -0,0 +1,447 @@
+SSSD 1.13.1
+===========
+
+Highlights
+----------
+
+-  Initial support for Smart Card authentication was added. The feature
+   can be activated with the new ``pam_cert_auth`` option
+-  The PAM prompting was enhanced so that when Two-Factor Authentication
+   is used, both factors (password and token) can be entered separately
+   on separate prompts. At the same time, only the long-term password is
+   cached, so offline access would still work using the long term
+   password
+-  A new command line tool ``sss_override`` is present in this release.
+   The tools allows to override attributes on the SSSD side. It's
+   helpful in environment where e.g. some hosts need to have a different
+   view of POSIX attributes than others. Please note that the overrides
+   are stored in the cache as well, so removing the cache will also
+   remove the overrides
+-  New methods were added to the SSSD D-Bus interface. Notably support
+   for looking up a user by certificate and looking up multiple users
+   using a wildcard was added. Please see the interface introspection or
+   the design pages for full details
+-  Several enhancements to the dynamic DNS update code. Notably, clients
+   that update multiple interfaces work better with this release
+-  This release supports authenticating againt a KDC proxy
+-  The fail over code was enhanced so that if a trusted domain is not
+   reachable, only that domain will be marked as inactive but the backed
+   would stay in online mode
+-  Several fixes to the GPO access control code are present
+
+Packaging Changes
+-----------------
+
+-  The Smart Card authentication feature requires a helper process
+   ``p11_child`` that needs to be marked as setgid if SSSD needs to be
+   able to. Please note the ``p11_child`` requires the NSS crypto
+   library at the moment
+-  The ``sss_override`` tool was added along with its own manpage
+-  The upstream RPM can now build on RHEL/CentOS 6.7
+
+Documentation Changes
+---------------------
+
+-  The ``config_file_version`` configuration option now defaults to 2.
+   As an effect, this option doesn't have to be set anymore unless the
+   config file format is changed again by SSSD upstream
+-  It is now possible to specify a comma-separated list of interfaces in
+   the ``dyndns_iface`` option
+-  The InfoPipe responder and the LDAP provider gained a new option
+   ``wildcard_lookup`` that specifies an upper limit on the number of
+   entries that can be returned with a wildcard lookup
+-  A new option ``dyndns_server`` was added. This option allows to
+   attempt a fallback DNS update against a specific DNS server. Please
+   note this option only works as a fallback, the first attempt will
+   always be performed against autodiscovered servers.
+-  The PAM responder gained a new option ``ca_db`` that allows the
+   storage of trusted CA certificates to be specified
+-  The time the ``p11_child`` is allowed to operate can be specified
+   using a new option ``p11_child_timeout``
+
+Tickets Fixed
+-------------
+
+.. raw:: html
+
+   <div>
+
+`#546 </sssd/ticket/546>`__
+    [RFE] Support for smart cards
+`#1697 </sssd/ticket/1697>`__
+    sssd: incorrect checks on length values during packet decoding
+`#1926 </sssd/ticket/1926>`__
+    [RFE] Start the dynamic DNS update after the SSSD has been setup for
+    the first time
+`#1994 </sssd/ticket/1994>`__
+    Complain loudly if backend doesn't start due to missing or invalid
+    keytab
+`#2275 </sssd/ticket/2275>`__
+    nested netgroups do not work in IPA provider
+`#2283 </sssd/ticket/2283>`__
+    test dyndns failed.
+`#2335 </sssd/ticket/2335>`__
+    Investigate using the krb5 responder for driving the PAM
+    conversation with OTPs
+`#2463 </sssd/ticket/2463>`__
+    Pass error messages via the extdom plugin
+`#2495 </sssd/ticket/2495>`__
+    [RFE]Allow sssd to add a new option that would specify which server
+    to update DNS with
+`#2549 </sssd/ticket/2549>`__
+    RFE: Support multiple interfaces with the dyndns\_iface option
+`#2553 </sssd/ticket/2553>`__
+    RFE: Add support for wildcard-based cache updates
+`#2558 </sssd/ticket/2558>`__
+    Add dualstack and multihomed support
+`#2561 </sssd/ticket/2561>`__
+    Too much logging
+`#2579 </sssd/ticket/2579>`__
+    TRACKER: Support one-way trusts for IPA
+`#2581 </sssd/ticket/2581>`__
+    Re-check memcache after acquiring the lock in the client code
+`#2584 </sssd/ticket/2584>`__
+    RFE: Support client-side overrides
+`#2597 </sssd/ticket/2597>`__
+    Add index for 'objectSIDString' and maybe to other cache attributes
+`#2637 </sssd/ticket/2637>`__
+    RFE: Don't mark the main domain as offline if SSSD can't connect to
+    a subdomain
+`#2639 </sssd/ticket/2639>`__
+    RFE: Detect re-established trusts in the IPA subdomain code
+`#2652 </sssd/ticket/2652>`__
+    KDC proxy not working with SSSD krb5\_use\_kdcinfo enabled
+`#2676 </sssd/ticket/2676>`__
+    Group members are not turned into ghost entries when the user is
+    purged from the SSSD cache
+`#2682 </sssd/ticket/2682>`__
+    sudoOrder not honored as expected
+`#2688 </sssd/ticket/2688>`__
+    Default to config\_file\_version=2
+`#2691 </sssd/ticket/2691>`__
+    GPO: PAM system error returned for PAM\_ACCT\_MGMT and offline mode
+`#2692 </sssd/ticket/2692>`__
+    GPO: Access denied due to using wrong sam\_account\_name
+`#2699 </sssd/ticket/2699>`__
+    SSSDConfig: wrong return type returned on python3
+`#2700 </sssd/ticket/2700>`__
+    krb5\_child should always consider online state to allow use of
+    MS-KKDC proxy
+`#2708 </sssd/ticket/2708>`__
+    Logging messages from user point of view
+`#2711 </sssd/ticket/2711>`__
+    [RFE] Provide interface for SSH to fetch user certificate
+`#2712 </sssd/ticket/2712>`__
+    Initgroups memory cache does not work with fq names
+`#2716 </sssd/ticket/2716>`__
+    Initgroups mmap cache needs update after db changes
+`#2717 </sssd/ticket/2717>`__
+    well-known SID check is broken for NetBIOS prefixes
+`#2718 </sssd/ticket/2718>`__
+    SSSD keytab validation check expects root ownership
+`#2719 </sssd/ticket/2719>`__
+    IPA: returned unknown dp error code with disabled migration mode
+`#2722 </sssd/ticket/2722>`__
+    Missing config options in gentoo init script
+`#2723 </sssd/ticket/2723>`__
+    Could not resolve AD user from root domain
+`#2724 </sssd/ticket/2724>`__
+    getgrgid for user's UID on a trust client prevents getpw\*
+`#2725 </sssd/ticket/2725>`__
+    If AD site detection fails, not even ad\_site override skipped
+`#2729 </sssd/ticket/2729>`__
+    Do not send SSS\_OTP if both factors were entered separately
+`#2731 </sssd/ticket/2731>`__
+    searching SID by ID always checks all domains
+`#2733 </sssd/ticket/2733>`__
+    Don't use deprecated libraries (libsystemd-\*)
+`#2737 </sssd/ticket/2737>`__
+    sss\_override: add import and export commands
+`#2738 </sssd/ticket/2738>`__
+    Cannot build rpms from upstream spec file on rawhide
+`#2742 </sssd/ticket/2742>`__
+    When certificate is added via user-add-cert, it cannot be looked up
+    via org.freedesktop.sssd.infopipe.Users.FindByCertificate
+`#2743 </sssd/ticket/2743>`__
+    memory cache can work intermittently
+`#2744 </sssd/ticket/2744>`__
+    cleanup\_groups should sanitize dn of groups
+`#2746 </sssd/ticket/2746>`__
+    the PAM srv test often fails on RHEL-7
+`#2748 </sssd/ticket/2748>`__
+    test\_memory\_cache failed in invalidation cache before stop
+`#2749 </sssd/ticket/2749>`__
+    Fix crash in nss responder
+`#2754 </sssd/ticket/2754>`__
+    Clear environment and set restrictive umask in p11\_child
+`#2757 </sssd/ticket/2757>`__
+    sss\_override does not work correctly when
+    'use\_fully\_qualified\_names = True'
+`#2758 </sssd/ticket/2758>`__
+    sss\_override contains an extra parameter --debug but is not listed
+    in the man page or in the arguments help
+`#2762 </sssd/ticket/2762>`__
+    [RFE] sssd: better feedback form constraint password change
+`#2768 </sssd/ticket/2768>`__
+    Test 'test\_id\_cleanup\_exp\_group' failed
+`#2772 </sssd/ticket/2772>`__
+    sssd cannot resolve user names containing backslash with ldap
+    provider
+`#2773 </sssd/ticket/2773>`__
+    Make p11\_child timeout configurable
+`#2777 </sssd/ticket/2777>`__
+    Fix memory leak in GPO
+`#2782 </sssd/ticket/2782>`__
+    sss\_override : The local override user is not found
+`#2783 </sssd/ticket/2783>`__
+    REGRESSION: Dyndns soes not update reverse DNS records
+`#2790 </sssd/ticket/2790>`__
+    sss\_override --name doesn't work with RFC2307 and ghost users
+`#2799 </sssd/ticket/2799>`__
+    unit tests do not link correctly on Debian
+`#2803 </sssd/ticket/2803>`__
+    Memory leak / possible DoS with krb auth.
+`#2805 </sssd/ticket/2805>`__
+    AD: Conditional jump or move depends on uninitialised value
+
+.. raw:: html
+
+   </div>
+
+Detailed Changelog
+------------------
+
+Jakub Hrozek (52):
+
+-  Updating the version for 1.13.1 development
+-  tests: Move N\_ELEMENTS definition to tests/common.h
+-  SYSDB: Add functions to look up multiple entries including name and
+   custom filter
+-  DP: Add DP\_WILDCARD and
+   SSS\_DP\_WILDCARD\_USER/SSS\_DP\_WILDCARD\_GROUP
+-  cache\_req: Extend cache\_req with wildcard lookups
+-  UTIL: Add sss\_filter\_sanitize\_ex
+-  LDAP: Fetch users and groups using wildcards
+-  LDAP: Add sdap\_get\_and\_parse\_generic\_send
+-  LDAP: Use sdap\_get\_and\_parse\_generic\_/\_recv
+-  LDAP: Add sdap\_lookup\_type enum
+-  LDAP: Add the wildcard\_limit option
+-  IFP: Add wildcard requests
+-  Use NSCD path in execl()
+-  KRB5: Use the right domain for case-sensitive flag
+-  IPA: Better debugging
+-  UTIL: Lower debug level in perform\_checks()
+-  IPA: Handle sssd-owned keytabs when running as root
+-  IPA: Remove MPG groups if getgrgid was called before getpw()
+-  LDAP: use ldb\_binary\_encode when printing attribute values
+-  IPA: Change the default of ldap\_user\_certificate to
+   userCertificate;binary
+-  UTIL: Provide a common interface to safely create temporary files
+-  IPA: Always re-fetch the keytab from the IPA server
+-  DYNDNS: Add a new option dyndns\_server
+-  p11child: set restrictive umask and clear environment
+-  KRB5: Use sss\_unique file in krb5\_child
+-  KRB5: Use sss\_unique\_file when creating kdcinfo files
+-  LDAP: Use sss\_unique\_filename in ldap\_child
+-  SSH: Use sss\_unique\_file\_ex to create the known hosts file
+-  SYSDB: Index the objectSIDString attribute
+-  sbus: Initialize errno if constructing message fails and add debug
+   messages
+-  sbus: Add a special error code for messages sent by the bus itself
+-  GPO: Use sss\_unique\_file and close fd on failure
+-  SDAP: Remove unused function
+-  KRB5: Don't error out reading a minimal krb5.conf
+-  UTIL: Convert domain->disabled into tri-state with domain states
+-  DP: Provide a way to mark subdomain as disabled and auto-enable it
+   later with offline\_timeout
+-  SDAP: Do not set is\_offline if ignore\_mark\_offline is set
+-  AD: Only ignore errors from SDAP lookups if there's another
+   connection to fallback to
+-  KRB5: Offline operation with disabled domain
+-  AD: Do not mark the whole back end as offline if subdomain lookup
+   fails
+-  AD: Set ignore\_mark\_offline=false when resolving AD root domain
+-  IPA: Do not allow the AD lookup code to set backend as offline in
+   server mode
+-  BUILD: link dp tests with LDB directly to fix builds on Debian
+-  LDAP: imposing sizelimit=1 for single-entry searches breaks
+   overlapping domains
+-  tests: Move named\_domain from test\_utils to common test code
+-  LDAP: Move sdap\_create\_search\_base from ldap to sdap code
+-  LDAP: Filter out multiple entries when searching overlapping domains
+-  IPA: Change ipa\_server\_trust\_add\_send request to be reusable from
+   ID code
+-  FO: Add an API to reset all servers in a single service
+-  FO: Also reset the server common data in addition to SRV
+-  IPA: Retry fetching keytab if IPA user lookup fails
+-  Updating translations for the 1.13.1 release
+
+Lukas Slebodnik (49):
+
+-  KRB5: Return right data provider error code
+-  Update few debug messages
+-  intg: Invalidate memory cache before removing files
+-  SPEC: Update spec file for krb5\_local\_auth\_plugin
+-  SSSDConfig: Return correct types in python3
+-  intg: Modernize 'except' clauses
+-  mmap\_cache: Rename variables
+-  mmap\_cache: "Override" functions for initgr mmap cache
+-  mmap: Invalidate initgroups memory cache after any change
+-  sss\_client: Update integrity check of records in mmap cache
+-  intg\_test: Add module for simulation of utility id
+-  intg\_test: Add integration test for memory cache
+-  NSS: Initgr memory cache should work with fq names
+-  test\_memory\_cache: Add test for initgroups mc with fq names
+-  SPEC: Workaround for build with rpm 4.13
+-  KRB5: Do not try to remove missing ccache
+-  test\_memory\_cache: Test mmap cache after initgroups
+-  test\_memory\_cache: Test invalidation with sss\_cache
+-  krb5\_utils-tests: Remove unused variables
+-  sss\_cache: Wait a while for invalidation of mc by nss responder
+-  test\_memory\_cache: Fix few python issues
+-  NSS: Fix use after free
+-  NSS: Don't ignore backslash in usernames with ldap provider
+-  intg\_tests: Add regression test for 2163
+-  BUILD: Build libdlopen\_test\_providers.la as a dynamic library
+-  BUILD: Speed up build of some tests
+-  BUILD: Simplify build of simple\_access\_tests
+-  CI: Set env variable for all tabs in screen
+-  dyndns-tests: Simulate job in wrapped execv
+-  AUTOMAKE: Disable portability warnings
+-  tests: Use unique name for TEST\_PATH
+-  tests: Move test\_dom\_suite\_setup to different module
+-  test\_ipa\_subdomains\_server: Use unique dorectory for keytabs
+-  test\_copy\_keytab: Create keytabs in unique directory
+-  test\_ad\_common: Use unique directory for keytabs
+-  Revert "LDAP: end on ENOMEM"
+-  Partially revert "LDAP: sanitize group name when used in filter"
+-  LDAP: Sanitize group dn before using in filter
+-  test\_ldap\_id\_cleanup: Fix coding style issues
+-  DYNDNS: Return right error code in case of failure
+-  BUILD: Simplify build of test\_data\_provider\_be
+-  BUILD: Remove unused variable CHECK\_OBJ
+-  BUILD: Do not build libsss\_ad\_common.la as library
+-  BUILD: Remove unused variable SSSD\_UTIL\_OBJ
+-  CONFIGURE: Remove bashism
+-  IFP: Suppress warning from static analyzer
+-  BUILD: Link test\_data\_provider\_be with -ldl
+-  sysdb-tests: Use valid base64 encoded certificate for search
+-  test\_pam\_srv: Run cert test only with NSS
+
+Michal Židek (13):
+
+-  DEBUG: Add new debug category for fail over.
+-  pam: Incerease p11 child timeout
+-  sdap\_async: Use specific errmsg when available
+-  TESTS: ldap\_id\_cleanup timeouts
+-  sssd: incorrect checks on length values during packet decoding
+-  CONFDB: Assume config file version 2 if missing
+-  Makefile.am: Add missing AM\_CFLAGS
+-  SYSDB: Add function to expire entry
+-  cleanup task: Expire all memberof targets when removing user
+-  CI: Add regression test for
+   `#2676 <https://fedorahosted.org/sssd/ticket/2676>`__
+-  intg: Fix some PEP 8 violations
+-  PAM: Make p11\_child timeout configurable
+-  tests: Set p11\_child\_timeout to 30 in tests
+
+Nikolai Kondrashov (1):
+
+-  TESTS: Add trailing whitespace test
+
+Pavel Březina (18):
+
+-  VIEWS TEST: add null-check
+-  SYSDB: prepare for LOCAL view
+-  TOOLS: add common command framework
+-  TOOLS: add sss\_override for local overrides
+-  AD: Use ad\_site also when site search fails
+-  IFP: use default limit if provided is 0
+-  sudo: use "higher value wins" when ordering rules
+-  sss\_override: print input name if unable to parse it
+-  sss\_override: support domains that require fqname
+-  TOOLS: add sss\_colondb API
+-  sss\_override: decompose code better
+-  sss\_override: support import and export
+-  sss\_override: document --debug options
+-  sss\_override: support fqn in override name
+-  views: do not require overrideDN in grous when LOCAL view is set
+-  views: fix two typos in debug messages
+-  views: allow ghost members for LOCAL view
+-  sss\_override: remove -d from manpage
+
+Pavel Reichl (23):
+
+-  DYNDNS: sss\_iface\_addr\_list\_get return ENOENT
+-  DYNDNS: support mult. interfaces for dyndns\_iface opt
+-  DYNDNS: special value '\*' for dyndns\_iface option
+-  TESTS: dyndns tests support AAAA addresses
+-  DYNDNS: support for dualstack
+-  TESTS: fix compiler warnings
+-  SDAP: rename SDAP\_CACHE\_PURGE\_TIMEOUT
+-  IPA: Improve messages about failures
+-  DYNDNS: Don't use server cmd in nsupdate by default
+-  DYNDNS: remove redundant talloc\_steal()
+-  DYNDNS: remove zone command
+-  DYNDNS: rename field of sdap\_dyndns\_update\_state
+-  DYNDNS: remove code duplication
+-  TESTS: UT for sss\_iface\_addr\_list\_as\_str\_list()
+-  LDAP: sanitize group name when used in filter
+-  LDAP: minor improvements in ldap id cleanup
+-  TESTS: fix fail in test\_id\_cleanup\_exp\_group
+-  LDAP: end on ENOMEM
+-  AD: send less logs to syslog
+-  Remove trailing whitespace
+-  GPO: fix memory leak
+-  DDNS: execute nsupdate for single update of PTR rec
+-  AD: inicialize root\_domain\_attrs field
+
+Petr Cech (6):
+
+-  BUILD: Repair dependecies on deprecated libraries
+-  TESTS: Removing part of responder\_cache\_req-tests
+-  UTIL: Function 2string for enum sss\_cli\_command
+-  UTIL: Fixing Makefile.am for util/sss\_cli\_cmd.h
+-  DATA\_PROVIDER: BE\_REQ as string in log message
+-  IPA PROVIDER: Resolve nested netgroup membership
+
+Robin `McCorkell? <https://docs.pagure.org/sssd-test2/McCorkell.html>`__
+(1):
+
+-  man: List alternative schema defaults for LDAP AutoFS parameters
+
+Stephen Gallagher (1):
+
+-  AD: Handle cases where no GPOs apply
+
+Sumit Bose (17):
+
+-  test common: sss\_dp\_get\_account\_recv() fix assignment
+-  nss\_check\_name\_of\_well\_known\_sid() improve name splitting
+-  negcache: allow domain name for UID and GID
+-  nss: use negative cache for sid-by-id requests
+-  krb5: do not send SSS\_OTP if two factors were used
+-  utils: add NSS version of cert utils
+-  Add NSS version of p11\_child
+-  pack\_message\_v3: allow empty name
+-  authok: add support for Smart Card related authtokens
+-  PAM: add certificate support to PAM (pre-)auth requests
+-  pam\_sss: add sc support
+-  ssh: generate public keys from certificate
+-  krb5 utils: add sss\_krb5\_realm\_has\_proxy()
+-  krb5: do not create kdcinfo file if proxy configuration exists
+-  krb5: assume online state if KDC proxy is configured
+-  GPO: use SDAP\_SASL\_AUTHID as samAccountName
+-  utils: make sss\_krb5\_get\_primary() private
+
+Thomas Oulevey (1):
+
+-  Fix memory leak in sssdpac\_verify()
+
+Tyler Gates (1):
+
+-  CONTRIB: Gentoo daemon startup options as declared in conf.d/sssd
+
+Yuri Chornoivan (1):
+
+-  Fix minor typos
diff --git a/users/relnotes/notes_1_13_2.rst b/users/relnotes/notes_1_13_2.rst
new file mode 100644
index 0000000..0c557ee
--- /dev/null
+++ b/users/relnotes/notes_1_13_2.rst
@@ -0,0 +1,252 @@
+SSSD 1.13.2
+===========
+
+Highlights
+----------
+
+-  This is primarily a bugfix release, with minor features added to the
+   local overrides feature
+-  The ``sss_override`` tool gained new ``user-show``, ``user-find``,
+   ``group-show`` and ``group-find`` commands
+-  The PAM responder was crashing if PAM\_USER was set to an empty
+   string. This bug was fixed
+-  The ``sssd_be`` process could crash when looking up groups in setups
+   with IPA-AD trusts that use POSIX attributes but do not replicate
+   them to the Global Catalog
+-  A socket leak in case SSSD couldn't establish a connection to an LDAP
+   server was fixed
+-  SSSD's memory cache now behaves better when used by long-running
+   applications such as system deamons and the administrator invalidates
+   the cache
+-  The SSSDConfig Python API no longer throws an exception when
+   config\_file\_version is missing
+-  The InfoPipe D-Bus interface is able to retrieve user groups
+   correctly if the user is a member of non-POSIX groups like ipausers
+   as well
+-  Lookups by certificate now work correctly in multi-domain environment
+-  The lookup of POSIX attributes after startup was relaxed to only
+   check attribute presence, not validity. The POSIX check was also made
+   less verbose.
+-  A bug when looking up a subdomain user by UPN users was fixed
+
+Packaging Changes
+-----------------
+
+-  The memory cache for initgroups results was previously not packaged.
+   This bug was fixed.
+-  Python 2/3 packaging in the RPM specfile was improved
+
+Tickets Fixed
+-------------
+
+.. raw:: html
+
+   <div>
+
+`#2176 </sssd/ticket/2176>`__
+    warn if memcache\_timeout is greater than entry\_cache\_timeout
+`#2493 </sssd/ticket/2493>`__
+    Check chown\_debug\_file() usage
+`#2673 </sssd/ticket/2673>`__
+    Consider also disabled domains when link\_forest\_roots() is called
+`#2697 </sssd/ticket/2697>`__
+    extend PAM responder unit test
+`#2706 </sssd/ticket/2706>`__
+    Contribute and DevelTips are duplicate
+`#2726 </sssd/ticket/2726>`__
+    Long living applicantion can use removed memory cache.
+`#2730 </sssd/ticket/2730>`__
+    responder\_cache\_req-tests failed
+`#2736 </sssd/ticket/2736>`__
+    sss\_override: add find and show commands
+`#2759 </sssd/ticket/2759>`__
+    sbus\_codegen\_tests leaves a process running
+`#2779 </sssd/ticket/2779>`__
+    Review and update wiki pages for 1.13.2
+`#2786 </sssd/ticket/2786>`__
+    Create a wiki page that lists security-sensitive options
+`#2792 </sssd/ticket/2792>`__
+    SSSD is not closing sockets properly
+`#2800 </sssd/ticket/2800>`__
+    Relax POSIX check
+`#2802 </sssd/ticket/2802>`__
+    sss\_override segfaults when accidentally adding --help flag to some
+    commands
+`#2804 </sssd/ticket/2804>`__
+    Size limit exceeded too loud during POSIX check
+`#2807 </sssd/ticket/2807>`__
+    CI: configure script failed on CentOS {6,7}
+`#2810 </sssd/ticket/2810>`__
+    sssd\_be crashed
+`#2811 </sssd/ticket/2811>`__
+    PAM responder crashed if user was not set
+`#2814 </sssd/ticket/2814>`__
+    avoid symlinks witih python modules
+`#2819 </sssd/ticket/2819>`__
+    CI: test\_ipa\_subdomains\_server failed on rhel6 + --coverage
+    (FAIL: test\_ipa\_subdom\_server)
+`#2826 </sssd/ticket/2826>`__
+    sss\_override: memory violation
+`#2827 </sssd/ticket/2827>`__
+    bug in UPN lookups for subdomain users
+`#2833 </sssd/ticket/2833>`__
+    local overrides: don't contact server with overriden name/id
+`#2837 </sssd/ticket/2837>`__
+    REGRESSION: ipa-client-automout failed
+`#2861 </sssd/ticket/2861>`__
+    sssd crashes if non-UTF-8 locale is used
+`#2863 </sssd/ticket/2863>`__
+    IFP: ifp\_users\_user\_get\_groups doesn't handle non-POSIX groups
+
+.. raw:: html
+
+   </div>
+
+Detailed Changelog
+------------------
+
+Dan Lavu (1):
+
+-  sss\_override: Add restart requirements to man page
+
+Jakub Hrozek (10):
+
+-  Bump the version for the 1.13.2 development
+-  AD: Provide common connection list construction functions
+-  AD: Consolidate connection list construction on ad\_common.c
+-  tests: Fix compilation warning
+-  tools: Don't shadow 'exit'
+-  IFP: Skip non-POSIX groups properly
+-  DP: Drop dp\_pam\_err\_to\_string
+-  DP: Check callback messages for valid UTF-8
+-  sbus: Check string arguments for valid UTF-8 strings
+-  Updating translations for the 1.13.2 release
+
+Lukas Slebodnik (33):
+
+-  CI: Fix configure script arguments for CentOS
+-  CI: Don't depend on user input with apt-get
+-  CI: Add missing dependency for debian
+-  CI: Run integration tests on debian testing
+-  BUILD: Link just libsss\_crypto with crypto libraries
+-  BUILD: Link crypto\_tests with existing library
+-  BUILD: Remove unused variable TEST\_MOCK\_OBJ
+-  BUILD: Avoid symlinks with python modules
+-  SSSDConfigTest: Try load saved config
+-  SSSDConfigTest: Test real config without config\_file\_version
+-  intg\_tests: Fix PEP8 warnings
+-  BUILD: Accept krb5 1.14 for building the PAC plugin
+-  BUILD: Fix detection of pthread with strict CFLAGS
+-  BUILD: Fix doc directory for sss\_simpleifp
+-  LDAP: Fix leak of file descriptors
+-  CI: Workaroung for code coverage with old gcc
+-  cache\_req: Fix warning -Wshadow
+-  SBUS: Fix warnings -Wshadow
+-  TESTS: Fix warnings -Wshadow
+-  INIT: Drop syslog.target from service file
+-  sbus\_codegen\_tests: Suppress warning Wmaybe-uninitialized
+-  DP\_PTASK: Fix warning may be used uninitialized
+-  UTIL: Fix memory leak in switch\_creds
+-  TESTS: Initialize leak check
+-  TESTS: Check return value of check\_leaks\_pop
+-  TESTS: Make check\_leaks static function
+-  TESTS: Add warning for unused result of leak check functions
+-  sss\_client: Fix underflow of active\_threads
+-  sssd\_client: Do not use removed memory cache
+-  test\_memory\_cache: Test removing mc without invalidation
+-  Revert "intg: Invalidate memory cache before removing files"
+-  CONFIGURE: Bump AM\_GNU\_GETTEXT\_VERSION
+-  test\_sysdb\_subdomains: Do not use assignment in assertions
+
+Michal Židek (7):
+
+-  SSSDConfig: Do not raise exception if config\_file\_version is
+   missing
+-  spec: Missing initgroups mmap file
+-  util: Update get\_next\_domain's interface
+-  tests: Add get\_next\_domain\_flags test
+-  sysdb: Include disabled domains in link\_forest\_roots
+-  sysdb: Use get\_next\_domain instead of dom->next
+-  Refactor some conditions
+
+Nikolai Kondrashov (13):
+
+-  CI: Update reason blocking move to DNF
+-  CI: Exclude whitespace\_test from Valgrind checks
+-  intg: Get base DN from LDAP connection object
+-  intg: Add support for specifying all user attrs
+-  intg: Split LDAP test fixtures for flexibility
+-  intg: Reduce sssd.conf duplication in test\_ldap.py
+-  intg: Fix RFC2307bis group member creation
+-  intg: Do not use non-existent pre-increment
+-  CI: Do not skip tests not checked with Valgrind
+-  CI: Handle dashes in valgrind-condense
+-  intg: Fix all PEP8 issues
+-  CI: Enforce coverage make check failures
+-  intg: Add more LDAP tests
+
+Pavel Březina (23):
+
+-  sss tools: improve option handling
+-  sbus codegen tests: free ctx
+-  cache\_req: provide extra flag for oob request
+-  cache\_req: add support for UPN
+-  cache\_req tests: reduce code duplication
+-  cache\_req: remove raw\_name and do not touch orig\_name
+-  sss\_override: fix comment describing format
+-  sss\_override: explicitly set ret = EOK
+-  sss\_override: steal msgs string to objs
+-  nss: send original name and id with local views if possible
+-  sudo: search with view even if user is found
+-  sudo: send original name and id with local views if possible
+-  sss\_tools: always show common and help options
+-  sss\_override: fix exporting multiple domains
+-  sss\_override: add user-find
+-  sss\_override: add group-find
+-  sss\_override: add user-show
+-  sss\_override: add group-show
+-  sss\_override: do not free ldb\_dn in get\_object\_dn()
+-  sss\_override: use more generic help text
+-  sss\_tools: do not allow unexpected free argument
+-  BE: Add IFP to known clients
+-  AD: remove annoying debug message
+
+Pavel Reichl (12):
+
+-  AD: add debug messages for netlogon get info
+-  confdb: warn if memcache\_timeout > than entry\_cache
+-  SDAP: Relax POSIX check
+-  SDAP: optional warning - sizelimit exceeded in POSIX check
+-  SDAP: allow\_paging in sdap\_get\_generic\_ext\_send()
+-  SDAP: change type of attrsonly in sdap\_get\_generic\_ext\_state
+-  SDAP: pass params in sdap\_get\_and\_parse\_generic\_send
+-  sss\_override: amend man page - overrides do not stack
+-  sss\_override: Removed overrides might be in memcache
+-  pam-srv-tests: split pam\_test\_setup() so it can be reused
+-  pam-srv-tests: Add UT for cached 'online' auth.
+-  intg: Add test for user and group local overrides
+
+Petr Cech (9):
+
+-  DEBUG: Preventing chown\_debug\_file if journald on
+-  TEST: Add test\_user\_by\_recent\_filter\_valid
+-  TEST: Refactor of test\_responder\_cache\_req.c
+-  TEST: Refactor of test\_responder\_cache\_req.c
+-  TEST: Add common function are\_values\_in\_array()
+-  TEST: Add test\_users\_by\_recent\_filter\_valid
+-  TEST: Add test\_group\_by\_recent\_filter\_valid
+-  TEST: Refactor of test\_responder\_cache\_req.c
+-  TEST: Add test\_groups\_by\_recent\_filter\_valid
+
+Stephen Gallagher (2):
+
+-  LDAP: Inform about small range size
+-  Monitor: Show service pings at debug level 8
+
+Sumit Bose (5):
+
+-  PAM: only allow missing user name for certificate authentication
+-  fix ldb\_search usage
+-  fix upn cache\_req for sub-domain users
+-  nss: fix UPN lookups for sub-domain users
+-  cache\_req: check all domains for lookups by certificate
diff --git a/users/relnotes/notes_1_13_3.rst b/users/relnotes/notes_1_13_3.rst
new file mode 100644
index 0000000..15787b5
--- /dev/null
+++ b/users/relnotes/notes_1_13_3.rst
@@ -0,0 +1,145 @@
+SSSD 1.13.3
+===========
+
+Highlights
+----------
+
+-  A bug that prevented user lookups and logins after migration from
+   winsync to IPA-AD trusts was fixed
+-  The OCSP certificate validation checks are enabled for smartcard
+   logins if SSSD was compiled with the NSS crypto library.
+-  A bug that prevented the ``ignore_group_members`` option from working
+   correctly in AD provider setups that use a dedicated primary group
+   (as opposed to a user-private group) was fixed
+-  Offline detection and offline login timeouts were improved for AD
+   users logging in from a domain trusted by an IPA server
+-  The AD provider supports setting up ``autofs_provider=ad``
+-  Several usability improvements to our debug messages
+
+Packaging Changes
+-----------------
+
+-  The ``p11_child`` helper binary is able to run completely
+   unprivileged and no longer requires the setgid bit to be set
+
+Documentation Changes
+---------------------
+
+-  A new option ``certificate_verification`` was added. This option
+   allows the administrator to disable OCSP checks in case the OCSP
+   server is not reachable
+
+Tickets Fixed
+-------------
+
+.. raw:: html
+
+   <div>
+
+`#1632 </sssd/ticket/1632>`__
+    [RFE] Unable to use AD provider for automount lookups
+`#1943 </sssd/ticket/1943>`__
+    convert sudo timer to be\_ptask
+`#2672 </sssd/ticket/2672>`__
+    sudo: reload hostinfo when going online
+`#2732 </sssd/ticket/2732>`__
+    Add Integration tests for local views feature
+`#2747 </sssd/ticket/2747>`__
+    get\_object\_from\_cache() does not handle services
+`#2755 </sssd/ticket/2755>`__
+    Review p11\_child hardening
+`#2787 </sssd/ticket/2787>`__
+    We should mention SSS\_NSS\_USE\_MEMCACHE in man sssd.conf(5) as
+    well
+`#2796 </sssd/ticket/2796>`__
+    fix man page for sssd-ldap
+`#2801 </sssd/ticket/2801>`__
+    Check next certificate on smart card if first is not valid
+`#2812 </sssd/ticket/2812>`__
+    Smartcard login when certificate on the card is revoked and ocsp
+    check enabled is not supported
+`#2830 </sssd/ticket/2830>`__
+    Try to suppress "Could not parse domain SID from [(null)]" for IPA
+    users
+`#2846 </sssd/ticket/2846>`__
+    Inform about SSSD PAC timeout better
+`#2868 </sssd/ticket/2868>`__
+    AD provider and ignore\_group\_members=True might cause flaky group
+    memberships
+`#2874 </sssd/ticket/2874>`__
+    sssd: [sysdb\_add\_user] (0x0400): Error: 17 (File exists)
+
+.. raw:: html
+
+   </div>
+
+Detailed Changelog
+------------------
+
+Dan Lavu (1):
+
+-  Clarify that subdomains always use service discovery
+
+Jakub Hrozek (7):
+
+-  Upgrading the version for the 1.13.3 release
+-  DP: Do not confuse static analysers with dead code
+-  BUILD: Only install polkit rules if the directory is available
+-  IPA: Use search timeout, not enum timeout for searching overrides
+-  AD: Add autofs provider
+-  MAN: Clarify when should TGs be disabled for group nesting
+   restriction
+-  Update translations for the 1.13.3 release
+
+Lukas Slebodnik (2):
+
+-  sbus\_codegen\_tests: Use portable definition of large constants
+-  DEBUG: Add missing new lines
+
+Michal Židek (1):
+
+-  MAN: sssd.conf should mention SSS\_NSS\_USE\_MEMCACHE
+
+Pavel Březina (22):
+
+-  SYSDB: Add missing include to sysdb\_services.h
+-  LDAP: Mark globals in ldap\_opts.h as extern
+-  AD: Mark globals in ad\_opts.h as extern
+-  IPA: Mark globals in ipa\_opts.h as extern
+-  KRB5: Mark globals in krb5\_opts.h as extern
+-  SUDO: convert periodical refreshes to be\_ptask
+-  SUDO: move refreshes from sdap\_sudo.c to sdap\_sudo\_refresh.c
+-  SUDO: move offline check to handler
+-  SUDO: simplify error handling
+-  SUDO: fix sdap\_id\_op logic
+-  SUDO: fix tevent style
+-  SUDO: fix sdap\_sudo\_smart\_refresh\_recv()
+-  SUDO: sdap\_sudo\_load\_sudoers improve iterator
+-  SUDO: set USN inside sdap\_sudo\_refresh request
+-  SUDO: built host filter inside sdap\_sudo\_refresh request
+-  SUDO: do not imitate full refresh if usn is unknown in smart refresh
+-  SUDO: fix potential memory leak in sdap\_sudo\_init
+-  SUDO: obtain host information when going online
+-  SUDO: remove finalizer
+-  SUDO: make sdap\_sudo\_handler static
+-  SUDO: use size\_t instead of int in for cycles
+-  SUDO: get srv\_opts after we are connected
+
+Pavel Reichl (1):
+
+-  sysdb-tests: Fix warning - incompatible pointer type
+
+Petr Cech (2):
+
+-  IPA\_PROVIDER: Explicit no handle of services
+-  KRB5\_CHILD: Debug logs for PAC timeout
+
+Sumit Bose (7):
+
+-  IPA: fix override with the same name
+-  p11: allow p11\_child to run completely unprivileged
+-  p11: check if cert is valid before selecting it
+-  p11: enable ocsp checks
+-  ldap: skip sdap\_save\_grpmem() if ignore\_group\_members is set
+-  initgr: only search for primary group if it is not already cached
+-  LDAP: check early for missing SID in mapping check
diff --git a/users/relnotes/notes_1_13_4.rst b/users/relnotes/notes_1_13_4.rst
new file mode 100644
index 0000000..439f2cf
--- /dev/null
+++ b/users/relnotes/notes_1_13_4.rst
@@ -0,0 +1,348 @@
+SSSD 1.13.4
+===========
+
+Highlights
+----------
+
+-  The IPA sudo provider was reimplemented. The new version reads the
+   data from IPA's LDAP tree (as opposed to the compat tree populated by
+   the ``slapi-nis`` plugin that was used previously). The benefit is
+   that deployments which don't require the compat tree for other
+   purposes, such as support for non-SSSD clients can disable those
+   autogenerated LDAP trees to conserve resources that slapi-nis
+   otherwise requires. There should be no visible changes to the end
+   user.
+-  SSSD now has the ability to renew the machine credentials (keytabs)
+   when the ``ad`` provider is used. Please note that a recent version
+   of the ``adcli`` (0.8 or newer) package is required for this feature
+   to work.
+-  The automatic ID mapping feature was improved so that the
+   administrator is no longer required to manually set the range size in
+   case a RID in the AD domain is larger than the default range size
+-  A potential infinite loop in the NFS ID mapping plugin that was
+   resulting in an excessive memory usage was fixed
+-  Clients that are pinned to a particular AD site using the ``ad_site``
+   option no longer communicate with DCs outside that site during
+   service discovery.
+-  The IPA identity provider is now able to resolve external (typically
+   coming from a trusted AD forest) group members during
+   get-group-information requests. Please note that resolving external
+   group memberships for AD users during the initgroup requests used to
+   work even prior to this update. This feature is mostly useful for
+   cases where an IPA client is using the compat tree to resolve AD
+   trust users.
+-  The IPA ID views feature now works correctly even for deployments
+   without a trust relationship. Previously, the ``subdomains`` IPA
+   provider failed to read the views data if no master domain record was
+   created on the IPA server during trust establishment.
+-  A race condition in the client libraries between the SSSD closing the
+   socket as idle and the client application using the socket was fixed.
+   This bug manifested with a ``Broken Pipe`` error message on the
+   client.
+-  SSSD is now able to resolve users with the same usernames in
+   different OUs of an AD domain
+-  The smartcard authentication now works properly with
+   ``gnome-screensaver``
+
+Packaging Changes
+-----------------
+
+-  The ``krb5.include.d`` directory is now owned by the ``sssd`` user
+   and packaged in the ``krb5-common`` subpackage
+
+Documentation Changes
+---------------------
+
+-  A new option ``ldap_idmap_helper_table_size`` was added. This option
+   can help tune allocation of new ID mapping slices for AD domains with
+   a high RID values. Most deployments can use the default value of this
+   option.
+-  Several PAM services were added to the lists that are used to map
+   Windows logon services to Linux PAM services. The newly added PAM
+   services include login managers (``lightdm``, ``lxdm``, ``sddm`` and
+   ``xdm``) as well as the ``cockpit`` service.
+-  The AD machine credentials renewal task can be fine-tuned using the
+   ``ad_machine_account_password_renewal_opts`` to change the initial
+   delay and period of the credentials renewal task. In addition, the
+   new ``ad_maximum_machine_account_password_age`` option allows the
+   administrator to select how old the machine credential must be before
+   trying to renew it.
+-  The administrator can use the new option
+   ``pam_account_locked_message`` to set a custom informational message
+   when the account logging in is locked.
+
+Tickets Fixed
+-------------
+
+.. raw:: html
+
+   <div>
+
+`#1041 </sssd/ticket/1041>`__
+    [RFE] Support Automatic Renewing of Kerberos Host Keytabs
+`#1108 </sssd/ticket/1108>`__
+    [RFE] SUDO: Support the IPA schema
+`#2188 </sssd/ticket/2188>`__
+    automatically assign new slices for any AD domain
+`#2522 </sssd/ticket/2522>`__
+    [RFE] IPA: resolve external group memberships of IPA groups during
+    getgrnam and getgrgid
+`#2626 </sssd/ticket/2626>`__
+    Retry EPIPE from clients
+`#2764 </sssd/ticket/2764>`__
+    the colondb intreface has no unit tests
+`#2765 </sssd/ticket/2765>`__
+    ad\_site parameter does not work
+`#2785 </sssd/ticket/2785>`__
+    incompatibility between sparkleshare and sss\_ssh\_knownhostsproxy
+    due to setlocale()
+`#2791 </sssd/ticket/2791>`__
+    sssd dereference processing failed : Input/output error
+`#2829 </sssd/ticket/2829>`__
+    collapse\_srv\_lookups frees fo\_server structure that is returned
+    by fail over API
+`#2839 </sssd/ticket/2839>`__
+    Allow SSSD to notify user of denial due to AD account lockout
+`#2849 </sssd/ticket/2849>`__
+    cache\_req: don't search override values in LDAP when using LOCAL
+    view
+`#2865 </sssd/ticket/2865>`__
+    sssd\_nss memory usage keeps growing on sssd-1.12.4-47.el6.x86\_64
+    (RHEL6.7) when trying to retrieve non-existing netgroups
+`#2881 </sssd/ticket/2881>`__
+    MAN: Clarify that subdomains always use service discovery
+`#2888 </sssd/ticket/2888>`__
+    SRV lookups with id\_provider=proxy and auth\_provider=krb5
+`#2899 </sssd/ticket/2899>`__
+    [sssd] Trusted (AD) user's info stays in sssd cache for much more
+    than expected.
+`#2902 </sssd/ticket/2902>`__
+    Review and update wiki pages for 1.13.4
+`#2904 </sssd/ticket/2904>`__
+    sssd\_be AD segfaults on missing A record
+`#2906 </sssd/ticket/2906>`__
+    Cannot retrieve users after upgrade from 1.12 to 1.13
+`#2909 </sssd/ticket/2909>`__
+    extreme memory usage in libnfsidmap sss.so plug-in when resolving
+    groups with many members
+`#2910 </sssd/ticket/2910>`__
+    sssd mixup nested group from AD trusted domains
+`#2912 </sssd/ticket/2912>`__
+    refresh\_expired\_interval stops sss\_cache from working
+`#2917 </sssd/ticket/2917>`__
+    Properly remove OriginalMemberOf attribute in SSSD cache if user has
+    no secondary groups anymore
+`#2922 </sssd/ticket/2922>`__
+    ID mapping - bug in computing max id for slice range
+`#2925 </sssd/ticket/2925>`__
+    Add gnome-screensaver to the list of PAM services considered for
+    Smartcard authentication
+`#2931 </sssd/ticket/2931>`__
+    Warn if user cannot read krb5.conf
+`#2934 </sssd/ticket/2934>`__
+    After removing certificate from user in IPA and even after
+    sss\_cache, FindByCertificate still finds the user
+`#2937 </sssd/ticket/2937>`__
+    sss\_obfuscate: SyntaxError: Missing parentheses in call to 'print'
+`#2938 </sssd/ticket/2938>`__
+    Cannot start sssd after switching to non-root
+`#2959 </sssd/ticket/2959>`__
+    The delete operation of the memberof plugin allocates memory on NULL
+    context
+`#2960 </sssd/ticket/2960>`__
+    IPA view: view name not stored properly with default FreeIPA
+    installation
+`#2961 </sssd/ticket/2961>`__
+    Initgroups in AD provider might fail if user is stored in a
+    non-default ou
+`#2962 </sssd/ticket/2962>`__
+    GPO: Access denied in non-root mode
+`#2964 </sssd/ticket/2964>`__
+    GPO: Access denied after blocking connection to AD.
+`#2969 </sssd/ticket/2969>`__
+    sudorule not working with ipa sudo\_provider on older freeipa
+`#2970 </sssd/ticket/2970>`__
+    sudo smart refresh does not work correctly on openldap
+`#2971 </sssd/ticket/2971>`__
+    SSSD PAM module does not support multiple password prompts (e.g.
+    Password + Token) with sudo
+`#2972 </sssd/ticket/2972>`__
+    IPA sudo: support the externalUser attribute
+`#2980 </sssd/ticket/2980>`__
+    sssd\_be[11010]: segfault at 0 ip 00007ff889ff61bb sp
+    00007ffc7d66a3b0 error 4 in libsss\_ipa.so[7ff889fcf000+5d000]
+`#2989 </sssd/ticket/2989>`__
+    local overrides: issues with sub-domain users and mixed case names
+
+.. raw:: html
+
+   </div>
+
+Detailed Changelog
+------------------
+
+Dan Lavu (1):
+
+-  PAM: Fix man for pam\_account\_{expired,locked}\_message
+
+David Disseldorp (1):
+
+-  build: detect endianness at configure time
+
+Jakub Hrozek (17):
+
+-  Upgrading the version for the 1.13.4 release
+-  SDAP: Make it possible to silence errors from dereference
+-  Add a new option ldap\_group\_external\_member
+-  IPA: Add interface to call into IPA provider from LDAP provider
+-  LDAP: Use the IPA provider interface to resolve external group
+   members
+-  FO: Don't free rc-allocated structure
+-  tests: Reduce failover code duplication
+-  FO: Use refcount to keep track of servers returned to callers
+-  FO: Use tevent\_req\_defer\_callback() when notifying callers
+-  memberof: Don't allocate on a NULL context
+-  tests: Add a unit test for the external groups resolution
+-  MAN: Remove duplicate description of the
+   pam\_account\_locked\_message option
+-  AD: Recognize Windows Server 2016
+-  memberof: Fix a memory leak when removing ghost users
+-  memberof: Don't allocate on NULL when deleting memberUids
+-  tests: Check NULL context in sysdb-tests when removing group members
+-  Updating translations for the 1.13.4 release
+
+Lukas Slebodnik (33):
+
+-  SPEC: Change package ownership of %{pubconfpath}/krb5.include.d
+-  CONFIGURE: Replace obsoleted macro AC\_PROG\_LIBTOOL
+-  TESTS: Fix race condition in python test
+-  PYTHON: sss\_obfuscate should work with python3
+-  PYTHON: Fix pep8 errors in sss\_obfuscate
+-  UTIL: Backport error code ERR\_ACCOUNT\_LOCKED
+-  sss\_idmap-tests: Fix segmentation fault
+-  krb5\_child: Warn if user cannot read krb5.conf
+-  Fix typos reported by lintian
+-  UTIL: Use prefix for debug function
+-  UTIL: Provide varargs version of debug\_fn
+-  UTIL: Use sss\_vdebug\_fn for callbacks
+-  Revert "DEBUG: Preventing chown\_debug\_file if journald on"
+-  DEBUG: Ignore ENOENT for change owner of log files
+-  TOOLS: Fix minor memory leak in sss\_colondb\_writeline
+-  CI: Use yum-deprecated instead of dnf
+-  FAIL\_OVER: Fix warning value computed is not used
+-  UTIL: Fix indentation in dlinklist.h
+-  UTIL: Fix warning misleading-indentation
+-  CLIENT: Reduce code duplication
+-  CLIENT: Retry request after EPIPE
+-  UTIL: Move debug part from util.h -> new debug.h
+-  UTIL: Allow to append new line in sss\_vdebug\_fn
+-  AUTOMAKE: Force usage of parallel test harness
+-  CI: Use make check instead of make-check-wrap
+-  test\_ipa\_subdom\_server: Workaround for slow krb5 + SELinux
+-  SPEC: Run extra unit tests with epel
+-  GPO: Soften umask in gpo\_child
+-  GPO\_CHILD: Create directories in gpo\_cache with right permissions
+-  GPO: Process GPOS in offline mode if ldap search failed
+-  IPA: Check RDN in ipa\_add\_ad\_memberships\_get\_next
+-  dp\_ptask: Fix memory leak in synchronous ptask
+-  test\_be\_ptask: Check leaks in tests
+
+Michal Židek (6):
+
+-  NSS: do not skip cache check for netgoups
+-  util: Continue if setlocale fails
+-  server\_setup: Log failed attempt to set locale
+-  tests: Run intgcheck without libsemanage
+-  tests: Regression test with wrong LC\_ALL
+-  GPO: log specific ini parse error messages
+
+Pavel Březina (37):
+
+-  AD SRV: prefer site-local DCs in LDAP ping
+-  SDAP: do not fail if refs are found but not processed
+-  SDAP: Add request that iterates over all search bases
+-  SDAP: rename sdap\_get\_id\_specific\_filter
+-  SDAP: support empty filters in sdap\_combine\_filters()
+-  SUDO: use sdap\_search\_bases instead custom sb iterator
+-  SUDO: make sudo sysdb interface more reusable
+-  SUDO: move code shared between ldap and ipa to separate module
+-  SUDO: allow to disable ptask
+-  SUDO: fail on failed request that cannot be retry
+-  IPA: add ipa\_get\_rdn and ipa\_check\_rdn
+-  SDAP: use ipa\_get\_rdn() in nested groups
+-  IPA SUDO: choose between IPA and LDAP schema
+-  IPA SUDO: Add ipasudorule mapping
+-  IPA SUDO: Add ipasudocmdgrp mapping
+-  IPA SUDO: Add ipasudocmd mapping
+-  IPA SUDO: Implement sudo handler
+-  IPA SUDO: Implement full refresh
+-  IPA SUDO: Implement rules refresh
+-  IPA SUDO: Remember USN
+-  SDAP: Add sdap\_or\_filters
+-  IPA SUDO: Implement smart refresh
+-  SUDO: sdap\_sudo\_set\_usn() do not steal usn
+-  SUDO: remove full\_refresh\_in\_progress
+-  SUDO: assume zero if usn is unknown
+-  SUDO: allow disabling full refresh
+-  SUDO: remember usn as number instead of string
+-  SUDO: simplify usn filter
+-  IPA SUDO: Add support for ipaSudoRunAsExt\* attributes
+-  sdap\_connect\_send: fail if uri or sockaddr is NULL
+-  cache\_req: simplify cache\_req\_cache\_check()
+-  cache\_req: do not lookup views if possible
+-  remove user certificate if not found on the server
+-  IPA SUDO: download externalUser attribute
+-  IPA SUDO: fix typo
+-  IPA SUDO: support old ipasudocmd rdn
+-  SUDO: be able to parse modifyTimestamp correctly
+
+Pavel Reichl (11):
+
+-  sudo: remove unused param name in sdap\_sudo\_get\_usn()
+-  sudo: remove unused param. in ldap\_get\_sudo\_options
+-  IDMAP: Fix computing max id for slice range
+-  IDMAP: New structure for domain range params
+-  IDMAP: Add support for automatic adding of ranges
+-  IDMAP: Fix minor memory leak
+-  IDMAP: Man change for ldap\_idmap\_range\_size option
+-  NSS: Fix memory leak netgroup
+-  IDMAP: Add test to validate off by one bug
+-  SDAP: Add return code ERR\_ACCOUNT\_LOCKED
+-  PAM: Pass account lockout status and display message
+
+Petr Cech (6):
+
+-  KRB5: Adding DNS SRV lookup for krb5 provider
+-  TOOLS: Fix memory leak after getline() failed
+-  TOOLS: Add comments on functions in colondb
+-  TEST\_TOOLS\_COLONDB: Add tests for sss\_colondb\_\*
+-  REFACTOR: umask(077) --> umask(SSS\_DFL\_X\_UMASK)
+-  REFACTOR: umask(0177) --> umask(SSS\_DFL\_UMASK)
+
+Stephen Gallagher (2):
+
+-  GPO: Add Cockpit to the Remote Interactive defaults
+-  GPO: Add other display managers to interactive logon
+
+Sumit Bose (20):
+
+-  nfs idmap: fix infinite loop
+-  Use right domain for user lookups
+-  sdap\_save\_grpmem: determine domain by SID if possible
+-  ipa\_s2n\_save\_objects(): use configured user and group timeout
+-  ldap: remove originalMeberOf if there is no memberOf
+-  UTIL: allow to skip default options for child processes
+-  DP\_TASK: add be\_ptask\_get\_timeout()
+-  AD: add task to renew the machine account password if needed
+-  FO: add fo\_get\_active\_server()
+-  FO: add be\_fo\_get\_active\_server\_name()
+-  AD: try to use current server in the renewal task
+-  p11: add gnome-screensaver to list of allowed services
+-  IPA: lookup idview name even if there is no master domain record
+-  IPA: invalidate override data if original view is missing
+-  sdap: improve filtering of multiple results in GC lookups
+-  pam\_sss: reorder pam\_message array
+-  sss\_override: do not generate DN, search object
+-  tools: read additional data of the master domain
+-  sss\_override: only add domain if name is not fully qualified
+-  intg: local override for user with mixed case name

