--- sssd-1.15.2.orig/.git-commit-template
+++ sssd-1.15.2/.git-commit-template
@@ -0,0 +1,9 @@
+COMPONENT: Subject
+
+Explanation
+
+Resolves:
+https://pagure.io/SSSD/sssd/issue/XXXX
+
+# Try to keep the subject line within 52 chars ----|
+# Also please try to not exceed 72 characters of length for the body --|
--- sssd-1.15.2.orig/.tx/config
+++ sssd-1.15.2/.tx/config
@@ -0,0 +1,13 @@
+[main]
+host = https://www.transifex.com
+
+[sssd.master-po-sssd-pot]
+file_filter = po/<lang>.po
+source_file = po/sssd.pot
+source_lang = en
+
+[sssd.sssd-docspot_1]
+file_filter = src/man/po/<lang>.po
+source_file = src/man/po/sssd-docs.pot
+source_lang = en
+
--- sssd-1.15.2.orig/README.md
+++ sssd-1.15.2/README.md
@@ -0,0 +1,28 @@
+# SSSD - System Security Services Daemon
+
+## Introduction
+SSSD provides a set of daemons to manage access to remote directories and
+authentication mechanisms such as LDAP, Kerberos or FreeIPA. It provides
+an NSS and PAM interface toward the system and a pluggable backend system
+to connect to multiple different account sources.
+
+More information about SSSD can be found on its project page -
+https://pagure.io/SSSD/sssd/
+
+## Building and installation
+Please see the file BUILD.txt for details
+
+## Documentation
+The most up-to-date documentation can be found at https://fedorahosted.org/sssd/wiki/Documentation
+
+## Licensing
+Please see the file called COPYING.
+
+## Contacts
+There are several ways to contact us:
+
+* the sssd-devel mailing list: [Development of the System Security Services Daemon](https://fedorahosted.org/mailman/listinfo/sssd-devel)
+* the sssd-users mailing list: [End-user discussions about the System Security Services Daemon](https://fedorahosted.org/mailman/listinfo/sssd-users)
+* the #sssd and #freeipa IRC channels on freenode:
+  * irc://irc.freenode.net/sssd
+  * irc://irc.freenode.net/freeipa
--- sssd-1.15.2.orig/Vagrantfile
+++ sssd-1.15.2/Vagrantfile
@@ -0,0 +1,77 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+# Fedora blog on creating Vagrant files:
+# http://fedoramagazine.org/running-vagrant-fedora-22/
+
+# All Vagrant configuration is done below. The "2" in Vagrant.configure
+# configures the configuration version (we support older styles for
+# backwards compatibility). Please don't change it unless you know what
+# you're doing.
+Vagrant.configure(2) do |config|
+  # The most common configuration options are documented and commented below.
+  # For a complete reference, please see the online documentation at
+  # https://docs.vagrantup.com.
+
+  # Every Vagrant development environment requires a box. You can search for
+  # boxes at https://atlas.hashicorp.com/search.
+  config.vm.box = "fedora-22"
+  config.vm.box_url = "http://download.fedoraproject.org/pub/fedora/linux/releases/22/Cloud/x86_64/Images/Fedora-Cloud-Base-Vagrant-22-20150521.x86_64.vagrant-libvirt.box"
+
+  # Disable automatic box update checking. If you disable this, then
+  # boxes will only be checked for updates when the user runs
+  # `vagrant box outdated`. This is not recommended.
+  # config.vm.box_check_update = false
+
+  # Create a forwarded port mapping which allows access to a specific port
+  # within the machine from a port on the host machine. In the example below,
+  # accessing "localhost:8080" will access port 80 on the guest machine.
+  # config.vm.network "forwarded_port", guest: 80, host: 8080
+
+  # Create a private network, which allows host-only access to the machine
+  # using a specific IP.
+  # config.vm.network "private_network", ip: "192.168.33.10"
+
+  # Create a public network, which generally matched to bridged network.
+  # Bridged networks make the machine appear as another physical device on
+  # your network.
+  # config.vm.network "public_network"
+
+  # Share an additional folder to the guest VM. The first argument is
+  # the path on the host to the actual folder. The second argument is
+  # the path on the guest to mount the folder. And the optional third
+  # argument is a set of non-required options.
+  # config.vm.synced_folder "../data", "/vagrant_data"
+
+  # Provider-specific configuration so you can fine-tune various
+  # backing providers for Vagrant. These expose provider-specific options.
+  # Example for VirtualBox:
+  #
+  # config.vm.provider "virtualbox" do |vb|
+  #   # Display the VirtualBox GUI when booting the machine
+  #   vb.gui = true
+  #
+  #   # Customize the amount of memory on the VM:
+  #   vb.memory = "1024"
+  # end
+  #
+  # View the documentation for the provider you are using for more
+  # information on available options.
+
+  # Define a Vagrant Push strategy for pushing to Atlas. Other push strategies
+  # such as FTP and Heroku are also available. See the documentation at
+  # https://docs.vagrantup.com/v2/push/atlas.html for more information.
+  # config.push.define "atlas" do |push|
+  #   push.app = "YOUR_ATLAS_USERNAME/YOUR_APPLICATION_NAME"
+  # end
+
+  # Enable provisioning with a shell script. Additional provisioners such as
+  # Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
+  # documentation for more information about their specific syntax and use.
+  # config.vm.provision "shell", inline: <<-SHELL
+  #   sudo apt-get update
+  #   sudo apt-get install -y apache2
+  # SHELL
+
+  config.vm.provision :shell, path: "contrib/vagrant/bootstrap.sh"
+end
--- sssd-1.15.2.orig/contrib/gdb/sssd_gdb_plugin.py
+++ sssd-1.15.2/contrib/gdb/sssd_gdb_plugin.py
@@ -0,0 +1,196 @@
+# SSSD and LDB debugging plugins
+#
+# Activate them by putting:
+#   source /path/to/this/file.py
+# to your .gdbinit file
+#
+# To bypass the pretty printer and print the raw values, use the "/r" option:
+#   print /r foobar
+import gdb
+
+
+def gdb_printer_decorator(fn):
+    gdb.pretty_printers.append(fn)
+    return fn
+
+
+def indent_string(s, indent):
+    return '\n'.join(["%s%s" % ("\t" * indent, part) for part in s.split('\n')])
+
+
+class StringPrinter(object):
+    "Shared code between different string-printing classes"
+    def __init__(self, val):
+        self.val = val
+
+    def to_string(self):
+        return self.as_string()
+
+
+class LdbDnPrinter(StringPrinter):
+    " print an ldb dn "
+
+    def as_string(self, indent=0):
+        ret = "{ <%s>\tlinearized:%s }" % (self.val.type, self.val['linearized'])
+        return indent_string(ret, indent)
+
+
+class LdbValPrinter(StringPrinter):
+    " print a ldb value"
+
+    def as_string(self, indent=0):
+        ret = "data = %(data)s, length = %(length)s" % self.val
+        return indent_string("{ <%s>\t%s }" % (self.val.type, ret), indent)
+
+
+class LdbMessageElementPrinter(StringPrinter):
+    " print a ldb message element "
+
+    def as_string(self, indent=0):
+        ret = "flags = %(flags)s, name = %(name)s, num_values = %(num_values)s" % self.val
+        try:
+            nvals = int(self.val['num_values'])
+        except ValueError:
+            return "num_values is not numeric?"
+
+        for i in range(nvals):
+            ldbval = LdbValPrinter(self.val['values'][i])
+            ret += "\n%s" % (ldbval.as_string(indent+1))
+
+        return indent_string("{ <%s>\t%s }" % (self.val.type, ret), indent)
+
+
+class LdbMessagePrinter(StringPrinter):
+    " print a ldb message "
+
+    def as_string(self, indent=0):
+        try:
+            nels = int(self.val['num_elements'])
+        except ValueError:
+            return "num_elements is not numeric?"
+
+        dn = LdbDnPrinter(self.val['dn'])
+        ret = "num_elements:\t%s\ndn:\t%s\nelements:\t" % (nels, dn.as_string(indent))
+
+        for i in range(nels):
+            el = LdbMessageElementPrinter(self.val['elements'][i])
+            ret += "\n%s" % (el.as_string(indent+1))
+
+        return indent_string("{ <%s>\n%s }" % (self.val.type, ret), indent)
+
+
+class LdbResultPrinter(StringPrinter):
+    " print a ldb message element "
+
+    def as_string(self, indent=0):
+        ret = "count = %(count)s, extended = %(extended)s, controls = %(controls)s, refs = %(refs)s" % self.val
+        try:
+            count = int(self.val['count'])
+        except ValueError:
+            ret += 'Count is not numeric value?'
+            return ret
+
+        for i in range(count):
+            msg = LdbMessagePrinter(self.val['msgs'][i])
+            ret += "\n%s" % (msg.as_string(indent+1))
+
+        return indent_string("{ <%s>\t%s }" % (self.val.type, ret), indent)
+
+
+class SysdbAttrsPrinter(StringPrinter):
+    " print a struct sysdb attrs "
+
+    def as_string(self, indent=0):
+        ret = "num = %(num)s" % self.val
+
+        try:
+            num = int(self.val['num'])
+        except ValueError:
+            ret += 'num is not numeric value?'
+            return ret
+
+        for i in range(num):
+            el = LdbMessageElementPrinter(self.val['a'][i])
+            ret += "\n%s" % (el.as_string(indent+1))
+
+        return indent_string("{ <%s>\t%s }" % (self.val.type, ret), indent)
+
+
+# ---
+# --- register pretty printers ---
+# ---
+@gdb_printer_decorator
+def ldb_val_element_printer(val):
+    if str(val.type) == 'struct ldb_dn':
+        return LdbDnPrinter(val)
+    return None
+
+
+@gdb_printer_decorator
+def ldb_val_element_printer(val):
+    if str(val.type) == 'struct ldb_val':
+        return LdbValPrinter(val)
+    return None
+
+
+@gdb_printer_decorator
+def ldb_message_element_printer(val):
+    if str(val.type) == 'struct ldb_message_element':
+        return LdbMessageElementPrinter(val)
+    return None
+
+
+@gdb_printer_decorator
+def ldb_message_printer(val):
+    if str(val.type) == 'struct ldb_message':
+        return LdbMessagePrinter(val)
+    return None
+
+
+@gdb_printer_decorator
+def ldb_result_printer(val):
+    if str(val.type) == 'struct ldb_result':
+        return LdbResultPrinter(val)
+    return None
+
+
+@gdb_printer_decorator
+def sysdb_attrs_printer(val):
+    if str(val.type) == 'struct sysdb_attrs':
+        return SysdbAttrsPrinter(val)
+    return None
+
+
+# ---
+# --- set a breakpoint at the tevent_req finish fn ---
+# ---
+class TeventBreak(gdb.Command):
+    """Break at the tevent finish location """
+
+    def __init__(self):
+        super(TeventBreak, self).__init__("tbr", gdb.COMMAND_BREAKPOINTS)
+
+    def invoke(self, arg, from_tty):
+        req = gdb.parse_and_eval(arg)
+        if not hasattr(req, 'type'):
+            print('cannot determine the type of the variable')
+            return
+        if str(req.type) != 'struct tevent_req *':
+            print('wrong attribute - must be a tevent_req pointer')
+            return
+
+        try:
+            fn = req['async']['fn']
+        except KeyError:
+            print("No async function defined?")
+            return
+
+        try:
+            fnaddr = str(fn).split()[0].strip()
+        except IndexError:
+            print("Cannot get function address")
+            return
+
+        b = gdb.Breakpoint("*%s" % fnaddr)
+
+TeventBreak()
--- sssd-1.15.2.orig/contrib/gdbinit
+++ sssd-1.15.2/contrib/gdbinit
@@ -0,0 +1,2 @@
+# When attaching to a sssd process, cancel the watchdog
+p teardown_watchdog()
--- sssd-1.15.2.orig/contrib/git/pre-push
+++ sssd-1.15.2/contrib/git/pre-push
@@ -0,0 +1,73 @@
+#!/usr/bin/env python
+
+# A git pre-push hook that declines commits that don't contain a Reviewed-By:
+# tag. The tag must be present on the beginning of the line. To activate, copy
+# to $GIT_DIR/hooks/pre-push and make sure the executable flag is on.
+
+# The commit message should also be based on .git-commit-template, although
+# that is just best practice and not enforced
+
+import sys
+import re
+import subprocess
+
+
+def get_all_commits(ref_from, ref_to):
+    args = ['git', 'rev-list', '{:s}..{:s}'.format(ref_from, ref_to)]
+    p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = p.communicate()
+    return [commit.strip() for commit in out.decode('UTF-8').split('\n') if commit != '']
+
+
+def commit_message(commit_hash):
+    args = ['git', 'cat-file', 'commit', commit_hash]
+    p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = p.communicate()
+    return out.decode('UTF-8')
+
+
+def commit_has_rb(commit):
+    msg = commit_message(commit)
+    for l in msg.split('\n'):
+        has_rb = re.search('^Reviewed-by:', l)
+        if has_rb:
+            return True
+
+    return False
+
+
+def report_commit(commit_hash):
+    print("Commit {:s} does not have Reviewed-By!".format(commit_hash))
+    print("Full message:\n======")
+    print("{:s}".format(commit_message(commit_hash)))
+    print("======")
+
+
+# man 5 githooks says:
+#   Information about what is to be pushed is provided on the hook's
+#   standard input with lines of the form:
+#       <local ref> SP <local sha1> SP <remote ref> SP <remote sha1> LF
+def check_push(hook_input):
+    ref_to = hook_input.split()[1][:6]
+    ref_from = hook_input.split()[3][:6]
+    commit_list = get_all_commits(ref_from, ref_to)
+
+    no_rb_list = []
+    for commit in commit_list:
+        if not commit_has_rb(commit):
+            no_rb_list.append(commit)
+
+    return no_rb_list
+
+# Don't warn when pushing to personal repositories, only origin
+remote = sys.argv[1]
+if remote != 'origin':
+    sys.exit(0)
+
+for hook_input in sys.stdin.readlines():
+    no_rb_list = check_push(hook_input)
+
+    if len(no_rb_list) > 0:
+        for offender in no_rb_list:
+            report_commit(offender)
+        sys.exit(1)
--- sssd-1.15.2.orig/contrib/suse/sssd.spec.in
+++ sssd-1.15.2/contrib/suse/sssd.spec.in
@@ -0,0 +1,301 @@
+%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import *; import sys; sys.stdout.write(get_python_lib(1))")}
+%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import *; import sys; sys.stdout.write(get_python_lib())")}
+
+Name: @PACKAGE_NAME@
+Version: @PACKAGE_VERSION@
+Release: 0@PRERELEASE_VERSION@%{?dist}
+Group: Applications/System
+Summary: System Security Services Daemon
+# The entire source code is GPLv3+ except replace/ which is LGPLv3+
+License: GPLv3+ and LGPLv3+
+URL: https://pagure.io/SSSD/sssd/
+Source0: %{name}-%{version}.tar.gz
+BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
+
+%global dhash_version 0.4.0
+
+### Patches ###
+
+### Dependencies ###
+
+Requires: libldb0 >= 0.9.3
+Requires: libtdb1 >= 1.1.3
+Requires: sssd-client = %{version}-%{release}
+Requires: libdhash = %{dhash_version}-%{release}
+Requires: cyrus-sasl-gssapi
+Requires(post): python
+Requires(preun):  aaa_base procps filesystem
+Requires(postun): /sbin/service
+
+%global servicename sssd
+%global sssdstatedir %{_localstatedir}/lib/sss
+%global dbpath %{sssdstatedir}/db
+%global pipepath %{sssdstatedir}/pipes
+%global pubconfpath %{sssdstatedir}/pubconf
+
+### Build Dependencies ###
+
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: libtool
+BuildRequires: m4
+BuildRequires: popt-devel
+BuildRequires: libtalloc-devel
+BuildRequires: libtevent0-devel
+BuildRequires: libtdb1-devel
+BuildRequires: libldb0-devel
+BuildRequires: libcares-devel
+BuildRequires: dbus-1-devel
+BuildRequires: dbus-1
+BuildRequires: openldap2-devel
+BuildRequires: pam-devel
+BuildRequires: mozilla-nss-devel
+BuildRequires: mozilla-nspr-devel
+BuildRequires: pcre-devel
+BuildRequires: libxslt
+BuildRequires: libxml2
+BuildRequires: docbook-xsl-stylesheets
+BuildRequires: krb5-devel
+BuildRequires: python-devel
+
+
+%description
+Provides a set of daemons to manage access to remote directories and
+authentication mechanisms. It provides an NSS and PAM interface toward
+the system and a pluggable backend system to connect to multiple different
+account sources. It is also the basis to provide client auditing and policy
+services for projects like FreeIPA.
+
+%package client
+Summary: SSSD Client libraries for NSS and PAM
+Group: Applications/System
+
+%description client
+Provides the libraries needed by the PAM and NSS stacks to connect to the SSSD
+service.
+
+%package -n libdhash
+Summary: Dynamic hash table
+Group: Development/Libraries
+Version: %{dhash_version}
+License: LGPLv3+
+
+%description -n libdhash
+A hash table which will dynamically resize to achieve optimal storage & access
+time properties
+
+%package -n libdhash-devel
+Summary: Development files for libdhash
+Group: Development/Libraries
+Version: %{dhash_version}
+Requires: libdhash = %{dhash_version}-%{release}
+License: LGPLv3+
+
+%description -n libdhash-devel
+A hash table which will dynamically resize to achieve optimal storage & access
+time properties
+
+
+%prep
+%setup -q
+
+%build
+%configure \
+    --without-tests \
+    --with-db-path=%{dbpath} \
+    --with-pipe-path=%{pipepath} \
+    --with-pubconf-path=%{pubconfpath} \
+    --with-init-dir=%{_initrddir} \
+    --enable-nsslibdir=/%{_lib} \
+    --without-selinux \
+    --without-semanage \
+    --with-os=suse \
+    --disable-static
+
+make %{?_smp_mflags}
+
+%install
+rm -rf $RPM_BUILD_ROOT
+
+make install DESTDIR=$RPM_BUILD_ROOT
+
+# Remove the example files from the output directory
+# We will copy them directly from the source directory
+# for packaging
+rm -f \
+    $RPM_BUILD_ROOT/usr/share/doc/dhash/README \
+    $RPM_BUILD_ROOT/usr/share/doc/dhash/examples/dhash_example.c \
+    $RPM_BUILD_ROOT/usr/share/doc/dhash/examples/dhash_test.c
+
+# Prepare language files
+/usr/lib/rpm/find-lang.sh $RPM_BUILD_ROOT sss_daemon
+/usr/lib/rpm/find-lang.sh $RPM_BUILD_ROOT sss_client
+
+# Copy default sssd.conf file
+mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sssd
+install -m600 server/examples/sssd.conf $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.conf
+install -m400 server/config/etc/sssd.api.conf $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.api.conf
+install -m400 server/config/etc/sssd.api.d/* $RPM_BUILD_ROOT%{_sysconfdir}/sssd/sssd.api.d/
+
+# Remove .la files created by libtool
+rm -f \
+    $RPM_BUILD_ROOT/%{_lib}/libnss_sss.la \
+    $RPM_BUILD_ROOT/%{_lib}/security/pam_sss.la \
+    $RPM_BUILD_ROOT/%{_libdir}/libdhash.la \
+    $RPM_BUILD_ROOT/%{_libdir}/ldb/memberof.la \
+    $RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_ldap.la \
+    $RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_proxy.la \
+    $RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_krb5.la \
+    $RPM_BUILD_ROOT/%{_libdir}/sssd/libsss_ipa.la \
+    $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.la \
+    $RPM_BUILD_ROOT/%{python_sitearch}/pysss.la
+
+if test -e $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
+then
+    # Apppend this file to the sss_daemon.lang
+    # Older versions of rpmbuild can only handle one -f option
+    echo %{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so >> sss_daemon.lang
+fi
+for file in `ls $RPM_BUILD_ROOT/%{python_sitelib}/*.egg-info 2> /dev/null`
+do
+    echo %{python_sitelib}/`basename $file` >> sss_daemon.lang
+done
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%files -f sss_daemon.lang
+%defattr(-,root,root,-)
+%doc COPYING
+%{_initrddir}/%{name}
+%{_sbindir}/sssd
+%{_sbindir}/sss_useradd
+%{_sbindir}/sss_userdel
+%{_sbindir}/sss_usermod
+%{_sbindir}/sss_groupadd
+%{_sbindir}/sss_groupdel
+%{_sbindir}/sss_groupmod
+%{_sbindir}/sss_groupshow
+%{_sbindir}/sss_debuglevel
+%{_libexecdir}/%{servicename}/
+%{_libdir}/%{name}/
+%{_libdir}/ldb/memberof.so
+%dir %{sssdstatedir}
+%attr(700,root,root) %dir %{dbpath}
+%attr(755,root,root) %dir %{pipepath}
+%attr(755,root,root) %dir %{pubconfpath}
+%attr(700,root,root) %dir %{pipepath}/private
+%attr(750,root,root) %dir %{_var}/log/%{name}
+%attr(700,root,root) %dir %{_sysconfdir}/sssd
+%config(noreplace) %{_sysconfdir}/sssd/sssd.conf
+%config %{_sysconfdir}/sssd/sssd.api.conf
+%attr(700,root,root) %dir %{_sysconfdir}/sssd/sssd.api.d
+%config %{_sysconfdir}/sssd/sssd.api.d/
+%{_mandir}/man5/sssd.conf.5*
+%{_mandir}/man5/sssd-ipa.5*
+%{_mandir}/man5/sssd-krb5.5*
+%{_mandir}/man5/sssd-ldap.5*
+%{_mandir}/man8/sssd.8*
+%{_mandir}/man8/sss_groupadd.8*
+%{_mandir}/man8/sss_groupdel.8*
+%{_mandir}/man8/sss_groupmod.8*
+%{_mandir}/man8/sss_groupshow.8*
+%{_mandir}/man8/sss_useradd.8*
+%{_mandir}/man8/sss_userdel.8*
+%{_mandir}/man8/sss_usermod.8*
+%{_mandir}/man8/sss_debuglevel.8*
+%{_mandir}/man8/sssd_krb5_locator_plugin.8*
+%{python_sitearch}/pysss.so
+%{python_sitelib}/*.py*
+
+
+%files client -f sss_client.lang
+%defattr(-,root,root,-)
+/%{_lib}/libnss_sss.so.2
+/%{_lib}/security/pam_sss.so
+%{_mandir}/man8/pam_sss.8*
+
+%files -n libdhash
+%defattr(-,root,root,-)
+%doc common/dhash/COPYING
+%doc common/dhash/COPYING.LESSER
+%{_libdir}/libdhash.so.1
+%{_libdir}/libdhash.so.1.0.0
+
+%files -n libdhash-devel
+%defattr(-,root,root,-)
+%{_includedir}/dhash.h
+%{_libdir}/libdhash.so
+%{_libdir}/pkgconfig/dhash.pc
+%doc common/dhash/README
+%doc common/dhash/examples
+
+%post
+/sbin/ldconfig
+/sbin/chkconfig --add %{servicename}
+if [ $1 -ge 2 ] ; then
+# a one-time upgrade from confdb v1 to v2, only if upgrading
+    python %{_libexecdir}/%{servicename}/upgrade_config.py
+fi
+
+%preun
+if [ $1 = 0 ]; then
+    /sbin/service %{servicename} stop 2>&1 > /dev/null
+    /sbin/chkconfig --del %{servicename}
+fi
+
+%postun
+/sbin/ldconfig
+if [ $1 -ge 1 ] ; then
+    /sbin/service %{servicename} condrestart 2>&1 > /dev/null
+fi
+
+%post client -p /sbin/ldconfig
+
+%postun client -p /sbin/ldconfig
+
+%post -n libdhash -p /sbin/ldconfig
+
+%postun -n libdhash -p /sbin/ldconfig
+
+%changelog
+* Mon Sep 28 2009 Sumit Bose <sbose@redhat.com> - 0.6.0-0
+- New upstream release 0.6.0
+
+* Fri Sep 25 2009 Simo Sorce <ssorce@redhat.com> - 0.5.0-1
+- Split package into server and clients components
+- Convert to new config file format
+
+* Wed Sep 02 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.5.0-0
+- New upstream release 0.5.0
+
+* Mon May 18 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.4.0-1
+- Convert build system to automake
+
+* Mon Apr 20 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
+- bugfix release 0.3.2
+
+* Mon Apr 13 2009 Simo Sorce <ssorce@redhat.com> - 0.3.1-1
+- bugfix release
+
+* Sun Apr 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.3.0-2
+- Remove InfoPipe from RPM build
+
+* Sun Apr 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.3.0-1
+- Convert to using /etc/sssd/sssd.conf for configuration
+
+* Tue Mar 10 2009 Simo Sorce <ssorce@redhat.com> - 0.2.1-1
+- Bump up to version 0.2.1
+
+* Fri Mar 06 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-4
+- fixed items found during review
+- added initscript
+
+* Thu Mar 05 2009 Sumit Bose <sbose@redhat.com> - 0.1.0-3
+- added sss_client
+
+* Mon Feb 23 2009 Jakub Hrozek <jhrozek@redhat.com> - 0.1.0-2
+- Small cleanup and fixes in the spec file
+
+* Thu Feb 12 2009 Stephen Gallagher <sgallagh@redhat.com> - 0.1.0-1
+- Initial release (based on version 0.1.0 upstream code)
--- sssd-1.15.2.orig/contrib/vagrant/bootstrap.sh
+++ sssd-1.15.2/contrib/vagrant/bootstrap.sh
@@ -0,0 +1,21 @@
+#!/bin/bash -x
+
+sed -e "s/@PACKAGE_NAME@/sssd/" \
+    -e "s/@PRERELEASE_VERSION@//" \
+    -e "s/@PACKAGE_VERSION@/0/" \
+    /vagrant/contrib/sssd.spec.in > /vagrant/contrib/sssd_vagrant.spec
+
+dnf clean metadata
+dnf install -y @buildsys-build realmd sssd adcli polkit oddjob-mkhomedir
+dnf builddep -y /vagrant/contrib/sssd_vagrant.spec
+
+source /usr/share/doc/git/contrib/completion/git-prompt.sh
+
+cat << EOF >> /home/vagrant/.bashrc
+source /usr/share/doc/git/contrib/completion/git-prompt.sh
+export GIT_PS1_SHOWDIRTYSTATE=1
+export PS1='[\u@\h:\W\$(__git_ps1 " (%s)")]\$\[\e[0m\] '
+
+. /vagrant/contrib/fedora/bashrc_sssd
+
+EOF
--- sssd-1.15.2.orig/debian/README.source
+++ sssd-1.15.2/debian/README.source
@@ -0,0 +1,58 @@
+This package uses quilt to manage all modifications to the upstream
+source.  Changes are stored in the source package as diffs in
+debian/patches and applied during the build.
+
+To configure quilt to use debian/patches instead of patches, you want
+either to export QUILT_PATCHES=debian/patches in your environment
+or use this snippet in your ~/.quiltrc:
+
+    for where in ./ ../ ../../ ../../../ ../../../../ ../../../../../; do
+        if [ -e ${where}debian/rules -a -d ${where}debian/patches ]; then
+                export QUILT_PATCHES=debian/patches
+                break
+        fi
+    done
+
+To get the fully patched source after unpacking the source package, cd to
+the root level of the source package and run:
+
+    quilt push -a
+
+The last patch listed in debian/patches/series will become the current
+patch.
+
+To add a new set of changes, first run quilt push -a, and then run:
+
+    quilt new <patch>
+
+where <patch> is a descriptive name for the patch, used as the filename in
+debian/patches.  Then, for every file that will be modified by this patch,
+run:
+
+    quilt add <file>
+
+before editing those files.  You must tell quilt with quilt add what files
+will be part of the patch before making changes or quilt will not work
+properly.  After editing the files, run:
+
+    quilt refresh
+
+to save the results as a patch.
+
+Alternately, if you already have an external patch and you just want to
+add it to the build system, run quilt push -a and then:
+
+    quilt import -P <patch> /path/to/patch
+    quilt push -a
+
+(add -p 0 to quilt import if needed). <patch> as above is the filename to
+use in debian/patches.  The last quilt push -a will apply the patch to
+make sure it works properly.
+
+To remove an existing patch from the list of patches that will be applied,
+run:
+
+    quilt delete <patch>
+
+You may need to run quilt pop -a to unapply patches first before running
+this command.
--- sssd-1.15.2.orig/debian/apparmor-profile
+++ sssd-1.15.2/debian/apparmor-profile
@@ -0,0 +1,51 @@
+#include <tunables/global>
+
+/usr/sbin/sssd {
+  #include <abstractions/base>
+  #include <abstractions/kerberosclient>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+
+  capability dac_override,
+  capability dac_read_search,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_nice,
+  capability sys_resource,
+
+  @{PROC} r,
+  @{PROC}/[0-9]*/net/psched r,
+  @{PROC}/[0-9]*/status r,
+
+  /etc/krb5.keytab k,
+  /etc/ldap/ldap.conf r,
+  /etc/libnl-3/classid r,
+  /etc/localtime r,
+  /etc/shells r,
+  /etc/sssd/sssd.conf r,
+
+  /usr/lib/@{multiarch}/ldb/modules/ldb/* m,
+  /usr/lib/@{multiarch}/samba/ldb/* m,
+  /usr/lib/@{multiarch}/sssd/* rix,
+  /usr/sbin/sssd rmix,
+
+  /tmp/{,.}krb5cc_* rwk,
+
+  /var/lib/sss/* rw,
+  /var/lib/sss/db/* rwk,
+  /var/lib/sss/gpo_cache/* rw,
+  /var/lib/sss/mc/* rw,
+  /var/lib/sss/pipes/* rw,
+  /var/lib/sss/pipes/private/* rw,
+  /var/lib/sss/pubconf/* rw,
+  /var/lib/sss/pubconf/krb5.include.d/ r,
+  /var/lib/sss/pubconf/krb5.include.d/* rw,
+  /var/log/sssd/* rw,
+  /var/tmp/host_* rw,
+
+  /{,var/}run/sssd.pid rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.sssd>
+}
--- sssd-1.15.2.orig/debian/changelog
+++ sssd-1.15.2/debian/changelog
@@ -0,0 +1,776 @@
+sssd (1.15.2-1) unstable; urgency=medium
+
+  * New upstream release.
+  * control: Demote adcli to sssd-ad suggests.
+  * rules, common.install: Fix sssd_krb5_locator_plugin install path.
+    (LP: #1664566)
+  * control, copyright, watch: Update upstream URLs.
+  * common.install: Add libsss_files and socket activation helper.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Mon, 20 Mar 2017 15:17:19 +0200
+
+sssd (1.15.0-3) unstable; urgency=medium
+
+  * rules, install: Remove responder service and socket files for now, the
+    sockets weren't supposed to be enabled anyway and can cause issues.
+    (Closes: #854048)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Sat, 04 Feb 2017 18:34:06 +0200
+
+sssd (1.15.0-2) unstable; urgency=medium
+
+  * import-daemon-opts.diff, sssd.default: Drop the patch modifying sssd
+    service file, and revert the daemon options for sysvinit.
+    /etc/default/sssd is now only for the initscript (Closes: #852719)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 26 Jan 2017 21:29:58 +0200
+
+sssd (1.15.0-1) unstable; urgency=medium
+
+  * New upstream release. (Closes: #852450) (LP: #1566508)
+  * Drop upstreamed patches.
+  * sssd-common.sssd.default, import-daemon-opts.diff: Change default
+    daemon options to match current upstream.
+  * sssd-dbus.install: Drop libsss_config, which was removed.
+  * sssd-{ad,common,dbus}.install: Add systemd service and socket files
+    for pac, sudo, ssh, autofs, pam, nss and ifp responders.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Jan 2017 22:46:02 +0200
+
+sssd (1.14.2-2.1) unstable; urgency=low
+
+  * Non-maintainer upload with maintainer approval.
+  * ldap-blocking.diff: Fix ldaps connections by removing NON_BLOCKING from
+    socket options (Closes: 849756).  Patch from upstream pull request #67.
+
+ -- Petter Reinholdtsen <pere@debian.org>  Tue, 24 Jan 2017 22:26:17 +0000
+
+sssd (1.14.2-2) unstable; urgency=medium
+
+  * fix-prefix-substitution.diff: Fix IFP service file path substitution.
+    (LP: #1652629)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 17 Jan 2017 16:39:14 +0200
+
+sssd (1.14.2-1) unstable; urgency=medium
+
+  * New upstream release.
+  * control: Add adcli to sssd-ad Recommends. (LP: #1590471)
+  * accept-krb5-1.15.diff: Allow building PAC responder with MIT krb5
+    1.15. (Closes: #843385)
+  * common.install: Add sssd-secrets manpage.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 16 Nov 2016 10:47:15 +0200
+
+sssd (1.14.1-1) unstable; urgency=medium
+
+  * New upstream release.
+  * ipa-terminate-if-view-name-fails.diff,
+    gpo-add-unity-to-ad-gpo-map-interactive.diff:
+    Dropped, upstream.
+  * sssd-common.dirs: Add etc/sssd/conf.d for config snippets.
+  * control: Add libhttp-parser-dev and libjansson-dev to build-deps.
+  * sssd-tools.install: Add sssctl.
+  * sssd-common.install: Add sssd-secrets and winbind idmap plugin.
+  * Drop the upstart job, it was only shipped on Ubuntu which has
+    switched to systemd.
+  * rules, default, import-daemon-opts.diff: Import daemon options from
+    default/sssd also with systemd. (LP: #1587395)
+  * rules: Don't install a default config file.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 05 Oct 2016 14:20:37 +0300
+
+sssd (1.13.4-3) unstable; urgency=medium
+
+  * common: Add /var/lib/sss/gpo_cache. (LP: #1579092)
+  * gpo-add-unity-to-ad-gpo-map-interactive.diff: Allow logging in from
+    unity lockscreen. (LP: #1578415)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 May 2016 10:39:46 +0300
+
+sssd (1.13.4-2) unstable; urgency=medium
+
+  * ipa-terminate-if-view-name-fails.diff: Fix support for older IPA
+    servers. (LP: #1572582)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 20 Apr 2016 16:55:24 +0300
+
+sssd (1.13.4-1) unstable; urgency=medium
+
+  * New upstream release.
+  * apparmor-profile: Fixed and tidied.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 30 Mar 2016 19:31:33 +0300
+
+sssd (1.13.3-1) unstable; urgency=medium
+
+  * New upstream release.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 17 Dec 2015 13:27:11 +0200
+
+sssd (1.13.2-1) unstable; urgency=medium
+
+  * New upstream release.
+  * patches: Removed fix-obsolete-target.diff, fix-python-modules.diff,
+    both upstream now.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 03 Dec 2015 21:14:29 +0200
+
+sssd (1.13.1-2) unstable; urgency=medium
+
+  * apparmor: Fix access to krb5.include.d. (LP: #1489378)
+  * {krb5-common,proxy}.postinst: Chmod the correct files. (Closes:
+    #801537, #801538)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 13 Oct 2015 16:55:47 +0300
+
+sssd (1.13.1-1) unstable; urgency=medium
+
+  * New upstream release.
+  * {common,ipa,krb5,proxy}.postinst: Create a sssd system user & group,
+    and migrate various bits to their ownership.
+  * Add sssd-dbus to libsss-simpleifp0 Depends.
+  * ipa: Add /var/lib/sss/keytabs.
+  * common: Add PEM/DER conversion library.
+  * Add support for python3 modules.
+  * tools: Add sss_override.
+  * common: Add p11_child.
+  * ad: Drop libsss_ad_common, it was for tests only and not shipped
+    anymore.
+  * common: Move libsss_krb5_common here from sssd-krb5-common to satisfy
+    libsss_ldap_common depending on it.
+  * libsystemd.diff: Dropped, fixed upstream.
+  * fix-python-modules.diff: Don't add symlinks to python modules,
+    rename the built modules instead.
+  * rules, postinst: Avoid running dpkg-architecture in postinst and
+    instead mangle them in post-dh_installdeb.
+  * common: Add depends on adduser.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Sat, 03 Oct 2015 08:38:29 +0300
+
+sssd (1.12.5-3) unstable; urgency=medium
+
+  * sssd-common.postinst: Drop removing the old logrotate file, handle
+    it in sssd.maintscript instead. (Closes: #794332)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 08 Sep 2015 22:47:08 +0300
+
+sssd (1.12.5-2) unstable; urgency=medium
+
+  * sssd-common.postinst: Remove duplicate logrotate file on update.
+    (LP: #1249772)
+  * control, libsystemd.diff: Transition to libsystemd, thanks Michael
+    Biebl! (Closes: #791909)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 21 Jul 2015 15:04:25 +0300
+
+sssd (1.12.5-1) unstable; urgency=medium
+
+  * New upstream release.
+  * Let uscan verify upstream tarballs.
+  * control: Bump policy to 3.9.6, no changes.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Jun 2015 22:36:52 +0300
+
+sssd (1.12.4-1) experimental; urgency=medium
+
+  * New upstream release.
+  * apparmor-profile: Updated. (LP: #1421110)
+  * control: Add new build-depends; cifs-utils, libaugeas-dev,
+    libnfsidmap-dev, libsmbclient-dev, systemd.
+  * control, .install: Add libwbclient-sssd{,-dev}.
+  * control, .install: Add libsss-simpleifp{0,-dev}.
+  * fix-automake-compat.diff, fix-catchchild.diff: Dropped, upstream.
+  * rules: Use max-parallel=1 for dh_auto_install.
+  * sssd-common.install: Add files for NFS v4 client.
+  * sssd-ad.install: Add new files.
+  * sssd-ipa.install: Add selinux_child.
+  * sssd-dbus: Add libsss_config.so.
+  * sssd-common: Add cifs idmap plugin, semanage library and krb5
+    localauth plugin.
+  * rules: Add a placeholder to not modify permissions of
+    {krb5,ldap,selinux}_child.
+  * control: Add libsystemd-login-dev to build-depends.
+  * control: Add libnss-wrapper and libuid-wrapper to build-depends.
+  * rules: Use automake native verbosity for tests, and bump
+    CK_TIMEOUT_MULTIPLIER.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 09 Apr 2015 23:56:01 +0300
+
+sssd (1.11.7-3) unstable; urgency=medium
+
+  * libsss-sudo.postrm: Delete sudoers line from nsswitch.conf, if only
+    files source left. (Closes: #749722)
+  * libsss-sudo.postinst: Fix comments.
+  * libsss-sudo.postinst: Check nsswitch sudoers entry unconditionally,
+    so that it is added on upgrade too if missing.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Fri, 16 Jan 2015 13:53:22 +0200
+
+sssd (1.11.7-2) unstable; urgency=medium
+
+  * default, upstart.in: Upstream ticket #2312 is fixed now, so drop the
+    workaround to run the daemon in the foreground. (Closes: #760353)
+  * fix-automake-compat.diff: Added an upstream commit to fix configure
+    with new automake.
+  * fix-catchchild.diff: Fix build failure with samba 4.1.13, bump
+    samba-dev build-dependency to match.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 30 Oct 2014 14:49:05 +0200
+
+sssd (1.11.7-1) unstable; urgency=medium
+
+  * New upstream release.
+  * sssd-common.install, sssd-dbus.install: Add new sss_signal helper
+    and the dbus service using it.
+  * fix-obsolete-target.diff: Drop syslog.target from the service file.
+  * libnss-sss.post*: Add sss entry to shadow and services on
+    nsswitch.conf. (Closes: #761173)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 24 Sep 2014 07:08:04 +0300
+
+sssd (1.11.6-1) unstable; urgency=medium
+
+  * New upstream release.
+  * control: Update my email.
+  * control: Update vcs urls.
+  * libnss-sss.postrm: Check DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT before
+    removing sss entry from nsswitch.conf. (Closes: #748671)
+  * libpam-sss.prerm: Check DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT before
+    running pam-auth-update --remove.
+  * control: Mark libkeyutils-dev, libselinux-dev, libsemanage-dev,
+    libnl*-dev build-deps as linux-any, as a preliminary step to build
+    on kfreebsd-*.
+  * Run wrap-and-sort.
+  * sssd-dbus: Add a new subpackage for the D-Bus responder.
+  * control: Demote libsasl2-modules-ldap to Suggests for sssd-ldap.
+  * generate-config: Bring it back for convenience, but don't run it on
+    postinst.
+  * sssd-common.postinst: Remove obsolete config upgrade.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 19 Aug 2014 09:15:13 +0300
+
+sssd (1.11.5.1-2) unstable; urgency=medium
+
+  * control: Drop libcmocka-dev and check from build-depends again so
+    that the package will build on every arch. Test failures will be
+    fixed in a future upload.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 14 Aug 2014 02:22:57 +0300
+
+sssd (1.11.5.1-1) unstable; urgency=medium
+
+  [ Stéphane Graber ]
+  * Fix upstart job to provide a proper stdin for sssd.
+  * Update defaults to always pass -i.
+
+  [ Timo Aaltonen ]
+  * New upstream release. (Closes: #745664)
+  * control: Bump libkrb5-dev build-dependency to 1.12 due to the OTP
+    features.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 09 May 2014 14:50:12 +0300
+
+sssd (1.11.5-1) unstable; urgency=medium
+
+  * New upstream bugfix release. (Closes: #729982)
+  * upstart: Run the daemon in foreground and drop expect fork from the
+    job, should fix issues with upstart getting confused when a backend
+    fails to start.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Tue, 08 Apr 2014 23:39:20 +0300
+
+sssd (1.11.4-1) unstable; urgency=low
+
+  * New upstream release.
+  * control, rules: Add libcmocka-dev and re-add check to build-depends.
+    Override dh_auto_test so that it shows the test error log if they fail.
+  * rules: Fix the manpage date handling with a bigger hammer, and
+    enable it for all manpages not just pam_sss.8. (Closes: #734083)
+  * Drop an obsolete lintian override from libsss-sudo.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 21 Mar 2014 13:28:38 +0200
+
+sssd (1.11.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * control: Update policy to 3.9.5, no changes.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 03 Jan 2014 00:01:29 +0200
+
+sssd (1.11.2-1) unstable; urgency=low
+
+  * New upstream release.
+  * rules, sssd-common.install: Use the correct path for the systemd
+    service file.
+  * control: Build depend on libpam0g-dev | libpam-dev.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Tue, 19 Nov 2013 15:22:27 +0200
+
+sssd (1.11.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * sssd-common.postinst, generate-config: Don't create a config on install,
+    drop generate-config. (Closes: #717587)
+  * sssd-common.postrm: Remove /etc/apparmor.d too, if empty.
+  * control, rules, sssd-common.install: Install the systemd service
+    file provided by upstream.
+  * control: Drop M-A: foreign from sssd-* and add back to sssd instead.
+  * control: Don't hardcode 'multiarch-support'.
+  * control: Drop unnecessary multiarch declarations.
+  * control: Drop obsolete Breaks/Conflicts.
+  * rules: Enable parallel build.
+  * control: Add libltdl-dev to build-depends.
+  * control: Prepare for new unified samba package, adjust build-
+    dependencies. Thanks, Ivo De Decker! (Closes: #725992)
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Tue, 06 Aug 2013 17:04:28 +0300
+
+sssd (1.10.0-1) unstable; urgency=low
+
+  [ Timo Aaltonen ]
+  * New upstream release (Closes: #693054, #705357, #711101)
+  * Update the packaging for the new version, thanks Esko Järnfors!
+    - Add libsss-idmap0, libsss-idmap-dev packages
+    - Add sssd Depends on libsss-idmap0
+    - Add /var/lib/sss/mc directory for the new mmap cache
+  * Split authentication providers to separate packages and make sssd
+    a metapackage.
+  * control: Drop libunistring-dev from build-depends and add libglib2.0-dev
+    for unicode support.
+  * sssd-*.install: Install new manpages.
+  * python-sss.install: py-files got moved under SSSDConfig.
+  * control, rules: Use default build flags, bump dpkg-dev build-dep to
+    1.16.1~.
+  * rules: Install the apparmor profile with -m644.
+  * python-sss: Add pysss_murmur.so.
+  * rules, control, sssd-ad-common.install: PAC responder support.
+    - Add libndr-dev, libndr-standard-dev, libsamba-util-dev, samba4-dev,
+      libdcerpc-dev to build-depends
+    - Add -I/usr/include/samba-4.0 to CFLAGS
+  * control: Mark sssd-common as Multi-Arch: foreign.
+  * watch: Add a comment about the upstream git tree.
+  * Replace perl snippet from libnss-sss.post* with sed, drop perl from
+    Depends. (Closes: #686237)
+  * compat: Bump compat to 9.
+  * rules: Set DEB_HOST_MULTIARCH, drop --libdir and remnants of cdbs.
+  * sssd-common.install: Install the support binaries under the multiarch path.
+  * rules,sssd-common.postinst: Move generate-config to /usr/share/sssd.
+  * rules, sssd-common.install: Use the correct install path for the
+    krb5_locator plugin.
+  * libnss-sss.postinst: SSSD doesn't handle shadow maps, so don't pretend
+    that it would.
+  * libsss-sudo*, control: Remove the soname from the library, move .so to
+    the libsss-sudo, drop -dev package.
+  * rules: Pass --datadir, so the path in autogenerated python files is
+    correctly substituted. (LP: #1079938)
+  * sssd-krb5-common.dirs: Add krb5 include dir.
+  * fix-cve-2013-0219*.diff, -0220.diff: Dropped, included upstream.
+  * libsss-sudo.postrm: Run ldconfig on remove/purge.
+  * apparmor-profile: Fix the profile to use the multiarch path for it's
+    helper location (LP: #1175317).
+  * Add packaging for libsss-nss-idmap0, libsss-nss-idmap-dev,
+    python-libsss-nss-idmap.
+  * watch: Updated to work with alpha/beta releases.
+  * control: Migrate to libnl-3 now that it's supported. (Closes: #688174)
+  * sssd-common.{preinst,postrm}: Install the apparmor profile in force-complain
+    mode on install, and remove the profile directory on purge (if empty). Also
+    migrate from previous setup which installed it as disabled.
+    (Closes: #676140)
+  * control: Bump policy to 3.9.4, no changes.
+  * control: Add libpam-pwquality (>= 1.2.2-1) to libpam-sss depends, which
+    makes the password stack work in all cases. (LP: #1159983)
+  * control: Drop check from build-depends for now, to work around a linking bug
+    in check (#712140) that makes the tests fail on (at least) i386.
+
+  [ Stéphane Graber ]
+  * Add postinst/postrm script for libsss-sudo. Those will add a "sudoers"
+    entry to /etc/nsswitch.conf upon first installation of the package and
+    will then take care of adding/removing sss from the stack as required.
+  * Set CK_DEFAULT_TIMEOUT to 30 so that slower buildds (armhf at least) can
+    run the tests without hitting the default 4s timeout.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 05 Jul 2013 14:53:06 +0300
+
+sssd (1.8.4-2) unstable; urgency=low
+
+  * fix-cve-2013-0219-1.diff, fix-cve-2013-0219-2.diff,
+    fix-cve-2013-0220.diff: Upstream commits from the stable tree to fix
+    recent CVE reports. (Closes: #698871)
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Wed, 27 Feb 2013 23:38:28 +0200
+
+sssd (1.8.4-1) unstable; urgency=low
+
+  * New upstream bugfix release 1.8.2.
+    - Several fixes to case-insensitive domain functions
+    - Fix for GSSAPI binds when the keytab contains unrelated
+      principals
+    - Fixed several segfaults
+    - Workarounds added for LDAP servers with unreadable RootDSE
+    - SSH knownhostproxy will no longer enter an infinite loop
+      preventing login
+    - The provided SYSV init script now starts SSSD earlier at startup
+      and stops it later during shutdown
+    - Assorted minor fixes for issues discovered by static analysis
+      tools
+  * New upstream bugfix release 1.8.3.
+    - Numerous manpage and translation updates
+    - LDAP: Handle situations where the RootDSE isn't available anonymously
+    - LDAP: Fix regression for users using non-standard LDAP attributes for
+      user information
+  * New upstream bugfix release 1.8.4. (LP: #981125, #985031)
+    - Fix a bug causing AD servers not to fail over properly when the KDC
+      on the primary server is down
+    - Fix an endianness bug on big-endian systems when looking up services
+    - Fix a segfault dealing with nested groups (LP: #981125)
+    - Make the nowait cache updates work for netgroups
+    - Fix a regression that broke domains with use_fully_qualified_names = True
+      (LP: #985031)
+  * control: Move the dependency of libsasl2-modules-gssapi-mit to
+    Recommends.
+  * control: sssd works with Heimdal gssapi modules too, add
+    libsasl2-modules-gssapi-mit as an option for the Recommends.
+    (LP: #966146)
+  * libpam-sss.pam-auth-update:
+    - Drop the dependency to 128, since pam_sss should always be below
+      pam_unix. (LP: #957486)
+    - Drop 'use_authtok' from the password stack, since it only works when
+      pam_cracklib is installed. This will allow password changes on the
+      default install.
+  * sssd.postrm: Try to remove /etc/sssd only if it exists.
+    (Closes: #666226)
+  * Add disabled by default Apparmor profile (LP: #933342)
+    - debian/sssd.upstart.in: load the profile during pre-start
+    - add debian/apparmor-profile, install to /etc/apparmor.d
+    - debian/rules: use dh_apparmor to install profile before sssd is
+      restarted
+    - debian/control: sssd Suggests apparmor (>= 2.3)
+    - debian/control: Add dh-apparmor to build-depends
+    - debian/sssd.preinst: disable profile on clean install or upgrades
+      from earlier than when we shipped the profile
+  * rules: Mangle the date stamp on pam_sss.8 so that the compressed file is
+    identical across all archs. (Closes: #670019)
+  * control: Add build-depends on libnl-dev to enable Netlink support.
+  * control: Add build-depends on libkeyutil-dev to enable support for
+    kernel keyring manipulation.
+  * sssd.logrotate: Rotate logs weekly, keep four previous rotations.
+    (Closes: #672984)
+  * sssd.upstart.in: Delete an invisible control character from the pre-start
+    script. (LP: #1003845)
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 01 Jun 2012 11:43:42 +0300
+
+sssd (1.8.1-1) unstable; urgency=low
+
+  * New maintainer, Debian SSSD Team. (Closes: #660985)
+
+  [ Timo Aaltonen ]
+  * New upstream release (1.8.1) (Closes: #647980, #624194, #639965)
+    - Support for the service map in NSS
+    - Support for setting default SELinux user context from FreeIPA
+    - Support for retrieving SSH user and host keys from LDAP (Experimental)
+    - Support for caching autofs LDAP requests (Experimental)
+    - Support for caching SUDO rules (Experimental)
+  * Update build-deps:
+    - Add libunistring-dev, libdhash-dev, libcollection-dev and
+      libini-config-dev.
+    - Add check for unit tests.
+    - Drop cvs and python-central.
+    - Migrate to dh, drop cdbs build-dep, add quilt, dh-autoreconf and
+      autopoint to build-deps.
+  * Add new packages:
+    - libipa-hbac0, libipa-hbac-dev, libsss-sudo0, libsss-sudo-dev,
+      and python-libipa-hbac.
+    - Split sssd-tools: add Breaks/Replaces sssd (<< 1.8.0~beta3-1) and
+      add to sssd Suggests
+  * Drop patch to ensure LDAP authentication never accept a zero
+    length password, which is now included upstream.
+  * sssd.upstart.ubuntu:
+    - Don't start before net-device-up. (LP: 812943)
+    - Source /etc/default/sssd. (LP: 812943)
+  * sssd.default: Added a file to include the sssd daemon defaults,
+    currently has '-D -f'.
+  * sssd.init: Drop separate OPTIONS, '-D' comes from /etc/default/sssd
+    now..
+  * rules: Install the Python API files to /usr/share/sssd, as discussed
+    with upstream. (LP: 859611)
+  * fix-python-api-path.dpatch: Use the new location for the API files.
+    (LP: 859611)
+  * libpam-sss.pam-auth-update:
+    - Add 'forward_pass' to auth stack to fix ecryptfs mounts. (LP: 826643)
+    - Add pam_localuser.so to account stack to allow local users to log in.
+      (LP: 860488)
+  * control: sssd now Recommends libpam-sss and libnss-sss, since sssd is
+    mostly useless without them. (LP: 767337)
+  * control, compat: Bump debhelper build-dep and compat level to 8.
+  * Switch patch-system to quilt.
+  * Do not install a working config file by default. The local domain
+    definition was broken (upstream #1014). The daemon will need to be
+    configured by other means before it's usable.
+  * Add support for Multi-Arch (Closes: #634123).
+  * Remove unnecessary libnss-sss.links.
+  * libnss-sss.overrides: Add an override for
+    "package-name-doesnt-match-sonames".
+  * Determine the used init system during build, add lsb-release to
+    build-deps. Default to sysvinit, use upstart if Ubuntu.
+  * sssd.upstart.in: Test if the config file exists, and exit if not.
+  * Fail gracefully if invoke-rc.d returns an error on postinst/prerm, like
+    when the daemon fails to start when there is no config file.
+  * sssd.init.in: Check that /etc/default/sssd is a real file before sourcing
+    it (Closes: #587895).
+  * control: Add libsasl2-modules-gssapi-mit and libsasl2-modules-ldap to
+    Recommends for sssd.
+  * rules: Move the rule for purging .la files before dh_install
+    (Closes: #633206).
+  * sssd.install: Fix the wildcard for plugins to include .so symlinks.
+  * rules: Add configure flags
+    - Disable RPATH
+    - Disable building static libs
+    - Enable ssh user and host key retrieval, autofs request
+      and sudo rules caching. The respective packages need to add support
+      for these to be useful.
+  * Drop fix-python-api-path.patch, included upstream.
+  * sssd.examples: Install the renamed example config.
+  * rules: Drop special handling of the sssd.api.d, upstream uses
+    the proper path now.
+  * rules: Add --fail-missing to dh_install.
+  * sssd.install: Add new files.
+  * libpam-sss.install, control: Move pam_sss.8 to the correct package,
+    add Breaks/Replaces.
+  * rules: Remove some files we don't want to install, to make dh_install
+    happy.
+  * rules: Clean po/*.gmo, po/stamp-po and *.pyc.
+  * Install lintian overrides using dh_lintian.
+  * {sssd,libnss-sss}.lintian-overrides: Update.
+  * Move libsasl2-modules-gssapi to sssd Depends to make sure it gets
+    installed, as it's needed in most cases.
+  * control: Update maintainer address and repo location.
+  * control: Bump the Standards-Version to 3.9.3, no changes.
+  * control: Bump the debhelper build-dep to 9.
+  * control: Add ${misc:Depends} to libipa-hbac*, libsss-sudo*.
+  * control, rules: Migrate to dh_python2 (Closes: #617071).
+  * control: Add myself to uploaders.
+
+  [ Petter Reinholdtsen ]
+  * New upstream version 1.2.4:
+    - Resolves long-standing issues related to group processing with
+      RFC2307bis LDAP servers.
+    - Fixed bugs in RFC2307bis group memberships related to initgroups
+      (Closes: #595564).
+    - Fix tight-loop bug on systems with older OpenLDAP client
+      libraries (such as Red Hat Enterprise Linux 5)
+  * New Upstream Version 1.2.3:
+    - Resolves CVE-2010-2940.
+  * New Upstream Version 1.2.2:
+    - The LDAP provider no longer requires access to the LDAP
+      RootDSE. If it is unavailable, we will continue on with our best
+      guess.
+    - The LDAP provider will now log issues with TLS and GSSAPI to the
+      syslog.
+    - Significant performance improvement when performing initgroups
+      on users who are members of large groups in LDAP.
+    - The sss_client will now reconnect properly to the SSSD if the
+      daemon is restarted.
+      * This resolves an issue causing GDM to crash when logging out
+        of a user after the SSSD had been restarted.
+  * Correct package description for python-sss (Closes: #596215).
+  * Update Standards-Version from 3.8.4 to 3.9.1.  No changes needed.
+
+  [ Stéphane Graber ]
+  * Fix prerm invoke_failure hook to simply return as empty functions
+    are invalid shell syntax.
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Thu, 22 Mar 2012 13:28:27 +0200
+
+sssd (1.2.1-4.4) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Fix FTBFS with -Werror=format-security. Thanks Philippe De Swert for patch.
+    (Closes: #643806).
+
+ -- Hector Oron <zumbi@debian.org>  Sun, 19 Feb 2012 19:33:04 +0000
+
+sssd (1.2.1-4.3) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Adjust install path to consider GNU triplet (Closes: #640626).
+
+ -- Luca Falavigna <dktrkranz@debian.org>  Tue, 20 Sep 2011 20:02:34 +0200
+
+sssd (1.2.1-4.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * debian/sssd.install
+    - updated location for ldb modules; Closes: #618159
+
+ -- Sandro Tosi <morph@debian.org>  Fri, 03 Jun 2011 23:53:59 +0200
+
+sssd (1.2.1-4.1) unstable; urgency=medium
+
+   * Non-maintainer upload by the Security Team
+   * Fix CVE-2010-4341 (Closes: #610032)
+
+ -- Moritz Muehlenhoff <jmm@debian.org>  Tue, 25 Jan 2011 22:09:21 +0100
+
+sssd (1.2.1-4) unstable; urgency=low
+
+  * Add patch from Stephen Gallagher to ensure LDAP authentication
+    never accept a zero length password (Closes: #594413).  Solves
+    CVE-2010-2940.
+
+ -- Petter Reinholdtsen <pere@debian.org>  Wed, 25 Aug 2010 22:33:40 +0200
+
+sssd (1.2.1-3) unstable; urgency=low
+
+  [ Petter Reinholdtsen ]
+  * Look for /etc/default/sssd, not /etc/defaults/sssd in init.d
+    script (Closes: #588252).
+  * Make sssd.conf generation more robust, and make sure missing SRV
+    records are ignored and not handled as host names.
+  * Add code in generate-config to look up Kerberos realm using
+    _kerberos TXT record in DNS if it exist.
+  * Recommend bind9-host used by generate-config for SRV and TXT
+    lookups.
+  
+  [ Morten Werner Forsbring ]
+  * Check if /etc/default/sssd is a file and executable, not a directory,
+    before sourcing in init-script. Thanks to lintian.
+
+ -- Morten Werner Forsbring <werner@debian.org>  Thu, 12 Aug 2010 16:31:14 +0200
+
+sssd (1.2.1-2) unstable; urgency=low
+
+  * Make sure init.d script sources /etc/default/sssd (Closes: #588252).
+  * Drop /etc/default/sssd from package, to avoid conffile question
+    from dpkg during upgrades.
+  * Make sure to only remove obsolete sssd conffiles on upgrades, not
+    on first time installation.
+  * Add new script generate-config and call it from the sssd postinst
+    during first time installation to try to generate the sssd.conf
+    file dynamically for LDAP and Kerberos using DNS entries, and fall
+    back to the static example configuration if this fail.
+  * Let sssd suggest libnss-sss and libpam-sss, to make those
+    installing sssd aware of the other packages.
+  * Add netgroup to nsswitch.conf entries added at first time
+    installation, to make sure those installing now get working
+    netgroups when sssd get netgroup support
+  * Let sssd recommend ldap-utils as ldapsearch is used for generating
+    the configuration.
+
+ -- Petter Reinholdtsen <pere@debian.org>  Fri, 06 Aug 2010 23:44:26 +0200
+
+sssd (1.2.1-1) unstable; urgency=low
+
+  [ Petter Reinholdtsen ]
+  * Move calls to pam-auth-update from the package scripts in sssd to
+    libpam-sss, and correct prerm call to remove the correct pam config.
+    Add versioned dependency on libpam-runtime to make sure
+    pam-auth-update is available.
+  * Add code to the postinst and postrm of libnss-sss to update
+    passwd, group and shadow entries in /etc/nsswitch.conf.
+  * Make sure init.d/sssd start after $named, to ensure it can look up
+    in DNS also when the DNS server is on the local machine.
+
+  [ Morten Werner Forsbring ]
+  * New upstream release.
+
+ -- Morten Werner Forsbring <werner@debian.org>  Thu, 24 Jun 2010 14:16:30 +0200
+
+sssd (1.2.0-1) unstable; urgency=low
+
+  [ Petter Reinholdtsen ]
+  * New upstream release.
+    - Add libsemanage1-dev as build dependency, as it is now required.
+    - Drop python-build-with-deb-layout.dpatch, now handled upstream.
+    - Adjust provide-default-working-sssd-config-file.dpatch to
+      work with new package source layout and config file content.
+    - Adjust build rules to cope with server/ changing to src/ in the
+      source tarball.
+    - Add --enable-krb5-locator-plugin to keep building the plugin.
+  * Change the pam-auth-update configuration to make the session
+    script optional instead of sufficient, to make sure the other
+    session modules are executed too.
+  * Change initial pam password entry from requisite to sufficient,
+    to make sure local users can have their password set even if
+    sssd is enabled.
+  * Rename pam-configs/sssd to pam-configs/sss, to have a name that
+    is consistent with the package name libpam-sss.
+  * Add VCS links to the GIT repository.
+  * Move configuration API documentation from /etc/sssd/ to
+    /usr/share/doc/sssd/.  It is not configuration and do not belong
+    in /etc/.
+  * Drop autoconf, automake, libtool, m4 and autotools-dev from
+    build-depends.  There is no need to regenerate the build files any
+    more.
+
+  [ Morten Werner Forsbring ]
+  * Add dnsutils as build-dependency.
+
+ -- Morten Werner Forsbring <werner@debian.org>  Tue, 01 Jun 2010 20:41:59 +0200
+
+sssd (1.0.5-1) unstable; urgency=low
+
+  * Initial upload based on package from Ubuntu (Closes: #579593).
+  * Update standards-version from 3.8.3 to 3.8.4.  No changes needed.
+  * Add init.d script and rename sssd.upstart to sssd.upstart.ubuntu
+    to make sure init.d script is installed instead of upstart job.
+  * Add draft pam-auth-update configuration based on proposals in
+    Launcepad bug #557398.
+  * Update address to FSF in copyright file.  Thanks lintian.
+  * Set section for python-sss to python after advice from lintian.
+  * Rewrite python-build-with-deb-layout.dpatch to patch Makefile.in
+    instead of Makefile.am, to avoid having to run autoreconf.
+  * Make sssd depend on python for its upgrade script.
+  * Extend clean rule to remove generated file server/config/.files.
+  * Make sure sssd.api.conf is installed into the sssd package, and
+    put it in /etc/sssd/sssd.api.conf.  Fixes typo in Ubuntu package.
+
+ -- Petter Reinholdtsen <pere@debian.org>  Wed, 05 May 2010 21:53:29 +0200
+
+sssd (1.0.5-0ubuntu1) lucid; urgency=low
+
+  * New upstream bugfix release. (LP: #510290)
+  * sssd.dirs: Add /var/lib/sss/pubconf (LP: #557394)
+
+ -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 16 Apr 2010 11:37:16 +0300
+
+sssd (1.0.2-0ubuntu2) lucid; urgency=low
+
+  * No change rebuild due to libldb downgrade
+
+ -- Scott Kitterman <scott@kitterman.com>  Fri, 02 Apr 2010 17:48:19 -0400
+
+sssd (1.0.2-0ubuntu1) lucid; urgency=low
+
+  * New upstream release (LP: #473262):
+    - python API for managing sssd daemon configuration and
+      native SSSD users.
+    - support for asynchronous cache refreshes.
+    - support password changing in LDAP and Kerberos providers.
+    - support for server failover.
+  * debian/control:
+    - update tdb build dependency to use libtdb-dev.
+    - add libselinux1-dev and libsasl2-dev build dependencies.
+  * debian/sssd.upstart: replace init script with an upstart job.
+  * Turn sssd.conf into a configuration file.
+  * Create sssd log directory.
+
+ -- Mathias Gug <mathiaz@ubuntu.com>  Tue, 19 Jan 2010 15:17:13 -0500
+
+sssd (0.5.0-0ubuntu2) karmic; urgency=low
+
+  * debian/libnss-sss.overrides, debian/sssd.overrides:
+    + Fix linitian errors and warnings (LP: #425697):
+      sssd ships an nss library - these are false-positives.
+  * debian/fix-dbus-watch.dpatch: Update dbus-patch to final
+    upstream version.
+  * debian/fix-proxy-segfault.dpatch: Fix proxy enumeration.
+
+ -- Mathias Gug <mathiaz@ubuntu.com>  Wed, 09 Sep 2009 20:21:04 -0400
+
+sssd (0.5.0-0ubuntu1) karmic; urgency=low
+
+  * Initial release.
+
+ -- Mathias Gug <mathiaz@ubuntu.com>  Mon, 24 Aug 2009 16:35:11 -0400
--- sssd-1.15.2.orig/debian/compat
+++ sssd-1.15.2/debian/compat
@@ -0,0 +1 @@
+9
--- sssd-1.15.2.orig/debian/control
+++ sssd-1.15.2/debian/control
@@ -0,0 +1,445 @@
+Source: sssd
+Section: utils
+Priority: extra
+Maintainer: Debian SSSD Team <pkg-sssd-devel@lists.alioth.debian.org>
+Uploaders: Timo Aaltonen <tjaalton@debian.org>
+Build-Depends:
+ autopoint,
+# check,
+ cifs-utils,
+ debhelper (>= 9),
+ dh-apparmor,
+ dh-autoreconf,
+ dh-python,
+ dh-systemd (>= 1.5),
+ dnsutils,
+ docbook-xml,
+ docbook-xsl,
+ dpkg-dev (>= 1.16.1~),
+ krb5-config,
+ libaugeas-dev,
+ libc-ares-dev,
+# libcmocka-dev [amd64 armhf i386],
+ libcollection-dev,
+ libdbus-1-dev,
+ libdhash-dev,
+ libglib2.0-dev,
+ libhttp-parser-dev,
+ libini-config-dev,
+ libjansson-dev,
+ libkeyutils-dev [linux-any],
+ libkrb5-dev (>= 1.12),
+ libldap2-dev,
+ libldb-dev,
+ libltdl-dev,
+ libnfsidmap-dev,
+ libnl-3-dev [linux-any],
+ libnl-route-3-dev [linux-any],
+ libnspr4-dev,
+ libnss-wrapper,
+ libnss3-dev,
+ libpam0g-dev | libpam-dev,
+ libpcre3-dev,
+ libpopt-dev,
+ libsasl2-dev,
+ libselinux1-dev [linux-any],
+ libsemanage1-dev [linux-any],
+ libsmbclient-dev,
+ libsystemd-dev [linux-any],
+ libtalloc-dev,
+ libtdb-dev,
+ libtevent-dev,
+ libuid-wrapper,
+ libxml2-utils,
+ lsb-release,
+ python-dev (>= 2.6.6-3~),
+ python-setuptools,
+ python3-dev,
+ python3-setuptools,
+ quilt,
+ samba-dev (>= 2:4.1.13),
+ systemd,
+ xml-core,
+ xsltproc
+X-Python-Version: >= 2.6
+X-Python3-Version: >= 3.3
+Standards-Version: 3.9.6
+Vcs-Git: git://anonscm.debian.org/pkg-sssd/sssd.git
+Vcs-Browser: http://anonscm.debian.org/cgit/pkg-sssd/sssd.git
+Homepage: https://pagure.io/SSSD/sssd/
+
+Package: sssd
+Section: metapackages
+Architecture: any
+Multi-Arch: foreign
+Pre-Depends: ${misc:Pre-Depends}
+Depends:
+ python-sss (= ${binary:Version}),
+ sssd-ad (= ${binary:Version}),
+ sssd-common (= ${binary:Version}),
+ sssd-ipa (= ${binary:Version}),
+ sssd-krb5 (= ${binary:Version}),
+ sssd-ldap (= ${binary:Version}),
+ sssd-proxy (= ${binary:Version}),
+ ${misc:Depends}
+Description: System Security Services Daemon -- metapackage
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package is a metapackage which installs the daemon and existing
+ authentication back ends.
+
+Package: sssd-common
+Architecture: any
+Depends: python, python-sss, ${misc:Depends}, ${shlibs:Depends},
+ adduser,
+Recommends: bind9-host, libnss-sss, libpam-sss, libsss-sudo
+Suggests: apparmor, sssd-tools
+Breaks: sssd (<< 1.10.0~beta2-1),
+ sssd-krb5-common (<< 1.13.1-1),
+Replaces: sssd (<< 1.10.0~beta2-1),
+ sssd-krb5-common (<< 1.13.1-1),
+Description: System Security Services Daemon -- common files
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provides the daemon and other common files needed by the
+ authentication back ends.
+
+Package: sssd-ad
+Architecture: any
+Depends:
+ libsss-idmap0 (= ${binary:Version}),
+ sssd-ad-common (= ${binary:Version}),
+ sssd-common (= ${binary:Version}),
+ sssd-krb5-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Suggests:
+ adcli,
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- Active Directory back end
+ Provides the Active Directory back end that the SSSD can utilize to fetch
+ identity data from and authenticate against an Active Directory server.
+
+Package: sssd-ad-common
+Architecture: any
+Depends: sssd-common (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- PAC responder
+ Provides the PAC responder that the AD and IPA backends can use for
+ fetching additional attributes from the kerberos ticket.
+
+Package: sssd-dbus
+Architecture: any
+Depends: sssd-common (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+Description: System Security Services Daemon -- D-Bus responder
+ Provides the D-Bus responder called InfoPipe, that allows the information
+ from the SSSD to be transmitted over the system bus.
+
+Package: sssd-ipa
+Architecture: any
+Depends:
+ libipa-hbac0 (= ${binary:Version}),
+ libsss-idmap0 (= ${binary:Version}),
+ sssd-ad-common (= ${binary:Version}),
+ sssd-common (= ${binary:Version}),
+ sssd-krb5-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- IPA back end
+ Provides the IPA back end that the SSSD can utilize to fetch identity data
+ from and authenticate against an IPA server.
+
+Package: sssd-krb5
+Architecture: any
+Depends:
+ sssd-common (= ${binary:Version}),
+ sssd-krb5-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- Kerberos back end
+ Provides the Kerberos back end that the SSSD can utilize authenticate
+ against a Kerberos server.
+
+Package: sssd-krb5-common
+Architecture: any
+Depends: sssd-common (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+Recommends: libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- Kerberos helpers
+ Provides helper processes that the LDAP and Kerberos back ends can use for
+ Kerberos user or host authentication.
+
+Package: sssd-ldap
+Architecture: any
+Depends:
+ libsss-idmap0 (= ${binary:Version}),
+ sssd-common (= ${binary:Version}),
+ sssd-krb5-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Recommends: ldap-utils
+Suggests: libsasl2-modules-ldap
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- LDAP back end
+ Provides the LDAP back end that the SSSD can utilize to fetch identity data
+ from and authenticate against an LDAP server.
+
+Package: sssd-proxy
+Architecture: any
+Depends: sssd-common (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+Breaks: sssd (<< 1.10.0~beta2-1)
+Replaces: sssd (<< 1.10.0~beta2-1)
+Description: System Security Services Daemon -- proxy back end
+ Provides the proxy back end which can be used to wrap an existing NSS and/or
+ PAM modules to leverage SSSD caching.
+
+Package: sssd-tools
+Architecture: any
+Depends:
+ python,
+ sssd-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Description: System Security Services Daemon -- tools
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provides tools to manage users, groups and nested groups when
+ using the local id provider.
+
+Package: libnss-sss
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Pre-Depends: ${misc:Pre-Depends}
+Recommends: sssd
+Multi-Arch: same
+Description: Nss library for the System Security Services Daemon
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provide the nss library to connect to the sssd daemon.
+
+Package: libpam-sss
+Architecture: any
+Depends:
+ libpam-pwquality (>= 1.2.2-1),
+ libpam-runtime (>= 1.0.1-6),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Recommends: sssd
+Multi-Arch: same
+Description: Pam module for the System Security Services Daemon
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provide the pam module to connect to the sssd daemon.
+
+Package: libipa-hbac0
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: FreeIPA HBAC Evaluator library
+ Utility library to validate FreeIPA HBAC rules for authorization requests.
+
+Package: libipa-hbac-dev
+Section: libdevel
+Architecture: any
+Depends: libipa-hbac0 (= ${binary:Version}), ${misc:Depends}
+Description: FreeIPA HBAC Evaluator library
+ Utility library to validate FreeIPA HBAC rules for authorization requests.
+ .
+ This package contains header files and symlinks to develop programs which will
+ use the libipa-hbac library.
+
+Package: libsss-idmap0
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: ID mapping library for SSSD
+ Utility library to convert SIDs to Unix uids and gids.
+
+Package: libsss-idmap-dev
+Section: libdevel
+Architecture: any
+Depends: libsss-idmap0 (= ${binary:Version}), ${misc:Depends}
+Description: ID mapping library for SSSD -- development files
+ Utility library to convert SIDs to Unix uids and gids.
+ .
+ This package contains header files and symlinks to develop programs which will
+ use the libsss-idmap library.
+
+Package: libsss-nss-idmap0
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: SID based lookups library for SSSD
+ Utility library for SID based lookups.
+
+Package: libsss-nss-idmap-dev
+Section: libdevel
+Architecture: any
+Depends: libsss-nss-idmap0 (= ${binary:Version}), ${misc:Depends}
+Description: SID based lookups library for SSSD -- development files
+ Utility library for SID based lookups.
+ .
+ This package contains header files and symlinks to develop programs which will
+ use the libsss-nss-idmap library.
+
+Package: libsss-sudo
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Replaces: libsss-sudo-dev (<= 1.9.3)
+Description: Communicator library for sudo
+ Utility library to allow communication between sudo and SSSD for caching
+ sudo rules by SSSD.
+
+Package: libsss-simpleifp0
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+ sssd-dbus (= ${binary:Version}),
+Description: SSSD D-Bus responder helper library
+ Provides library that simplifies D-Bus API for the SSSD InfoPipe responder.
+
+Package: libsss-simpleifp-dev
+Section: libdevel
+Architecture: any
+Depends: libsss-simpleifp0 (= ${binary:Version}), ${misc:Depends}
+Description: SSSD D-Bus responder helper library -- development files
+ Provides library that simplifies D-Bus API for the SSSD InfoPipe responder.
+ .
+ This package contains header files and symlinks to develop programs which will
+ use the libsss-simpleifp0 library.
+
+Package: libwbclient-sssd
+Section: libs
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: SSSD libwbclient implementation
+ The SSSD libwbclient implementation.
+
+Package: libwbclient-sssd-dev
+Section: libdevel
+Architecture: any
+Depends: libwbclient-sssd (= ${binary:Version}), ${misc:Depends},
+Description: SSSD libwbclient implementation -- development files
+ The SSSD libwbclient implementation.
+ .
+ This package contains header files and symlinks to develop programs which will
+ use the libwbclient-sssd library.
+
+Package: python-libipa-hbac
+Section: python
+Architecture: any
+Depends:
+ libipa-hbac0 (= ${binary:Version}),
+ ${misc:Depends},
+ ${python:Depends},
+ ${shlibs:Depends}
+Description: Python bindings for the FreeIPA HBAC Evaluator library
+ The libipa_hbac-python contains the bindings so that libipa_hbac can be
+ used by Python applications.
+ .
+ This package installs the library for Python 2.
+
+Package: python-libsss-nss-idmap
+Section: python
+Architecture: any
+Depends:
+ libsss-nss-idmap0 (= ${binary:Version}),
+ ${misc:Depends},
+ ${python:Depends},
+ ${shlibs:Depends}
+Description: Python bindings for the SID lookups library
+ This package contains the bindings for libnss_sss_idmap to be used by
+ Python applications.
+ .
+ This package installs the library for Python 2.
+
+Package: python-sss
+Section: python
+Architecture: any
+Depends: ${misc:Depends}, ${python:Depends}, ${shlibs:Depends}
+Provides: ${python:Provides}
+Recommends: sssd
+Description: Python module for the System Security Services Daemon
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provide a module to access the configuration of the sssd daemon.
+ .
+ This package installs the library for Python 2.
+
+Package: python3-libipa-hbac
+Section: python
+Architecture: any
+Depends:
+ libipa-hbac0 (= ${binary:Version}),
+ ${misc:Depends},
+ ${python3:Depends},
+ ${shlibs:Depends}
+Description: Python3 bindings for the FreeIPA HBAC Evaluator library
+ The libipa_hbac-python contains the bindings so that libipa_hbac can be
+ used by Python applications.
+ .
+ This package installs the library for Python 3.
+
+Package: python3-libsss-nss-idmap
+Section: python
+Architecture: any
+Depends:
+ libsss-nss-idmap0 (= ${binary:Version}),
+ ${misc:Depends},
+ ${python3:Depends},
+ ${shlibs:Depends}
+Description: Python3 bindings for the SID lookups library
+ This package contains the bindings for libnss_sss_idmap to be used by
+ Python applications.
+ .
+ This package installs the library for Python 3.
+
+Package: python3-sss
+Section: python
+Architecture: any
+Depends: ${misc:Depends}, ${python3:Depends}, ${shlibs:Depends}
+Provides: ${python3:Provides}
+Recommends: sssd
+Description: Python3 module for the System Security Services Daemon
+ Provides a set of daemons to manage access to remote directories and
+ authentication mechanisms. It provides an NSS and PAM interface toward
+ the system and a pluggable backend system to connect to multiple different
+ account sources. It is also the basis to provide client auditing and policy
+ services for projects like FreeIPA.
+ .
+ This package provide a module to access the configuration of the sssd daemon.
+ .
+ This package installs the library for Python 3.
--- sssd-1.15.2.orig/debian/copyright
+++ sssd-1.15.2/debian/copyright
@@ -0,0 +1,222 @@
+This package was debianized by Mathias Gug <mathiaz@ubuntu.com> on
+Wed, 05 Aug 2009 08:58:56 +0100.
+
+It was downloaded from https://pagure.io/SSSD/sssd/
+
+Upstream Authors:
+   Dmitri Pal <dpal@redhat.com>
+   Jakub Hrozek <jhrozek@redhat.com>
+   Simo Sorce <ssorce@redhat.com>
+   Stephen Gallagher <sgallagh@redhat.com>
+   Sumit Bose <sbose@redhat.com>
+
+Copyright:
+
+   Copyright (C) Red Hat 2008, 2009
+
+   Copyright (C) Dmitri Pal <dpal@redhat.com> 2009
+   Copyright (C) Jakub Hrozek <jhrozek@redhat.com> 2009
+   Copyright (C) Simo Sorce <ssorce@redhat.com>	2007, 2008, 2009
+   Copyright (C) Stephen Gallagher <sgallagh@redhat.com> 2008,2009
+   Copyright (C) Sumit Bose <sbose@redhat.com>  2009
+
+   Copyright (C) Andrew Bartlett 2002
+   Copyright (C) Andrew Tridgell 1992-2006
+   Copyright (C) James J Myers 			2003 <myersjj@samba.org>
+   Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2002, 2006, 2007
+   Copyright (C) Jeremy Allison 1998-2002, 2007
+   Copyright (C) Martin Pool			2002
+   Copyright (C) Michael Adam 2008
+   Copyright (C) Tim Potter 2000
+   Copyright (c) 1997 Kungliga Tekniska Högskolan
+
+   Copyright (c) 1996-2005, The PostgreSQL Global Development Group
+   Copyright (c) 1994, The Regents of the University of California
+   Copyright (c) 1996-2007, PostgreSQL Global Development Group
+   Copyright (C) 1996-2001  Internet Software Consortium.
+
+
+License:
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+The Debian packaging is Copyright (C) Canonical Ltd 2009 and is licensed under
+the GPL-3 or later, see `/usr/share/common-licenses/GPL-3'.
+
+========================
+replace/repdir_getdents.c
+replace/test/testsuite.c
+replace/test/main.c
+replace/getpass.c
+replace/replace.c
+replace/socketpair.c
+replace/inet_ntoa.c
+replace/strptime.c
+replace/inet_aton.c
+replace/dlfcn.c
+replace/repdir_getdirentries.c
+common/collection/*
+common/ini/*
+========================
+License: LGPL3 or later - see `/usr/share/common-licenses/LGPL-3'.
+
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+
+
+===================
+sss_client/group.c
+sss_client/common.c
+sss_client/passwd.c
+===================
+License: LGPL (v2.1 or later)
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU Lesser General Public License as
+   published by the Free Software Foundation; either version 2.1 of the
+   License, or (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
+   USA.
+
+
+=====================
+replace/getaddrinfo.c
+replace/getaddrinfo.h
+=====================
+
+  Permission to use, copy, modify, and distribute this software and its
+  documentation for any purpose, without fee, and without a written agreement
+  is hereby granted, provided that the above copyright notice and this paragraph
+  and the following two paragraphs appear in all copies.
+
+  IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR
+  DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
+  LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION,
+  EVEN IF THE UNIVERSITY OF CALIFORNIA HAS BEEN ADVISED OF THE POSSIBILITY OF
+  SUCH DAMAGE.
+
+  THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
+  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+  AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS
+  ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS
+  TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+
+===================
+replace/inet_pton.c
+replace/inet_ntop.c
+===================
+License: ISC
+
+   Permission to use, copy, modify, and distribute this software for any
+   purpose with or without fee is hereby granted, provided that the above
+   copyright notice and this permission notice appear in all copies.
+
+   THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+   DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+   INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+   INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+   FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+   NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+   WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+================
+replace/timegm.c
+================
+License: BSD (3 clause)
+
+   Redistribution and use in source and binary forms, with or without
+   modification, are permitted provided that the following conditions
+   are met:
+
+   1. Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+   2. Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+   3. Neither the name of the Institute nor the names of its contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+   THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+   ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+   ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+   OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+   HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+   LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+   OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+   SUCH DAMAGE.
+
+==================
+replace/snprintf.c
+==================
+
+  This code is based on code written by Patrick Powell (papowell@astart.com)
+  It may be used for any purpose as long as this notice remains intact
+  on all source code distributions
+
+===========================
+sss_client/sss_cli.h
+sss_client/protos.h
+sss_client/sss_pam_macros.h
+sss_client/sss_errno.h
+===========================
+
+  You can used this header file in any way you see fit provided copyright
+  notices are preserved.
+
+=============================
+server/resolv/ares/ares_dns.h
+=============================
+
+  * Permission to use, copy, modify, and distribute this
+  * software and its documentation for any purpose and without
+  * fee is hereby granted, provided that the above copyright
+  * notice appear in all copies and that both that copyright
+  * notice and this permission notice appear in supporting
+  * documentation, and that the name of M.I.T. not be used in
+  * advertising or publicity pertaining to distribution of the
+  * software without specific, written prior permission.
+  * M.I.T. makes no representations about the suitability of
+  * this software for any purpose.  It is provided "as is"
+  * without express or implied warranty.
+
+=============================
+server/util/nss_sha512crypt.c
+=============================
+
+ Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>.
--- sssd-1.15.2.orig/debian/generate-config
+++ sssd-1.15.2/debian/generate-config
@@ -0,0 +1,136 @@
+#!/bin/sh
+
+# Generate sssd.conf setup dynamically based on autodetectet LDAP
+# and Kerberos server.
+
+set -e
+
+# See if we can find an LDAP server.  Prefer ldap.domain, but also
+# accept SRV records if no ldap.domain server is found.
+lookup_ldap_uri() {
+    domain="$1"
+    if ping -c2 ldap.$domain > /dev/null 2>&1; then
+	echo ldap://ldap.$domain
+    else
+	host=$(host -N 2 -t SRV _ldap._tcp.$domain | grep -v NXDOMAIN | awk '{print $NF}' | head -1)
+	if [ "$host" ] ; then
+	    echo ldap://$host | sed 's/\.$//'
+	fi
+    fi
+}
+
+lookup_ldap_base() {
+    ldapuri="$1"
+    defaultcontext="$(ldapsearch -LLL -H "$ldapuri" -x -b '' -s base defaultNamingContext  2>/dev/null | awk '/^defaultNamingContext: / { print $2}')"
+    if [ -z "$defaultcontext" ] ; then
+	# If there are several contexts, pick the first one with
+	# posixAccount or posixGroup objects in it.
+	for context in $(ldapsearch -LLL -H "$ldapuri" -x -b '' \
+	    -s base namingContexts 2>/dev/null | \
+	    awk '/^namingContexts: / { print $2}') ; do
+	    if ldapsearch -LLL -H $ldapuri -x -b "$context" -s sub -z 1 \
+		'(|(objectClass=posixAccount)(objectclass=posixGroup))' 2>&1 | \
+		egrep -q '^dn:|^Administrative limit exceeded' ; then
+		echo $context
+		return
+	    fi
+	done
+    fi
+    echo $defaultcontext
+}
+
+lookup_kerberos_server() {
+    domain="$1"
+    if ping -c2 kerberos.$domain > /dev/null 2>&1; then
+	echo kerberos.$domain
+    else
+	host=$(host -t SRV _kerberos._tcp.$domain | grep -v NXDOMAIN | awk '{print $NF}'|head -1)
+	if [ "$host" ] ; then
+	    echo $host | sed 's/\.$//'
+	fi
+    fi
+}
+
+lookup_kerberos_realm() {
+    domain="$1"
+    realm=$(host -t txt _kerberos.$domain | grep -v NXDOMAIN | awk '{print $NF}'|head -1|tr -d '"')
+    if [ -z "$realm" ] ; then
+	realm=$(echo $domain | tr a-z A-Z)
+    fi
+    echo $realm
+}
+
+
+generate_config() {
+    if [ "$1" ] ; then
+	domain=$1
+    else
+	domain="$(hostname -d)"
+    fi
+    kerberosrealm=$(lookup_kerberos_realm $domain)
+    ldapuri=$(lookup_ldap_uri "$domain")
+    if [ -z "$ldapuri" ];  then
+	# autodetection failed
+	return
+    fi
+
+    ldapbase="$(lookup_ldap_base "$ldapuri")"
+    if [ -z "$ldapbase" ];  then
+	# autodetection failed
+	return
+    fi
+    kerberosserver=$(lookup_kerberos_server "$domain")
+
+cat <<EOF
+# SSSD configuration generated using $0
+[sssd]
+config_file_version = 2
+reconnection_retries = 3
+sbus_timeout = 30
+services = nss, pam
+domains = $domain
+
+[nss]
+filter_groups = root
+filter_users = root
+reconnection_retries = 3
+
+[pam]
+reconnection_retries = 3
+EOF
+if [ "$kerberosserver" ] ; then
+    auth="krb5"
+    chpass="krb5"
+else
+    auth="ldap"
+    chpass="ldap";
+fi
+
+cat <<EOF
+
+[domain/$domain]
+; Using enumerate = true leads to high load and slow response
+enumerate = false
+cache_credentials = true
+
+id_provider = ldap
+auth_provider = $auth
+chpass_provider = $chpass
+
+ldap_uri = $ldapuri
+ldap_search_base = $ldapbase
+ldap_tls_reqcert = demand
+ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
+EOF
+
+if [ "$kerberosserver" ] ; then
+    cat <<EOF
+
+krb5_kdcip = $kerberosserver
+krb5_realm = $kerberosrealm
+krb5_changepw_principle = kadmin/changepw
+krb5_auth_timeout = 15
+EOF
+fi
+}
+generate_config "$@"
--- sssd-1.15.2.orig/debian/libipa-hbac-dev.install
+++ sssd-1.15.2/debian/libipa-hbac-dev.install
@@ -0,0 +1,3 @@
+usr/include/ipa_hbac.h
+usr/lib/*/libipa_hbac.so
+usr/lib/*/pkgconfig/ipa_hbac.pc
--- sssd-1.15.2.orig/debian/libipa-hbac0.install
+++ sssd-1.15.2/debian/libipa-hbac0.install
@@ -0,0 +1 @@
+usr/lib/*/libipa_hbac.so.*
--- sssd-1.15.2.orig/debian/libnss-sss.install
+++ sssd-1.15.2/debian/libnss-sss.install
@@ -0,0 +1 @@
+lib/*/libnss_sss.so.2
--- sssd-1.15.2.orig/debian/libnss-sss.lintian-overrides
+++ sssd-1.15.2/debian/libnss-sss.lintian-overrides
@@ -0,0 +1 @@
+package-name-doesnt-match-sonames libnss-sss2
--- sssd-1.15.2.orig/debian/libnss-sss.postinst
+++ sssd-1.15.2/debian/libnss-sss.postinst
@@ -0,0 +1,45 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
+log() {
+    echo "$*"
+}
+
+# try to insert sss entries to the passwd, group, shadow and netgroup
+# lines in /etc/nsswitch.conf to automatically enable libnss-sss
+# support; do not change the configuration if the lines already
+# references some sss lookups
+insert_nss_entry() {
+    log "Checking NSS setup..."
+    # abort if /etc/nsswitch.conf does not exist
+    if ! [ -e /etc/nsswitch.conf ]; then
+        log "Could not find /etc/nsswitch.conf."
+        return
+    fi
+    # append 'sss' to the end of the line if it's not found already
+    sed -i --regexp-extended '
+      /^(passwd|group|shadow|netgroup|services):/ {
+        /\bsss\b/! s/$/ sss/
+      }
+    ' /etc/nsswitch.conf
+}
+
+action="$1"
+
+if [ configure = "$action" ]; then
+    if [ -z "$2" ]; then
+        log "First installation detected..."
+        # first install: setup the recommended configuration (unless
+        # nsswitch.conf already contains sss entries)
+        insert_nss_entry
+    else
+        # upgrade
+        version="$2"
+
+        # Nothing to do here yet
+    fi
+fi
--- sssd-1.15.2.orig/debian/libnss-sss.postrm
+++ sssd-1.15.2/debian/libnss-sss.postrm
@@ -0,0 +1,40 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
+log() {
+    echo "$*"
+}
+
+remove_nss_entry() {
+    log "Checking NSS setup..."
+    # abort if /etc/nsswitch.conf does not exist
+    if ! [ -e /etc/nsswitch.conf ]; then
+        log "Could not find /etc/nsswitch.conf."
+        return
+    fi
+    sed -i --regexp-extended '
+      /^(passwd|group|shadow|netgroup|services):/ {
+        s/\bsss\b//g
+        s/[[:space:]]+$//
+      }
+    ' /etc/nsswitch.conf
+}
+
+case "$1" in
+    remove|purge)
+        if [ "${DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT:-1}" = 1 ]; then
+            remove_nss_entry
+        fi
+    ;;
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
--- sssd-1.15.2.orig/debian/libpam-sss.install
+++ sssd-1.15.2/debian/libpam-sss.install
@@ -0,0 +1,2 @@
+lib/*/security/pam_sss.so
+usr/share/man/man8/pam_sss.8*
--- sssd-1.15.2.orig/debian/libpam-sss.pam-auth-update
+++ sssd-1.15.2/debian/libpam-sss.pam-auth-update
@@ -0,0 +1,22 @@
+Name: SSS authentication
+Default: yes
+Priority: 128
+
+Auth-Type: Primary
+Auth:
+	[success=end default=ignore]	pam_sss.so use_first_pass
+Auth-Initial:
+	[success=end default=ignore]	pam_sss.so forward_pass
+Account-Type: Additional
+Account:
+	sufficient			pam_localuser.so
+	[default=bad success=ok user_unknown=ignore]	pam_sss.so
+Session-Type: Additional
+Session-Interactive-Only: yes
+Session:
+	optional			pam_sss.so
+Password-Type: Primary
+Password:
+	sufficient			pam_sss.so use_authtok
+Password-Initial:
+	sufficient			pam_sss.so
--- sssd-1.15.2.orig/debian/libpam-sss.postinst
+++ sssd-1.15.2/debian/libpam-sss.postinst
@@ -0,0 +1,40 @@
+#!/bin/sh
+# postinst script for sssd
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    configure)
+        pam-auth-update --package
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- sssd-1.15.2.orig/debian/libpam-sss.prerm
+++ sssd-1.15.2/debian/libpam-sss.prerm
@@ -0,0 +1,8 @@
+#! /bin/sh -e
+
+
+if [ "$1" = remove ] && [ "${DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT:-1}" = 1 ]; then
+    pam-auth-update --package --remove sss
+fi
+
+#DEBHELPER#
--- sssd-1.15.2.orig/debian/libsss-idmap-dev.install
+++ sssd-1.15.2/debian/libsss-idmap-dev.install
@@ -0,0 +1,3 @@
+usr/include/sss_idmap.h
+usr/lib/*/libsss_idmap.so
+usr/lib/*/pkgconfig/sss_idmap.pc
--- sssd-1.15.2.orig/debian/libsss-idmap0.install
+++ sssd-1.15.2/debian/libsss-idmap0.install
@@ -0,0 +1 @@
+usr/lib/*/libsss_idmap.so.*
--- sssd-1.15.2.orig/debian/libsss-nss-idmap-dev.install
+++ sssd-1.15.2/debian/libsss-nss-idmap-dev.install
@@ -0,0 +1,3 @@
+usr/include/sss_nss_idmap.h
+usr/lib/*/libsss_nss_idmap.so
+usr/lib/*/pkgconfig/sss_nss_idmap.pc
--- sssd-1.15.2.orig/debian/libsss-nss-idmap0.install
+++ sssd-1.15.2/debian/libsss-nss-idmap0.install
@@ -0,0 +1 @@
+usr/lib/*/libsss_nss_idmap.so.*
--- sssd-1.15.2.orig/debian/libsss-simpleifp-dev.install
+++ sssd-1.15.2/debian/libsss-simpleifp-dev.install
@@ -0,0 +1,4 @@
+usr/include/sss_sifp*
+usr/lib/*/libsss_simpleifp.so
+usr/lib/*/pkgconfig/sss_simpleifp.pc
+
--- sssd-1.15.2.orig/debian/libsss-simpleifp0.install
+++ sssd-1.15.2/debian/libsss-simpleifp0.install
@@ -0,0 +1,2 @@
+usr/lib/*/libsss_simpleifp.so.*
+
--- sssd-1.15.2.orig/debian/libsss-sudo.install
+++ sssd-1.15.2/debian/libsss-sudo.install
@@ -0,0 +1 @@
+usr/lib/*/libsss_sudo.so
--- sssd-1.15.2.orig/debian/libsss-sudo.lintian-overrides
+++ sssd-1.15.2/debian/libsss-sudo.lintian-overrides
@@ -0,0 +1 @@
+shlib-without-versioned-soname usr/lib/*/libsss_sudo.so libsss_sudo.so
--- sssd-1.15.2.orig/debian/libsss-sudo.postinst
+++ sssd-1.15.2/debian/libsss-sudo.postinst
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+    configure)
+        ldconfig
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
+log() {
+    echo "$*"
+}
+
+# try to insert sss entries to the sudoers line in /etc/nsswitch.conf to
+# automatically enable libsss-sudo support; do not change the configuration
+# if the lines already references some sss lookups
+insert_nss_entry() {
+    log "Checking NSS setup..."
+    # abort if /etc/nsswitch.conf does not exist
+    if ! [ -e /etc/nsswitch.conf ]; then
+        log "Could not find /etc/nsswitch.conf."
+        return
+    fi
+
+    if grep -q ^sudoers /etc/nsswitch.conf; then
+        # append 'sss' to the end of the line if it's not found already
+        sed -i --regexp-extended '
+          /^(sudoers):/ {
+            /\bsss\b/! s/$/ sss/
+          }
+        ' /etc/nsswitch.conf
+    else
+        echo "sudoers:        files sss" >> /etc/nsswitch.conf
+    fi
+}
+
+insert_nss_entry
+
+
+exit 0
--- sssd-1.15.2.orig/debian/libsss-sudo.postrm
+++ sssd-1.15.2/debian/libsss-sudo.postrm
@@ -0,0 +1,44 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
+log() {
+    echo "$*"
+}
+
+remove_nss_entry() {
+    log "Checking NSS setup..."
+    # abort if /etc/nsswitch.conf does not exist
+    if ! [ -e /etc/nsswitch.conf ]; then
+        log "Could not find /etc/nsswitch.conf."
+        return
+    fi
+    sed -i --regexp-extended '
+      /^(sudoers):/ {
+        s/\bsss\b//g
+        s/[[:space:]]+$//
+      }
+    ' /etc/nsswitch.conf
+
+    # delete sudoers line if only default entry left"
+    if ! [ -z "grep \"^sudoers:        files$\" /etc/nsswitch.conf" ]; then
+        sed -i /^sudoers:/d /etc/nsswitch.conf
+    fi
+}
+
+case "$1" in
+    remove|purge)
+        remove_nss_entry
+        ldconfig
+    ;;
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
--- sssd-1.15.2.orig/debian/libwbclient-sssd-dev.install
+++ sssd-1.15.2/debian/libwbclient-sssd-dev.install
@@ -0,0 +1,3 @@
+usr/include/wbclient_sssd.h
+usr/lib/*/pkgconfig/wbclient_sssd.pc
+usr/lib/*/sssd/modules/libwbclient.so
--- sssd-1.15.2.orig/debian/libwbclient-sssd.install
+++ sssd-1.15.2/debian/libwbclient-sssd.install
@@ -0,0 +1,2 @@
+usr/lib/*/sssd/modules/libwbclient.so.*
+
--- sssd-1.15.2.orig/debian/patches/restart_providers_on_timeshift.patch
+++ sssd-1.15.2/debian/patches/restart_providers_on_timeshift.patch
@@ -0,0 +1,24 @@
+Description: Restart the providers after a time shift has been detected
+ This patch restarts the providers using the already implemented SIGUSR2
+ for method .resetOffline (used after netlink detects an interface change).
+ By doing this, events like LDAP connection retries will be executed
+ immediately instead of having to wait the time shifted (potentially hours)
+ to get to its normal schedule.
+
+Author: Victor Tapia <victor.tapia@canonical.com>
+Bug: https://fedorahosted.org/sssd/ticket/3285
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1641875
+Last-Update: 2017-02-15
+
+--- a/src/util/util_watchdog.c
++++ b/src/util/util_watchdog.c
+@@ -158,6 +158,9 @@
+               "[%d]: %s\n", ret, sss_strerror(ret));
+         orderly_shutdown(1);
+     }
++    if (getpid() == getpgrp()) {
++        kill(-getpgrp(), SIGUSR2);
++    }
+ }
+ 
+ int setup_watchdog(struct tevent_context *ev, int interval)
--- sssd-1.15.2.orig/debian/patches/series
+++ sssd-1.15.2/debian/patches/series
@@ -0,0 +1 @@
+#placeholder
--- sssd-1.15.2.orig/debian/python-libipa-hbac.install
+++ sssd-1.15.2/debian/python-libipa-hbac.install
@@ -0,0 +1 @@
+usr/lib/python2*/dist-packages/pyhbac.so
--- sssd-1.15.2.orig/debian/python-libsss-nss-idmap.install
+++ sssd-1.15.2/debian/python-libsss-nss-idmap.install
@@ -0,0 +1 @@
+usr/lib/python2*/dist-packages/pysss_nss_idmap.so
--- sssd-1.15.2.orig/debian/python-sss.install
+++ sssd-1.15.2/debian/python-sss.install
@@ -0,0 +1,3 @@
+usr/lib/python2*/dist-packages/SSSDConfig/*.py
+usr/lib/python2*/dist-packages/pysss.so
+usr/lib/python2*/dist-packages/pysss_murmur.so
--- sssd-1.15.2.orig/debian/python3-libipa-hbac.install
+++ sssd-1.15.2/debian/python3-libipa-hbac.install
@@ -0,0 +1 @@
+usr/lib/python3*/site-packages/pyhbac.so
--- sssd-1.15.2.orig/debian/python3-libsss-nss-idmap.install
+++ sssd-1.15.2/debian/python3-libsss-nss-idmap.install
@@ -0,0 +1 @@
+usr/lib/python3*/site-packages/pysss_nss_idmap.so
--- sssd-1.15.2.orig/debian/python3-sss.install
+++ sssd-1.15.2/debian/python3-sss.install
@@ -0,0 +1,3 @@
+usr/lib/python3*/dist-packages/SSSDConfig/*.py
+usr/lib/python3*/site-packages/pysss.so
+usr/lib/python3*/site-packages/pysss_murmur.so
--- sssd-1.15.2.orig/debian/rules
+++ sssd-1.15.2/debian/rules
@@ -0,0 +1,103 @@
+#!/usr/bin/make -f
+%:
+	dh $@ --with quilt,autoreconf,python2,python3,systemd \
+		--parallel \
+		--builddirectory=build
+
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
+
+CFLAGS = $(shell dpkg-buildflags --get CFLAGS)
+CFLAGS += -I/usr/include/samba-4.0
+
+export CK_DEFAULT_TIMEOUT=30
+
+DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+
+APIDOCDIR = /usr/share/sssd
+DISTRIBUTION = $(shell lsb_release -i | sed 's/.*:\t//')
+INIT = init
+PKGDATE = $(shell dpkg-parsechangelog | \
+	awk -F" " '/^Date/ { print $$4 "/" $$3 "/" $$5 }' | \
+	sed 's/Jan/01/;s/Feb/02/;s/Mar/03/;s/Apr/04/;s/May/05/;s/Jun/06/;s/Jul/07/;s/Aug/08/;s/Sep/09/;s/Oct/10/;s/Nov/11/;s/Dec/12/;s/\//\\\//g')
+CURDATE = $(shell date +%m/%d/%Y | sed 's/\//\\\//g')
+export CK_VERBOSITY=verbose
+
+override_dh_auto_configure:
+	dh_auto_configure -- --enable-krb5-locator-plugin \
+	--datadir=/usr/share/ \
+	--with-environment-file=/etc/default/sssd \
+	--with-ldb-lib-dir=/usr/lib/$(DEB_HOST_MULTIARCH)/ldb/modules/ldb \
+	--with-krb5-plugin-path=/usr/lib/$(DEB_HOST_MULTIARCH)/krb5/plugins/libkrb5 \
+	--enable-nsslibdir=/lib/$(DEB_HOST_MULTIARCH) \
+	--enable-pammoddir=/lib/$(DEB_HOST_MULTIARCH)/security \
+	--disable-static \
+	--disable-rpath \
+	--with-autofs \
+	--with-ssh \
+	--with-initscript=systemd --with-systemdunitdir=/lib/systemd/system \
+	--with-sudo
+
+override_dh_auto_test:
+	export CK_TIMEOUT_MULTIPLIER=10
+	dh_auto_test -- VERBOSE=yes
+	unset CK_TIMEOUT_MULTIPLIER
+
+override_dh_auto_install:
+	dh_auto_install --max-parallel=1
+
+override_dh_fixperms:
+	dh_fixperms -Xkrb5_child -Xldap_child -Xselinux_child
+
+override_dh_install:
+	install -D -m755 $(CURDIR)/debian/generate-config \
+		$(CURDIR)/debian/tmp/usr/share/sssd/generate-config
+
+	mkdir -p $(CURDIR)/debian/libpam-sss/usr/share/pam-configs
+	install -m644 debian/libpam-sss.pam-auth-update \
+		$(CURDIR)/debian/libpam-sss/usr/share/pam-configs/sss
+	install -m644 -D $(CURDIR)/debian/apparmor-profile \
+		$(CURDIR)/debian/sssd-common/etc/apparmor.d/usr.sbin.sssd
+
+	cat $(CURDIR)/debian/sssd-common.sssd.$(INIT).in > $(CURDIR)/debian/sssd-common.sssd.$(INIT)
+
+	# remove files we don't want to install
+	find $(CURDIR)/debian/tmp/ -name '*.la' -exec rm '{}' ';'
+	find $(CURDIR)/debian/tmp/ -name '*.pyc' -exec rm '{}' ';'
+	find $(CURDIR)/debian/tmp/ -name '*.egg-info' -exec rm '{}' ';'
+	rm -f $(CURDIR)/debian/tmp/etc/rc.d/init.d/sssd
+
+	# we don't need a default config, yet anyway
+	rm -f $(CURDIR)/debian/tmp/usr/lib/*/sssd/conf/sssd.conf
+	rm -f $(CURDIR)/debian/tmp/etc/pam.d/sssd-shadowutils
+
+	# match nn/nn/nnnn, replace with the date from changelog
+	sed -i 's/[0-1][0-9]\/[0-3][0-9]\/[0-9][0-9][0-9][0-9]/${PKGDATE}/g' $(CURDIR)/debian/tmp/usr/share/man/man*/*
+
+	for responder in autofs ifp nss pac pam-priv pam ssh sudo; do \
+		rm -f $(CURDIR)/debian/tmp/lib/systemd/system/sssd-$$responder.service \
+		      $(CURDIR)/debian/tmp/lib/systemd/system/sssd-$$responder.socket; \
+	done
+
+	dh_install --fail-missing
+
+override_dh_python2:
+	dh_python2 --no-guessing-versions
+
+override_dh_installinit:
+	dh_apparmor -psssd-common --profile-name=usr.sbin.sssd
+	dh_installinit --name sssd --error-handler=invoke_failure
+
+override_dh_installdeb:
+	dh_installdeb
+	for pkg in sssd-common sssd-ipa sssd-krb5-common sssd-proxy; do \
+		sed -i 's/@TRIPLET@/${DEB_HOST_MULTIARCH}/' \
+		$(CURDIR)/debian/$$pkg/DEBIAN/postinst; \
+	done
+
+override_dh_auto_clean:
+	dh_auto_clean
+	rm -f $(CURDIR)/debian/sssd-common.$(INIT)
+	rm -f $(CURDIR)/po/*.gmo
+	rm -f $(CURDIR)/src/config/*.pyc
+	rm -f $(CURDIR)/po/stamp-po
--- sssd-1.15.2.orig/debian/source/format
+++ sssd-1.15.2/debian/source/format
@@ -0,0 +1 @@
+1.0
--- sssd-1.15.2.orig/debian/sssd-ad-common.install
+++ sssd-1.15.2/debian/sssd-ad-common.install
@@ -0,0 +1,3 @@
+#lib/systemd/system/sssd-pac.service
+#lib/systemd/system/sssd-pac.socket
+usr/lib/*/sssd/sssd_pac
--- sssd-1.15.2.orig/debian/sssd-ad-common.postinst
+++ sssd-1.15.2/debian/sssd-ad-common.postinst
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+    configure)
+        if dpkg --compare-versions "$2" lt-nl "1.15.0-3"; then
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge sssd-pac.service >/dev/null
+                deb-systemd-helper unmask sssd-pac.service >/dev/null
+                deb-systemd-helper purge sssd-pac.socket >/dev/null
+                deb-systemd-helper unmask sssd-pac.socket >/dev/null
+            fi
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- sssd-1.15.2.orig/debian/sssd-ad.install
+++ sssd-1.15.2/debian/sssd-ad.install
@@ -0,0 +1,3 @@
+usr/lib/*/sssd/gpo_child
+usr/lib/*/sssd/libsss_ad.so
+usr/share/man/man5/sssd-ad.5*
--- sssd-1.15.2.orig/debian/sssd-common.dirs
+++ sssd-1.15.2/debian/sssd-common.dirs
@@ -0,0 +1,10 @@
+etc/sssd
+etc/sssd/conf.d
+var/lib/sss
+var/lib/sss/db
+var/lib/sss/gpo_cache
+var/lib/sss/mc
+var/lib/sss/pipes
+var/lib/sss/pipes/private
+var/lib/sss/pubconf
+var/log/sssd
--- sssd-1.15.2.orig/debian/sssd-common.docs
+++ sssd-1.15.2/debian/sssd-common.docs
@@ -0,0 +1 @@
+BUILD.txt
--- sssd-1.15.2.orig/debian/sssd-common.examples
+++ sssd-1.15.2/debian/sssd-common.examples
@@ -0,0 +1 @@
+src/examples/sssd-example.conf
--- sssd-1.15.2.orig/debian/sssd-common.install
+++ sssd-1.15.2/debian/sssd-common.install
@@ -0,0 +1,58 @@
+lib/systemd/system/sssd.service
+lib/systemd/system/sssd-secrets.service
+lib/systemd/system/sssd-secrets.socket
+#lib/systemd/system/sssd-sudo.service
+#lib/systemd/system/sssd-sudo.socket
+#lib/systemd/system/sssd-ssh.service
+#lib/systemd/system/sssd-ssh.socket
+#lib/systemd/system/sssd-autofs.service
+#lib/systemd/system/sssd-autofs.socket
+#lib/systemd/system/sssd-pam.service
+#lib/systemd/system/sssd-pam.socket
+#lib/systemd/system/sssd-pam-priv.socket
+#lib/systemd/system/sssd-nss.service
+#lib/systemd/system/sssd-nss.socket
+usr/bin/sss_ssh_authorizedkeys
+usr/bin/sss_ssh_knownhostsproxy
+usr/lib/*/cifs-utils/cifs_idmap_sss.so
+usr/lib/*/krb5/plugins/authdata/sssd_pac_plugin.so
+usr/lib/*/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
+usr/lib/*/ldb/modules/ldb/memberof.so
+usr/lib/*/libnfsidmap/sss.so
+usr/lib/*/samba/idmap/sss.so
+usr/lib/*/sssd/libsss_cert.so
+usr/lib/*/sssd/libsss_child.so
+usr/lib/*/sssd/libsss_crypt.so
+usr/lib/*/sssd/libsss_debug.so
+usr/lib/*/sssd/libsss_files.so
+usr/lib/*/sssd/libsss_krb5_common.so
+usr/lib/*/sssd/libsss_ldap_common.so
+usr/lib/*/sssd/libsss_semanage.so
+usr/lib/*/sssd/libsss_simple.so
+usr/lib/*/sssd/libsss_util.so
+usr/lib/*/sssd/modules/libsss_autofs.so
+usr/lib/*/sssd/modules/sssd_krb5_localauth_plugin.so
+usr/lib/*/sssd/p11_child
+usr/lib/*/sssd/sss_signal
+usr/lib/*/sssd/sssd_autofs
+usr/lib/*/sssd/sssd_be
+usr/lib/*/sssd/sssd_check_socket_activated_responders
+usr/lib/*/sssd/sssd_nss
+usr/lib/*/sssd/sssd_pam
+usr/lib/*/sssd/sssd_secrets
+usr/lib/*/sssd/sssd_ssh
+usr/lib/*/sssd/sssd_sudo
+usr/sbin/sssd
+usr/share/locale/*/LC_MESSAGES/*
+usr/share/man/man1/sss_ssh_authorizedkeys.1*
+usr/share/man/man1/sss_ssh_knownhostsproxy.1*
+usr/share/man/man5/sss_rpcidmapd.5*
+usr/share/man/man5/sssd-files.5*
+usr/share/man/man5/sssd-secrets.5*
+usr/share/man/man5/sssd-simple.5*
+usr/share/man/man5/sssd-sudo.5*
+usr/share/man/man5/sssd.conf.5*
+usr/share/man/man8/idmap_sss.8*
+usr/share/man/man8/sssd.8*
+usr/share/man/man8/sssd_krb5_locator_plugin.8*
+usr/share/sssd/*
--- sssd-1.15.2.orig/debian/sssd-common.lintian-overrides
+++ sssd-1.15.2/debian/sssd-common.lintian-overrides
@@ -0,0 +1 @@
+manpage-has-errors-from-man usr/share/man/man5/sssd-ldap.5.*
--- sssd-1.15.2.orig/debian/sssd-common.logrotate
+++ sssd-1.15.2/debian/sssd-common.logrotate
@@ -0,0 +1,11 @@
+/var/log/sssd/*.log {
+	rotate 4
+	weekly
+	missingok
+	notifempty
+	compress
+	delaycompress
+	postrotate
+		kill -HUP `cat /var/run/sssd.pid` > /dev/null 2>&1 || true
+	endscript
+}
--- sssd-1.15.2.orig/debian/sssd-common.manpages
+++ sssd-1.15.2/debian/sssd-common.manpages
@@ -0,0 +1 @@
+usr/share/man/man*/*
--- sssd-1.15.2.orig/debian/sssd-common.postinst
+++ sssd-1.15.2/debian/sssd-common.postinst
@@ -0,0 +1,103 @@
+#!/bin/sh
+# postinst script for sssd
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+OUT=/dev/null
+HOME=/var/lib/sss
+LIBDIR=/usr/lib/@TRIPLET@/sssd
+
+case "$1" in
+    configure)
+        if ! getent passwd sssd > $OUT; then
+            echo "Creating SSSD system user & group..."
+            adduser --quiet --system --home $HOME \
+                --disabled-password --group \
+                --gecos "SSSD system user" \
+                sssd > $OUT
+        fi
+        chown sssd:sssd \
+            $HOME/db \
+            $HOME/gpo_cache \
+            $HOME/mc \
+            $HOME/pipes \
+            $HOME/pipes/private \
+            $HOME/pubconf \
+            /etc/sssd \
+            /var/log/sssd
+        chown root:sssd $LIBDIR/p11_child
+
+        chmod 4754 $LIBDIR/p11_child
+        chmod 755 $HOME/gpo_cache $HOME/mc $HOME/pipes $HOME/pubconf
+        chmod 750 /var/log/sssd
+        chmod 711 /etc/sssd
+        chmod 700 $HOME/db $HOME/pipes/private
+        if [ -f /etc/sssd/sssd.conf ]; then
+            chown root:root /etc/sssd/sssd.conf
+            chmod 0600 /etc/sssd/sssd.conf
+        fi
+
+        if dpkg --compare-versions "$2" lt-nl "1.15.0-3"; then
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge sssd-autofs.service >/dev/null
+                deb-systemd-helper unmask sssd-autofs.service >/dev/null
+                deb-systemd-helper purge sssd-autofs.socket >/dev/null
+                deb-systemd-helper unmask sssd-autofs.socket >/dev/null
+                deb-systemd-helper purge sssd-nss.service >/dev/null
+                deb-systemd-helper unmask sssd-nss.service >/dev/null
+                deb-systemd-helper purge sssd-nss.socket >/dev/null
+                deb-systemd-helper unmask sssd-nss.socket >/dev/null
+                deb-systemd-helper purge sssd-pam.service >/dev/null
+                deb-systemd-helper unmask sssd-pam.service >/dev/null
+                deb-systemd-helper purge sssd-pam.socket >/dev/null
+                deb-systemd-helper unmask sssd-pam.socket >/dev/null
+                deb-systemd-helper purge sssd-pam-priv.socket >/dev/null
+                deb-systemd-helper unmask sssd-pam-priv.socket >/dev/null
+                deb-systemd-helper purge sssd-sudo.service >/dev/null
+                deb-systemd-helper unmask sssd-sudo.service >/dev/null
+                deb-systemd-helper purge sssd-sudo.socket >/dev/null
+                deb-systemd-helper unmask sssd-sudo.socket >/dev/null
+                deb-systemd-helper purge sssd-ssh.service >/dev/null
+                deb-systemd-helper unmask sssd-ssh.service >/dev/null
+                deb-systemd-helper purge sssd-ssh.socket >/dev/null
+                deb-systemd-helper unmask sssd-ssh.socket >/dev/null
+            fi
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+invoke_failure() {
+    # invoke-rc.d failed, likely because of a missing sssd.conf
+    if [ ! -s /etc/sssd/sssd.conf ]; then
+        echo "... because /etc/sssd/sssd.conf is not available yet"
+    fi
+}
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- sssd-1.15.2.orig/debian/sssd-common.postrm
+++ sssd-1.15.2/debian/sssd-common.postrm
@@ -0,0 +1,53 @@
+#!/bin/sh
+# postrm script for sssd
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge)
+        rm -f /etc/sssd/sssd.conf
+	if [ -d /etc/sssd ]; then
+		rmdir --ignore-fail-on-non-empty /etc/sssd/
+	fi
+	rm -rf /var/log/sssd/
+	if getent group dirsrv > /dev/null; then
+	    deluser --system sssd
+	fi
+    ;;
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+# work around buggy dh_apparmor which doesn't do this for us
+if [ "$1" = "purge" ]; then
+    rmdir /etc/apparmor.d/force-complain 2>/dev/null || true
+    rmdir /etc/apparmor.d 2>/dev/null || true
+fi
+
+exit 0
--- sssd-1.15.2.orig/debian/sssd-common.preinst
+++ sssd-1.15.2/debian/sssd-common.preinst
@@ -0,0 +1,61 @@
+#!/bin/sh
+
+set -e
+
+# Remove a no-longer used conffile
+# Copied from http://wiki.debian.org/DpkgConffileHandling
+rm_conffile() {
+    local PKGNAME="$1"
+    local CONFFILE="$2"
+
+    [ -e "$CONFFILE" ] || return 0
+
+    local md5sum="$(md5sum $CONFFILE | sed -e 's/ .*//')"
+    local old_md5sum="$(dpkg-query -W -f='${Conffiles}' $PKGNAME | \
+            sed -n -e "\' $CONFFILE ' { s/ obsolete$//; s/.* //; p }")"
+    if [ "$md5sum" != "$old_md5sum" ]; then
+        echo "Obsolete conffile $CONFFILE has been modified by you."
+        echo "Saving as $CONFFILE.dpkg-bak ..."
+        mv -f "$CONFFILE" "$CONFFILE".dpkg-bak
+    else
+        echo "Removing obsolete conffile $CONFFILE ..."
+        mv -f "$CONFFILE" "$CONFFILE".dpkg-del
+    fi
+}
+
+APP_PROFILE="usr.sbin.sssd"
+APP_CONFFILE="/etc/apparmor.d/$APP_PROFILE"
+APP_COMPLAIN="/etc/apparmor.d/force-complain/$APP_PROFILE"
+APP_DISABLE="/etc/apparmor.d/disable/$APP_PROFILE"
+
+inst_complain_profile() {
+    # Create a symlink to the yet-to-be-unpacked profile
+    mkdir -p `dirname $APP_COMPLAIN` 2>/dev/null || true
+    ln -sf $APP_CONFFILE $APP_COMPLAIN
+}
+
+case "$1" in
+install)
+    # Force the AppArmor profile to complain mode on install
+    inst_complain_profile
+    ;;
+upgrade)
+    if dpkg --compare-versions "$2" le "1.0.5-1"; then
+        rm_conffile sssd "/etc/sssd/sssd.api.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-proxy.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-simple.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-ipa.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-local.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-krb5.conf"
+        rm_conffile sssd "/etc/sssd/sssd.api.d/sssd-ldap.conf"
+    fi
+    if dpkg --compare-versions "$2" lt "1.10.0~beta2-1"; then
+	    inst_complain_profile
+        if [ -e "$APP_DISABLE" ]; then
+            rm -f "$APP_DISABLE"
+        fi
+    fi
+    ;;
+esac
+
+#DEBHELPER#
--- sssd-1.15.2.orig/debian/sssd-common.prerm
+++ sssd-1.15.2/debian/sssd-common.prerm
@@ -0,0 +1,9 @@
+#! /bin/sh -e
+
+invoke_failure() {
+    # invoke-rc.d failed
+    return
+}
+
+#DEBHELPER#
+
--- sssd-1.15.2.orig/debian/sssd-common.sssd.default
+++ sssd-1.15.2/debian/sssd-common.sssd.default
@@ -0,0 +1,5 @@
+# Defaults for sssd, installed at /etc/default/sssd by the maintainer scripts
+# This is only used for /etc/init.d/sssd
+
+# Additional options that are passed to the Daemon.
+DAEMON_OPTS="-D -f"
--- sssd-1.15.2.orig/debian/sssd-common.sssd.init.in
+++ sssd-1.15.2/debian/sssd-common.sssd.init.in
@@ -0,0 +1,86 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          sssd
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Should-Start:      $named
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: System Security Services Daemon
+# Description:       Provides a set of daemons to manage access to
+#                    remote directories and authentication
+#                    mechanisms. It provides an NSS and PAM interface
+#                    toward the system and a pluggable backend system
+#                    to connect to multiple different account sources.
+### END INIT INFO
+# start on filesystem
+# stop on runlevel [06]
+
+DESCRIPTION="System Security Services Daemon"
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+NAME=sssd
+DAEMON_OPTS=""
+DAEMON=/usr/sbin/$NAME
+PIDFILE=/var/run/$NAME.pid
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+if [ -f /etc/default/sssd ] ; then
+    . /etc/default/sssd
+fi
+
+initdmain() {
+    case "$1" in
+        start)
+            [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESCRIPTION" "$NAME"
+            start_daemon -p $PIDFILE $DAEMON $DAEMON_OPTS
+            RC=$?
+            case "$RC" in
+                0)
+                    [ "$VERBOSE" != no ] && log_end_msg $RC
+                    ;;
+                *)
+                # Report error also when VERBOSE=no
+                    log_daemon_msg "Starting $DESCRIPTION" "$NAME"
+                    log_end_msg $RC
+                    ;;
+            esac
+            ;;
+        stop)
+            [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESCRIPTION" "$NAME"
+            killproc -p $PIDFILE $DAEMON
+            RC=$?
+            case "$RC" in
+                0)
+                    [ "$VERBOSE" != no ] && log_end_msg $RC
+                    ;;
+                *)
+                # Report error also when VERBOSE=no
+                    log_daemon_msg "Stopping $DESCRIPTION" "$NAME"
+                    log_end_msg $RC
+                    ;;
+            esac
+            ;;
+        force-reload|restart)
+            $0 stop
+            $0 start
+            ;;
+        status)
+            status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
+            ;;
+        *)
+            echo "Usage: /etc/init.d/$NAME {start|stop|restart|force-reload|status}"
+            exit 1
+            ;;
+    esac
+}
+
+initdmain $@
+
+exit 0
--- sssd-1.15.2.orig/debian/sssd-dbus.install
+++ sssd-1.15.2/debian/sssd-dbus.install
@@ -0,0 +1,5 @@
+etc/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
+#lib/systemd/system/sssd-ifp.service
+usr/lib/*/sssd/sssd_ifp
+usr/share/dbus-1/system-services/org.freedesktop.sssd.infopipe.service
+usr/share/man/man5/sssd-ifp.5
--- sssd-1.15.2.orig/debian/sssd-dbus.postinst
+++ sssd-1.15.2/debian/sssd-dbus.postinst
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+    configure)
+        if dpkg --compare-versions "$2" lt-nl "1.15.0-3"; then
+            if [ -x "/usr/bin/deb-systemd-helper" ]; then
+                deb-systemd-helper purge sssd-ifp.service >/dev/null
+                deb-systemd-helper unmask sssd-ifp.service >/dev/null
+            fi
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- sssd-1.15.2.orig/debian/sssd-ipa.dirs
+++ sssd-1.15.2/debian/sssd-ipa.dirs
@@ -0,0 +1 @@
+var/lib/sss/keytabs
--- sssd-1.15.2.orig/debian/sssd-ipa.install
+++ sssd-1.15.2/debian/sssd-ipa.install
@@ -0,0 +1,3 @@
+usr/lib/*/sssd/libsss_ipa.so
+usr/lib/*/sssd/selinux_child
+usr/share/man/man5/sssd-ipa.5*
--- sssd-1.15.2.orig/debian/sssd-ipa.postinst
+++ sssd-1.15.2/debian/sssd-ipa.postinst
@@ -0,0 +1,16 @@
+#!/bin/sh
+set -e
+
+LIBDIR=/usr/lib/@TRIPLET@/sssd
+
+case "$1" in
+    configure)
+        chown root:sssd $LIBDIR/selinux_child
+        chmod 4754 $LIBDIR/selinux_child
+        chown sssd:sssd /var/lib/sss/keytabs
+        chmod 700 /var/lib/sss/keytabs
+    ;;
+esac
+
+#DEBHELPER#
+
--- sssd-1.15.2.orig/debian/sssd-krb5-common.dirs
+++ sssd-1.15.2/debian/sssd-krb5-common.dirs
@@ -0,0 +1,2 @@
+var/lib/sss/pubconf/krb5.include.d
+
--- sssd-1.15.2.orig/debian/sssd-krb5-common.install
+++ sssd-1.15.2/debian/sssd-krb5-common.install
@@ -0,0 +1,2 @@
+usr/lib/*/sssd/krb5_child
+usr/lib/*/sssd/ldap_child
--- sssd-1.15.2.orig/debian/sssd-krb5-common.postinst
+++ sssd-1.15.2/debian/sssd-krb5-common.postinst
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+LIBDIR=/usr/lib/@TRIPLET@/sssd
+
+case "$1" in
+    configure)
+        chown root:sssd $LIBDIR/krb5_child $LIBDIR/ldap_child
+        chmod 4754 $LIBDIR/krb5_child $LIBDIR/ldap_child
+    ;;
+esac
+
+#DEBHELPER#
+
--- sssd-1.15.2.orig/debian/sssd-krb5.install
+++ sssd-1.15.2/debian/sssd-krb5.install
@@ -0,0 +1,2 @@
+usr/lib/*/sssd/libsss_krb5.so
+usr/share/man/man5/sssd-krb5.5*
--- sssd-1.15.2.orig/debian/sssd-ldap.install
+++ sssd-1.15.2/debian/sssd-ldap.install
@@ -0,0 +1,2 @@
+usr/lib/*/sssd/libsss_ldap.so
+usr/share/man/man5/sssd-ldap.5*
--- sssd-1.15.2.orig/debian/sssd-proxy.install
+++ sssd-1.15.2/debian/sssd-proxy.install
@@ -0,0 +1,2 @@
+usr/lib/*/sssd/libsss_proxy.so
+usr/lib/*/sssd/proxy_child
--- sssd-1.15.2.orig/debian/sssd-proxy.postinst
+++ sssd-1.15.2/debian/sssd-proxy.postinst
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+LIBDIR=/usr/lib/@TRIPLET@/sssd
+
+case "$1" in
+    configure)
+        chown root:sssd $LIBDIR/proxy_child
+        chmod 4754 $LIBDIR/proxy_child
+    ;;
+esac
+
+#DEBHELPER#
--- sssd-1.15.2.orig/debian/sssd-tools.install
+++ sssd-1.15.2/debian/sssd-tools.install
@@ -0,0 +1,26 @@
+usr/sbin/sss_cache
+usr/sbin/sss_debuglevel
+usr/sbin/sss_groupadd
+usr/sbin/sss_groupdel
+usr/sbin/sss_groupmod
+usr/sbin/sss_groupshow
+usr/sbin/sss_obfuscate
+usr/sbin/sss_override
+usr/sbin/sss_seed
+usr/sbin/sss_useradd
+usr/sbin/sss_userdel
+usr/sbin/sss_usermod
+usr/sbin/sssctl
+usr/share/man/man8/sss_cache.8*
+usr/share/man/man8/sss_debuglevel.8*
+usr/share/man/man8/sss_groupadd.8*
+usr/share/man/man8/sss_groupdel.8*
+usr/share/man/man8/sss_groupmod.8*
+usr/share/man/man8/sss_groupshow.8*
+usr/share/man/man8/sss_obfuscate.8*
+usr/share/man/man8/sss_override.8*
+usr/share/man/man8/sss_seed.8*
+usr/share/man/man8/sss_useradd.8*
+usr/share/man/man8/sss_userdel.8*
+usr/share/man/man8/sss_usermod.8*
+usr/share/man/man8/sssctl.8*
--- sssd-1.15.2.orig/debian/sssd.maintscript
+++ sssd-1.15.2/debian/sssd.maintscript
@@ -0,0 +1 @@
+rm_conffile /etc/logrotate.d/sssd 1.12.5-3~
--- sssd-1.15.2.orig/debian/upstream/signing-key.asc
+++ sssd-1.15.2/debian/upstream/signing-key.asc
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.3
+
+mQGiBEXDdfURBACLDLdnY7LeLJ7fh3HQWojKuMtJGV3tmTRtt58XnEf/FPJae0MUXQDAKJM7
+MDYf0yDNT6Nq6WMQDAIHznFdGRTTSaD97kMeYO11i60FfZ9nM88XJCv0R+OiWh8d7ChCG6ri
+v/AUeNtg++casIQNB8xK9HKLFBS1e+q3b+rXTS9crwCg7FWXqZoZrm4lPlBZQltfhzdmvn8D
+/3CyvgtW5hwr7w+ScQcYnBxdVCtMPSEo541Ealjgq9Knn4sE9lnGjtG4RCYMT2Sideognk9A
+h5nWOGynwta6cluCEqlF6ORJPKpAeqG1a2zpn3iSPbUiyRF+udta9sbwL0hsJTcPTGzvDZO/
+XtMoHSSyPi/Xum6R+jwISv7nTMQpA/0efY/Gy/SZrulBgQqKBMbaW2phvgRThph4n31IYrlS
+B6tAqN0G7VL6AFcsiOJZPhu0TNqEOSYE6Mh5/YBwRPnrKMHZYXiKOeUrfjvURVq+l5dTX7KN
+tbnCrhS+Rlgq1uin5L7g8QbAKMns32Mo1MxB5aN0YUL5pTbJuWL0Sb2Kb7QhSmFrdWIgSHJv
+emVrIDxqaHJvemVrQHJlZGhhdC5jb20+iEYEEBECAAYFAkoAZ+EACgkQeiVVYja6o6PaUgCc
+C1uIdzSouXkz/Hpc8WIq5bbdMCkAoIi6PtlzQuiCQgzN39VcFzIdnUfuiEYEEBECAAYFAkoA
+aA0ACgkQWAkQHAJrbG8paQCgle0IkEHUEpBG3T+despZYg2KaIwAnRRsCazy6CeJfOuP0IVG
+Y8FKWedYiEYEEBECAAYFAkoAcQUACgkQGliNByGNTpdfzgCfVdjXUF5AXkDJ78q2N9biKECo
+GTEAoJWdxJJAI6kE54tSCay6LkqU49etiEgEEBECAAkFAkoAZiECBwAACgkQUDGHpI6P4rpH
+YgCWJtMmuHsk2/znWsUfqALeXL3LXQCgpmRUJbjVee51ja2KSLRqslUZZ1KIXwQTEQIAIAUC
+RcN19QIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEB7Gq3Uy57wlIcEAoKNgX8eyFiQn
+ylJlOKUs7TJsxY4XAJiU6oXuJwZUMVPjZbcKiot+BqMKiQIcBBABAgAGBQJKAGrfAAoJEKqM
+a5A1GvYd/CsP/1eHH2Ogbp9ycbPBc7pO5iLwBDPE81a4SMXqLcs0VS4Ps5d4gpjGo6CilNb6
+gi5GTK4gmpQqFHYmzRSacO5aYnwSeueGYpI+jMxDeQcbabwA9oquOhckYuQ4tM6Cmnwdiym4
+0RsIA+8zEnZuzQywUD7h/b1xRjoEeLAe24UPdF0qMypChdF0EGXhosaapmxhXe31F/qqa2uH
+LUpECwJb417y9aVxDxtq4tnWh3kjpFMrLkX8NA2qMkBO9csI0lRVkDu+Ofs0V7yc3MjART2k
+azYI7VkpVbqRc4QHnzfD3MLR2sgycEc5HQzJZYhe84AYATz8bqwptJlDi2pfEx11rHpVeGGN
+/I2hjitsARsNUIopYyNdXpbwCk4xv2U+uZzGpgzpt/siU4t1oKHc+P2gJ5xrazRan3gEd6QF
+XrWHq1+sdV4pUFM2R3UZt8z8NquRposHPn9ldNEpxNVkjbTZiY6D+f3yIUa43z6f4B2gWSuI
+Gq2ayIVGSKaf+hxzFa9sFsMJ1VeGsYt9g3zxnWRFEJRup0/VasVCqkMan0YoXOJB5+R2Ie73
+WWfoLlv2KozPDL91D1sXhxschxHHnQ8ro3Nl80s+yCNINhBK3+UUZsE/THlU7KQvq2j8dy85
+frWvjPylNddJsXGRzBVTu629Gkhm3glVMPrfi5CEZkuRC4FOiQIcBBABAgAGBQJNsBsGAAoJ
+EK184QA5M3MO9bMP/R4d3Xvhx65ayuLTehyoi0CAdaCU6wbxvO922rzSu57i0JY2Ef14ZXF2
+2RDrkAPgbw6S+wF8GRT4NKvfYaVx9oYunvD1OTa5EfEjG2KvJrKOsOKUCD7yQxKXGhP7K8sc
+AiuZk4rCgfX9+O4RpqRdl1/EqCEBzUZaU79RN/KLqapddtF0H4tyLWpWSyrQs8PjGRJmeh3J
+7RuD7ZYC4XRtvpx3IDqn6+RCQFhb/EpGX7EwxbKgapmpD+9W2vqLHbM655w6/hc68J4bnE80
+DnZKc659HuNvRGitzS7ShbI+8h5TUHcxsEsQCnfKkrkfdQo79878IKBmlJKC1WqUBZbbvdIT
+fVToL9dtShHiNoy4jVuxUoizEAXEIjdi52MHhAY5I6wWyrDOV9Ftg9ZLwa6MbH31EKUbRMmP
+75y0ID4RQCINqP7HMu5vlHRBKAKC1Tf3DqRZJIU61v4A3WR6IMGNXaoVFbQwB6YXsOkJPiN1
+vgrqo42Z+rNRFFkCj341RJO2KNpjeUdeKVSyDmEb22wiRLEgXnmk902uOJN1HFcj7/JjlXGR
+R24Zu0C97B+HNdlmWVnxJx/aNx2zkGnjdAjMLy1bosMJSPyAJVWnKU3TmrsB4raPeawbk8OS
+mwzRCiIl9VDlBjaDK4E4+0I05/BNMWvsEMOeGeJdKU/OhWYPnoBWuQINBEXDdgAQCAC6qjQX
+EfVe106L+pbq/61Z2pgcuP9/RWiqPVxulL5w4M1NpfX9d/gme/q+biU4bmAiSoPV7lQKkbmk
+Mm8ySuljSVhGvlEagLb20dlhd8QFUSR2G5TtlNJBFqiK0rlNLCM6Ploq8VIcSMysJZwZJRqM
+QJCREfBlvccrbCqoFasmOOM+2P7lxCD6wqntmnrFTeJmUyhV91iL/MZ6e6YKnlIybwJlnmBy
+w1mGMi2RPDDkr/83orPjWgxjIeWCHTb0kPQsc+Appw/cp4QQPNIMTH9JIQXjMP8R8sMd6GBr
++fRmKw2bF3G578EjYubuqoY0O1X6prXukgnp899p9tIAphq3AAQLB/9K4yRk3fpQOyg6fTqo
+itiLkkGyzew5+F4kSepQgQ7QkKnJv5+qKx2qhMkzQbmAWkK+5k4AKnPNW/RaOGUwjI+X/tS4
+/gpgjosaoABGo3GwdPsU3FPRS/pBHx8Y9CpV0UsUF3roQEv0+c63dENjC0mUP1ww1Q2nNYRe
+MndEKTSVkXZ6WOk+W7Q6vnc66KiaaeGZyaPFHmC8x/ikupRGERnZTTKVGJOJMiTRjIgBKwOc
+B/QEKUVfPiLipIPqMmWgqitELsy7zvGLUMbgwv4VgL/Z3ncjw6ocFGG01S38Zty2GwcPEWrm
+JWk3HAMBfW+vrk9a/3ym9MycmaMgOF+DAkx0iEkEGBECAAkFAkXDdgACGwwACgkQHsardTLn
+vCWU5wCgqQcHeUMVaVQ1xIt1EJDF+wILLvMAn0YtJTYbQdH6FBUyLY42isSL8TJM
+=+iK5
+-----END PGP PUBLIC KEY BLOCK-----
--- sssd-1.15.2.orig/debian/watch
+++ sssd-1.15.2/debian/watch
@@ -0,0 +1,4 @@
+#git=git://pagure.io/SSSD/sssd.git
+version=3
+opts="uversionmangle=s/alpha/~alpha/;s/beta/~beta/,pgpsigurlmangle=s/$/.asc/" \
+https://releases.pagure.org/SSSD/sssd/sssd-(.*)\.tar\.gz
--- sssd-1.15.2.orig/scripts/release.sh
+++ sssd-1.15.2/scripts/release.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+function config()
+{
+    autoreconf -i -f || return $?
+    ./configure
+}
+
+SAVED_PWD=$PWD
+version=`grep '\[VERSION_NUMBER], \[.*\]' version.m4 |grep '[0-9]\+\.[0-9]\+\.[0-9]\+' -o`
+tag=$(echo ${version} | tr "." "_")
+
+trap "cd $SAVED_PWD; rm -rf sssd-${version} sssd-${version}.tar" EXIT
+
+git archive --format=tar --prefix=sssd-${version}/ sssd-${tag} > sssd-${version}.tar
+if [ $? -ne 0 ]; then
+    echo "Cannot perform git-archive, check if tag $tag is present in git tree"
+    exit 1
+fi
+tar xf sssd-${version}.tar
+
+pushd sssd-${version}
+config || exit 1
+make dist-gzip || exit 1  # also builds docs
+popd
+
+mv sssd-${version}/sssd-${version}.tar.gz .
+gpg --detach-sign --armor sssd-${version}.tar.gz
+
--- sssd-1.15.2.orig/src/man/po/LINGUAS
+++ sssd-1.15.2/src/man/po/LINGUAS
@@ -0,0 +1,2 @@
+ca
+cs
--- sssd-1.15.2.orig/src/tests/intg/.config/screenrc
+++ sssd-1.15.2/src/tests/intg/.config/screenrc
@@ -0,0 +1,23 @@
+autodetach on
+defscrollback 1024
+startup_message off
+nethack on
+vbell off
+vbell_msg "   -- Bell,Bell!! --   "
+multiuser off
+msgminwait 0
+msgwait 10
+
+defutf8 on
+defencoding utf8
+
+hardstatus string '%{gk}[ %{G}%H %{g}][%= %{wk}%?%-Lw%?%{=b kR}(%{W}%n*%f %t%?(%u)%?%{=b kR})%{= kw}%?%+Lw%?%?%= %{g}]%{=b C}[ %d/%m %c ]%{W}'
+hardstatus alwayslastline
+
+setenv LD_LIBRARY_PATH "$_LD_LIBRARY_PATH"
+setenv LD_PRELOAD "$_LD_PRELOAD"
+
+screen -t / 0 sh -c 'cd $ROOT_DIR; exec "${SHELL:-sh}"'
+screen -t /etc 1 sh -c 'cd $ROOT_DIR/etc; exec "${SHELL:-sh}"'
+screen -t sssd_cache 3 sh -c 'cd $ROOT_DIR/var/lib/sss/db; exec "${SHELL:-sh}"'
+screen -t sssd_log 2 sh -c 'cd $ROOT_DIR/var/log/sssd; exec "${SHELL:-sh}"'
--- sssd-1.15.2.orig/zanata.xml
+++ sssd-1.15.2/zanata.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<config xmlns="http://zanata.org/namespace/config/">
+    <url>https://fedora.zanata.org/</url>
+    <project>sssd</project>
+    <project-version>master</project-version>
+    <project-type>gettext</project-type>
+    <src-dir>.</src-dir>
+    <trans-dir>.</trans-dir>
+    <includes>po/*.pot,src/man/po/*.pot</includes>
+    <locales>
+        <locale>af</locale>
+        <locale>sq</locale>
+        <locale>am</locale>
+        <locale>ar</locale>
+        <locale>as</locale>
+        <locale>ast</locale>
+        <locale>bal</locale>
+        <locale>eu</locale>
+        <locale>be</locale>
+        <locale>bn</locale>
+        <locale>bn-IN</locale>
+        <locale>brx</locale>
+        <locale>bs</locale>
+        <locale>br</locale>
+        <locale>bg</locale>
+        <locale>ca</locale>
+        <locale>zh-CN</locale>
+        <locale>zh-HK</locale>
+        <locale>zh-TW</locale>
+        <locale>kw</locale>
+        <locale>kw@kkcor</locale>
+        <locale>kw@uccor</locale>
+        <locale>kw-GB</locale>
+        <locale>hr</locale>
+        <locale>cs</locale>
+        <locale>da</locale>
+        <locale>nl</locale>
+        <locale>en-GB</locale>
+        <locale>eo</locale>
+        <locale>et</locale>
+        <locale>fi</locale>
+        <locale>fr</locale>
+        <locale>gl</locale>
+        <locale>ka</locale>
+        <locale>de</locale>
+        <locale>de-CH</locale>
+        <locale>el</locale>
+        <locale>gu</locale>
+        <locale>he</locale>
+        <locale>hi</locale>
+        <locale>hu</locale>
+        <locale>is</locale>
+        <locale>ilo</locale>
+        <locale>id</locale>
+        <locale>ia</locale>
+        <locale>it</locale>
+        <locale>ja</locale>
+        <locale>kn</locale>
+        <locale>kk</locale>
+        <locale>km</locale>
+        <locale>ky</locale>
+        <locale>ko</locale>
+        <locale>lv</locale>
+        <locale>lt</locale>
+        <locale>nds</locale>
+        <locale>mk</locale>
+        <locale>mai</locale>
+        <locale>ms</locale>
+        <locale>ml</locale>
+        <locale>mr</locale>
+        <locale>mn</locale>
+        <locale>ne</locale>
+        <locale>nso</locale>
+        <locale>nb</locale>
+        <locale>nn</locale>
+        <locale>or</locale>
+        <locale>fa</locale>
+        <locale>pl</locale>
+        <locale>pt</locale>
+        <locale>pt-BR</locale>
+        <locale>pa</locale>
+        <locale>ro</locale>
+        <locale>ru</locale>
+        <locale>sr</locale>
+        <locale>sr@latin</locale>
+        <locale>si</locale>
+        <locale>sk</locale>
+        <locale>sl</locale>
+        <locale>es</locale>
+        <locale>sv</locale>
+        <locale>tg</locale>
+        <locale>ta</locale>
+        <locale>te</locale>
+        <locale>th</locale>
+        <locale>bo</locale>
+        <locale>tr</locale>
+        <locale>tw</locale>
+        <locale>uk</locale>
+        <locale>ur</locale>
+        <locale>vi</locale>
+        <locale>cy</locale>
+        <locale>zu</locale>
+        <locale>wba</locale>
+    </locales>
+    <rules/>
+</config>