SSSD 1.13.3

Highlights

A bug that prevented user lookups and logins after migration from winsync to IPA-AD trusts was fixed
The OCSP certificate validation checks are enabled for smartcard logins if SSSD was compiled with the NSS crypto library.
A bug that prevented the ignore_group_members option from working correctly in AD provider setups that use a dedicated primary group (as opposed to a user-private group) was fixed
Offline detection and offline login timeouts were improved for AD users logging in from a domain trusted by an IPA server
The AD provider supports setting up autofs_provider=ad
Several usability improvements to our debug messages

The p11_child helper binary is able to run completely unprivileged and no longer requires the setgid bit to be set

A new option certificate_verification was added. This option allows the administrator to disable OCSP checks in case the OCSP server is not reachable