diff --git a/SOURCES/0031-WebUI-Add-confirmation-dialog-for-changing-default-u.patch b/SOURCES/0031-WebUI-Add-confirmation-dialog-for-changing-default-u.patch
new file mode 100644
index 0000000..657757c
--- /dev/null
+++ b/SOURCES/0031-WebUI-Add-confirmation-dialog-for-changing-default-u.patch
@@ -0,0 +1,67 @@
+From abe2dd0796e77eafca439f35e61ae743b7ac4b16 Mon Sep 17 00:00:00 2001
+From: Serhii Tsymbaliuk <stsymbal@redhat.com>
+Date: Wed, 13 May 2020 15:54:17 +0200
+Subject: [PATCH] WebUI: Add confirmation dialog for changing default user/host
+ group
+
+Changing default group on automember rules page is too easy.
+Add a confirmation dialog to avoid misclick in the case.
+
+Ticket: https://pagure.io/freeipa/issue/8322
+
+Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com>
+Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
+---
+ install/ui/src/freeipa/automember.js | 21 ++++++++++++++++-----
+ ipaserver/plugins/internal.py | 3 +++
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/install/ui/src/freeipa/automember.js b/install/ui/src/freeipa/automember.js
+index a1d56a1b15244d81506c20284bb8341ab5e30d59..7223d0fa9a283a28dc985526375744805dc4f8b2 100644
+--- a/install/ui/src/freeipa/automember.js
++++ b/install/ui/src/freeipa/automember.js
+@@ -594,11 +594,22 @@ IPA.automember.default_group_widget = function(spec) {
+
+ if (group === that.group) return;
+
+- if (group === '') {
+- that.remove_default_group();
+- } else {
+- that.set_default_group(group);
+- }
++ var dialog = IPA.confirm_dialog({
++ title: that.get_title(),
++ message: text.get('@i18n:objects.automember.default_group_confirm'),
++ on_ok: function() {
++ if (group === '') {
++ that.remove_default_group();
++ } else {
++ that.set_default_group(group);
++ }
++ },
++ on_cancel: function() {
++ that.group_select.update([that.group]);
++ }
++ });
++
++ dialog.open();
+ };
+
+ that.load = function(data) {
+diff --git a/ipaserver/plugins/internal.py b/ipaserver/plugins/internal.py
+index c293e0b5e06677f09daa4b820ffd06a2671cd6e1..8588a7198c7def6727ba33d0b80b9e0be5cae701 100644
+--- a/ipaserver/plugins/internal.py
++++ b/ipaserver/plugins/internal.py
+@@ -363,6 +363,9 @@ class i18n_messages(Command):
+ "add_condition": _("Add Condition into ${pkey}"),
+ "add_rule": _("Add Rule"),
+ "attribute": _("Attribute"),
++ "default_group_confirm": _(
++ "Are you sure you want to change default group?"
++ ),
+ "default_host_group": _("Default host group"),
+ "default_user_group": _("Default user group"),
+ "exclusive": _("Exclusive"),
+--
+2.34.3
+
diff --git a/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch b/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
index d84bdbe..30398c9 100644
--- a/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
+++ b/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
@@ -1,4 +1,4 @@
-From 8d6310399c814bfa89fdca2a94b72a5ab09b1c3b Mon Sep 17 00:00:00 2001
+From 1487b30fc127c54098ebb796847f72a98b2d9c22 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Tue, 14 Mar 2017 15:48:07 +0000
Subject: [PATCH] Change branding to IPA and Identity Management
@@ -1106,5 +1106,5 @@ index 643215985e932cae6e8d954596194032655b25d4..68baa0174ed88ede3f42092fb68150b5
""") + _("""
To enable the binddn run the following command to set the password:
--
-2.31.1
+2.34.3
diff --git a/SOURCES/1002-Package-copy-schema-to-ca.py.patch b/SOURCES/1002-Package-copy-schema-to-ca.py.patch
index 2cc3f3a..f2f5ca2 100644
--- a/SOURCES/1002-Package-copy-schema-to-ca.py.patch
+++ b/SOURCES/1002-Package-copy-schema-to-ca.py.patch
@@ -1,4 +1,4 @@
-From 80c99f767a503529580d4b14534a3774398ad426 Mon Sep 17 00:00:00 2001
+From 0c5a4fa341964fd8c08cd7bfa7b2cc2ee2c839e4 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Tue, 14 Mar 2017 16:07:15 +0000
Subject: [PATCH] Package copy-schema-to-ca.py
@@ -40,5 +40,5 @@ index 922185c4b948fa7a5d1bcab6b2be3b34e99f66d4..8fead26f50cb4f045db6d60f9ca71dd9
--
-2.31.1
+2.34.3
diff --git a/SOURCES/1003-Revert-Increased-mod_wsgi-socket-timeout.patch b/SOURCES/1003-Revert-Increased-mod_wsgi-socket-timeout.patch
index c9091c0..0cbf698 100644
--- a/SOURCES/1003-Revert-Increased-mod_wsgi-socket-timeout.patch
+++ b/SOURCES/1003-Revert-Increased-mod_wsgi-socket-timeout.patch
@@ -1,4 +1,4 @@
-From 12ec57b3e8ac5d05fbd28fc9ab9c8f22da13c391 Mon Sep 17 00:00:00 2001
+From 7531be93bf9c67b8c0137b87f70c47afa157f342 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Wed, 22 Jun 2016 13:53:46 +0200
Subject: [PATCH] Revert "Increased mod_wsgi socket-timeout"
@@ -24,5 +24,5 @@ index 912a63c2240e0681dfbeeac223a902b15b304716..c5fc518f803d379287043b405efeb46d
WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py
--
-2.31.1
+2.34.3
diff --git a/SOURCES/1004-Remove-csrgen.patch b/SOURCES/1004-Remove-csrgen.patch
index eaccfc3..7d4b284 100644
--- a/SOURCES/1004-Remove-csrgen.patch
+++ b/SOURCES/1004-Remove-csrgen.patch
@@ -1,4 +1,4 @@
-From 6d108cc59c643b5a9f3acea3a9c5d37fb7ef3252 Mon Sep 17 00:00:00 2001
+From 85b0a51d4ffc2c22a13dca3f29e569357922bd47 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Thu, 16 Mar 2017 09:44:21 +0000
Subject: [PATCH] Remove csrgen
@@ -403,5 +403,5 @@ index 79111ab686b4fe25227796509b3cd3fcb54af728..00000000000000000000000000000000
@@ -1 +0,0 @@
-{{ options|join(";") }}
--
-2.31.1
+2.34.3
diff --git a/SOURCES/1005-Removing-filesystem-encoding-check.patch b/SOURCES/1005-Removing-filesystem-encoding-check.patch
index 36128a3..9ea1ff2 100644
--- a/SOURCES/1005-Removing-filesystem-encoding-check.patch
+++ b/SOURCES/1005-Removing-filesystem-encoding-check.patch
@@ -1,4 +1,4 @@
-From 0207539df5773e24ce260368b1f696128aead682 Mon Sep 17 00:00:00 2001
+From abc706d992c4b5b73eeab41ec1a02931371ca7f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tibor=20Dudl=C3=A1k?= <tdudlak@redhat.com>
Date: Fri, 10 Aug 2018 13:16:38 +0200
Subject: [PATCH] Removing filesystem encoding check
@@ -126,5 +126,5 @@ index b660532bd6e8db964b8287845ed1b5ebbcb43b9b..60309c58f250a263c8c3d13b0b47773b
IPA_NOT_CONFIGURED = b'IPA is not configured on this system'
IPA_CLIENT_NOT_CONFIGURED = b'IPA client is not configured on this system'
--
-2.31.1
+2.34.3
diff --git a/SPECS/ipa.spec b/SPECS/ipa.spec
index 5897b65..4d91221 100644
--- a/SPECS/ipa.spec
+++ b/SPECS/ipa.spec
@@ -103,7 +103,7 @@
Name: ipa
Version: %{IPA_VERSION}
-Release: 5%{?dist}.10
+Release: 5%{?dist}.11
Summary: The Identity, Policy and Audit system
Group: System Environment/Base
@@ -111,9 +111,9 @@ License: GPLv3+
URL: http://www.freeipa.org/
Source0: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz
# RHEL spec file only: START: Change branding to IPA and Identity Management
-#Source1: header-logo.png
-#Source2: login-screen-background.jpg
-#Source4: product-name.png
+Source1: header-logo.png
+Source2: login-screen-background.jpg
+Source4: product-name.png
# RHEL spec file only: END: Change branding to IPA and Identity Management
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -148,6 +148,7 @@ Patch0027: 0027-Allow-PKINIT-to-be-enabled-when-updating-from-a-pre-.patch
Patch0028: 0028-extdom-return-LDAP_NO_SUCH_OBJECT-if-domains-differ.patch
Patch0029: 0029-Fix-cert_request-for-KDC-cert.patch
Patch0030: 0030-SMB-switch-IPA-domain-controller-role.patch
+Patch0031: 0031-WebUI-Add-confirmation-dialog-for-changing-default-u.patch
Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch
Patch1002: 1002-Package-copy-schema-to-ca.py.patch
Patch1003: 1003-Revert-Increased-mod_wsgi-socket-timeout.patch
@@ -404,10 +405,7 @@ Requires: oddjob
Requires: gssproxy >= 0.7.0-2
# 1.15.2: FindByNameAndCertificate (https://pagure.io/SSSD/sssd/issue/3050)
Requires: sssd-dbus >= 1.15.2
-
-%if 0%{?centos} == 0
Requires: system-logos >= 70.7.0
-%endif
Provides: %{alt_name}-server = %{version}
Conflicts: %{alt_name}-server
@@ -964,9 +962,9 @@ cp -r %{_builddir}/freeipa-%{version} %{_builddir}/freeipa-%{version}-python3
# with_python3
# RHEL spec file only: START: Change branding to IPA and Identity Management
-#cp %SOURCE1 install/ui/images/header-logo.png
-#cp %SOURCE2 install/ui/images/login-screen-background.jpg
-#cp %SOURCE4 install/ui/images/product-name.png
+cp %SOURCE1 install/ui/images/header-logo.png
+cp %SOURCE2 install/ui/images/login-screen-background.jpg
+cp %SOURCE4 install/ui/images/product-name.png
# RHEL spec file only: END: Change branding to IPA and Identity Management
@@ -990,8 +988,7 @@ find \
%configure --with-vendor-suffix=-%{release} \
%{enable_server_option} \
%{with_ipatests_option} \
- %{linter_options} \
- --with-ipaplatform=rhel
+ %{linter_options}
%make_build
@@ -1012,8 +1009,7 @@ find \
%configure --with-vendor-suffix=-%{release} \
%{enable_server_option} \
%{with_ipatests_option} \
- %{linter_options} \
- --with-ipaplatform=rhel
+ %{linter_options}
popd
%endif
# with_python3
@@ -1100,11 +1096,9 @@ ln -s %{_bindir}/ipa-test-task-%{python2_version} %{buildroot}%{_bindir}/ipa-tes
# remove files which are useful only for make uninstall
find %{buildroot} -wholename '*/site-packages/*/install_files.txt' -exec rm {} \;
-%if 0%{?centos} == 0
# RHEL spec file only: START: Replace login-screen-logo.png with a symlink
ln -sf %{_datadir}/pixmaps/fedora-gdm-logo.png %{buildroot}%{_usr}/share/ipa/ui/images/login-screen-logo.png
# RHEL spec file only: END: Replace login-screen-logo.png with a symlink
-%endif
%find_lang %{gettext_domain}
@@ -1761,8 +1755,9 @@ fi
%changelog
-* Thu Dec 16 2021 CentOS Sources <bugs@centos.org> - 4.6.8-5.el7.centos.10
-- Roll in CentOS Branding
+* Tue May 10 2022 Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
+- Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
+ - WebUI: Add confirmation dialog for changing default user/host group
* Thu Dec 02 2021 Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
- Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server