Merge branch '19400-login-sync-logincluster'. Closes #19400

Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima@curii.com>

diff --cc doc/admin/upgrading.html.textile.liquid
index 7ee8fbb08ade7190f9121a88add620c64a31838c,8ed5af19c525d375e4f1a41801e4c765fe30858b..a3717e3c567934f12826438bb3b97e5fe3855ba9
--- 1/doc/admin/upgrading.html.textile.liquid
--- 2/doc/admin/upgrading.html.textile.liquid
+++ b/doc/admin/upgrading.html.textile.liquid
@@@ -28,33 -28,14 +28,37 @@@ TODO: extract this information based o
  <div class="releasenotes">
  </notextile>
  
 -h2(#main). development main (as of 2022-08-26)
  
 -"previous: Upgrading to 2.4.2":#v2_4_2
 +h2(#main). development main (as of 2022-09-21)
 +
 +"previous: Upgrading to 2.4.3":#v2_4_3
  
+ h3. Login-sync script requires configuration update on LoginCluster federations
+ 
+ If you have @arvados-login-sync@ running on a satellite cluster, please update the environment variable settings by removing the @LOGINCLUSTER_ARVADOS_API_*@ variables and setting @ARVADOS_API_TOKEN@ to a LoginCluster's admin token, as described on the "updated install page":{{site.baseurl}}/install/install-shell-server.html#arvados-login-sync.
+ 
 +h3. Renamed keep-web metrics and WebDAV configs
 +
 +Metrics previously reported by keep-web (@arvados_keepweb_collectioncache_requests@, @..._hits@, @..._pdh_hits@, @..._api_calls@, @..._cached_manifests@, and @arvados_keepweb_sessions_cached_collection_bytes@) have been replaced with @arvados_keepweb_cached_session_bytes@.
 +
 +The config entries @Collections.WebDAVCache.UUIDTTL@, @...MaxCollectionEntries@, and @...MaxUUIDEntries@ are no longer used, and should be removed from your config file.
 +
 +h2(#v2_4_3). v2.4.3 (2022-09-21)
 +
 +"previous: Upgrading to 2.4.2":#v2_4_2
 +
 +h3. Fixed PAM authentication security vulnerability
 +
 +In Arvados 2.4.2 and earlier, when using PAM authentication, if a user
 +presented valid credentials but the account is disabled or otherwise
 +not allowed to access the host, it would still be accepted for access
 +to Arvados.  From 2.4.3 onwards, Arvados now also checks that the
 +account is permitted to access the host before completing the PAM login
 +process.
 +
 +Other authentication methods (LDAP, OpenID Connect) are not affected
 +by this flaw.
 +
  h2(#v2_4_2). v2.4.2 (2022-08-09)
  
  "previous: Upgrading to 2.4.1":#v2_4_1