diff --git a/sssd-2.0.0.tar.gz b/sssd-2.0.0.tar.gz
deleted file mode 100644
index 2591175..0000000
--- a/sssd-2.0.0.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:77569d00dd516e7eba1bfcc2ae562647068d7d16e283e8b3fc4f1e03fc899586
-size 6263376
diff --git a/sssd-2.0.0.tar.gz.asc b/sssd-2.0.0.tar.gz.asc
deleted file mode 100644
index a446f4f..0000000
--- a/sssd-2.0.0.tar.gz.asc
+++ /dev/null
@@ -1,10 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQEcBAABAgAGBQJbcd4JAAoJEHDBRgYiUL36ZpUH/0R46OWssuYR7gVSoh1UWZdA
-Gg/uPN5iSo0hq6mjU/w7inGb5GxTnbj8WQXo8466EUw98NDTTc7NMLScy83bsb1i
-MIk4eXxm0c5lsRuIFCS+3qtakZtYyjDk+8v6BqRARFFPE9R4j8Cb1BOUurgoMDTg
-IE75AP+QHTxdrPQ/xj4PQcdIZ6qimeztD1IJDrb7hValyMfqs9XHsamXsQwRrfEV
-l0U3eUlsX0vegrQwEG8iOQt4v0cr9jMCahgSnvNZotqiyHUr5VLH901OSZzwPly6
-8+BAp9mnNZ2lG5pqFEXOsI1kmQ5hnXDFu1OcIedkKHdBRMqNZC3ip0k8ow3fbAk=
-=K92m
------END PGP SIGNATURE-----
diff --git a/sssd-2.1.0.tar.gz b/sssd-2.1.0.tar.gz
new file mode 100644
index 0000000..840d42f
--- /dev/null
+++ b/sssd-2.1.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:10f04bd8a1ae7e888e2bcc13edc1a64ef19b4990866c09c65c667d0c72b66743
+size 6463331
diff --git a/sssd-2.1.0.tar.gz.asc b/sssd-2.1.0.tar.gz.asc
new file mode 100644
index 0000000..3a490d1
--- /dev/null
+++ b/sssd-2.1.0.tar.gz.asc
@@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iEYEABECAAYFAlx24YkACgkQHsardTLnvCWcxgCgt5a0AYEWnuJkx7qH37pBpDj8
+nQEAn3x6FKj/f71JTCYpPrykAc47dyRD
+=fQLU
+-----END PGP SIGNATURE-----
diff --git a/sssd.changes b/sssd.changes
index f2bde67..1d71cf4 100644
--- a/sssd.changes
+++ b/sssd.changes
@@ -1,3 +1,19 @@
+-------------------------------------------------------------------
+Sat Mar 16 11:50:58 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to new upstream release 2.1.0
+  * Any provider can now match and map certificates to user
+    identities.
+  * pam_sss can now be configured to only perform Smart Card
+    authentication or return an error if this is not possible.
+  * pam_sss can also prompt the user to insert a Smart Card if,
+    during an authentication it is not available.
+  * A new configuration option ad_gpo_implicit_deny was added.
+    This option (when set to True) can be used to deny access to
+    users even if there is not applicable GPO.
+  * The dynamic DNS update can now batch DNS updates to include
+    all address family updates in a single transaction.
+
 -------------------------------------------------------------------
 Wed Feb 20 16:01:52 UTC 2019 - Samuel Cabrero <scabrero@suse.de>
 
diff --git a/sssd.spec b/sssd.spec
index b01ea33..5b9e591 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -17,7 +17,7 @@
 
 
 Name:           sssd
-Version:        2.0.0
+Version:        2.1.0
 Release:        0
 Summary:        System Security Services Daemon
 License:        GPL-3.0+ and LGPL-3.0+
@@ -409,8 +409,8 @@ make %{?_smp_mflags} all
 # sss_obfuscate is compatible with both python 2 and 3
 sed -i -e 's:%_bindir/python:%_bindir/python3:' src/tools/sss_obfuscate
 
+%make_install
 b="%buildroot"
-make install DESTDIR="$b"
 
 # Copy default sssd.conf file
 install -d "$b/%_mandir"/{cs,cs/man8,nl,nl/man8,pt,pt/man8,uk,uk/man1} \
@@ -424,20 +424,17 @@ install -d "$b/%_unitdir"
 install -d "$b/%_sysconfdir/logrotate.d"
 install -m644 src/examples/logrotate "$b/%_sysconfdir/logrotate.d/sssd"
 
-rm -Rf "$b/%_initddir"
-ln -s service "$b/%_sbindir/rcsssd"
+rm -Rfv "$b/%_initddir"
+ln -sfv service "$b/%_sbindir/rcsssd"
 
-mkdir -p "$b/%sssdstatedir/mc"
-mkdir -p "$b/%_sysconfdir/ld.so.conf.d"
+mkdir -pv "$b/%sssdstatedir/mc"
+mkdir -pv "$b/%_sysconfdir/ld.so.conf.d"
 cat >"$b/%_sysconfdir/ld.so.conf.d/sssd-wbclient.conf" <<-EOF
 	%_libdir/%name/modules
 EOF
-find "$b" -type f -name "*.la" -delete
-
-rm -Rf "$b/%_sysconfdir/dbus-1" "$b/%_datadir/dbus-1"
-rm -rf "$b/usr/lib/debug/usr/lib/sssd/p11_child-1.16.2-0.x86_64.debug"
-
-
+find "$b" -type f -name "*.la" -print -delete
+rm -Rfv "$b/%_sysconfdir/dbus-1" "$b/%_datadir/dbus-1"
+rm -Rfv "$b/usr/lib/debug/usr/lib/sssd/p11_child-1.16.2-0.x86_64.debug"
 %find_lang %name --all-name
 
 %check
@@ -448,19 +445,19 @@ make %{?_smp_mflags} check ||:
 %service_add_pre sssd.service
 
 %post
+/sbin/ldconfig
 # migrate config variable krb5_kdcip to krb5_server (bnc#851048)
 /bin/sed -i -e 's,^krb5_kdcip =,krb5_server =,g' %_sysconfdir/sssd/sssd.conf
-/sbin/ldconfig
 %service_add_post sssd.service
 
 %preun
 %service_del_preun sssd.service
 
 %postun
-if [ "$1" = "0" ]; then
+/sbin/ldconfig
+if [ "$1" = "0" -a -x "%_sbindir/pam-config" ]; then
 	"%_sbindir/pam-config" -d --sss || :
 fi
-/sbin/ldconfig
 # Clear caches, which may have an incompatible format afterwards
 # (especially, downgrades)
 rm -f /var/lib/sss/db/*.ldb
@@ -567,7 +564,7 @@ rm -f /var/lib/sss/db/*.ldb
 %_libdir/krb5/
 %_libdir/%name/modules/sssd_krb5_localauth_plugin.so
 %_mandir/??/man8/pam_sss.8*
-%_mandir/??/man8/sssd_krb5_locator_plugin.8*
+#%_mandir/??/man8/sssd_krb5_locator_plugin.8*
 %_mandir/man8/pam_sss.8*
 %_mandir/man8/sssd_krb5_locator_plugin.8*