- Resolves: #1321138 Missing dependency package "python-sss-murmur" in
  ipa-server-3.0.0-50.el6.x86_64
  - SPEC: Require python2 version of sssd bindings
- Resolves: #1367026 Document and test procedure for running IdM Server in TLS
  1.2+ environment
  - Require 389-ds-base with TLS 1.0 disable switch

- Resolves: #1369470 IPA Replica-Install from RHEL6 to RHEL7 Fails
  - Modififed NSSConnection not to shutdown existing database.
  - Do not erroneously reinit NSS in Dogtag interface
  - Make sure replication works after DM password is changed

- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
  certificate revocation
  - cert-revoke: fix permission check bypass (CVE-2016-5404)

- Update IPA code to support Samba 4.2
- Related: #1322689

- Update IPA code to support Samba 4.2
- Related: #1322688

- Resolves: #1280207 Unable to resolve group memberships for AD users when
  using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with
  ipa-server-3.0.0-42.el6.x86_64 with AD Trust
  - Do not lookup up the domain too early if only the SID is known
  - Do not store SID string in a local buffer
  - Allow ID-to-SID mappings in the extdom plugin
- Resolves: #1280208 ipa-server-install with externally signed CA fails with
  NSS error (SEC_ERROR_BUSY)
  - Free NSS objects in --external-ca scenario

- Resolves: #1220788 - Some IPA schema files are not RFC 4512 compliant

- Require 389-ds-base >= 1.2.11.15-38 to fix roken dereference control with
  the FreeIPA 4.0 ACIs (#1112698)

- group-add-member command reported wrong error on duplicates (#970541)
- ipa-client installation succeeding in ipa server instance (#1011044)

- Require 389-ds-base >= 1.2.11.15-14 to pick up fix for CVE-2013-1897
  (#928160)

- Missing LDAP schema attributeType and objectClass after upgrade (#916535)
- ipa-adtrust-install and ipa-replica-conncheck may not parse krb5.conf
  correctly and crash (#917065)

- Filter generated winbind dependencies so the right version of samba
  can be installed. (#905594)