This update for Samba provides the latest bugfix release 4.1.21 with various fixes and improvements.

- Avoid quoting problems in user's DNs (bso#11488).
- Relocate the tmpfiles.d directory to the client package (bsc#947552).
- s3: winbindd: Fix TALLOC_FREE of uninitialized groups variable (bso#10823).
- Fix logon via MS Remote Desktop (bso#11061).
- s3:winbindd: make sure we pass a valid server to rpccli_netlogon_sam_network_logon*() (bso#11081).
- s3:param/loadparm fix 'testparm --show-all-parameters' (bso#11170).
- s3-passdb: Respect LOOKUP_NAME_GROUP flag in sid lookup (bso#11320).
- Use resource group sids obtained from pac logon_info (bso#11328).
- s3: smbd: Use separate flag to track become_root()/unbecome_root() state (bso#11339).
- s3: smbd: Codenomicon crash in do_smb_load_module() (bso#11342).
- lib: replace: Add strsep function (bso#11359).
- s3:libsmb: Fix a bug in conversion of ea list to ea array (bso#11361).
- docs: Overhaul the description of "smb encrypt" to include SMB3 encryption (bso#11366).
- smbd: Fix SMB3 functionality of "smb encrypt" (bso#11372).
- s3-smbd: Reset protocol in smbXsrv_connection_init_tables failure paths (bso#11373).
- s3-smbd: Leave sys_disk_free() if dfree command is used (bso#11403).
- s3-auth: Fix a possible null pointer dereference (bso#11404).
- s3-net: Use talloc array in share allowedusers (bso#11426).
- s3-util: Compare the maximum allowed length of a NetBIOS name (bso#11427).
- Configure with --bundled-libraries=NONE (bso#11458).
- Adapt net-kdc-lookup patch for post-3.3 Samba versions (bsc#295284).
- Backport changes to use resource group sids obtained from pac logon_info (bso#11328, bsc#912457).
- Remove deprecated base_rid example from idmap_rid manpage (bso#11169, bsc#913304).
- Use domain name if search by domain SID fails to send SIDHistory lookups to correct idmap backend (bsc#773464).
- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).