Document no_search in Param flags
Use the right attribute with ipapwd_entry_checks for MagicRegen

There is a special mode to set the ipaNTHash attribute if a RC4 Kerberos
key is available for the corresponding user. This is typically triggered
by samba via the ipa_sam passdb plugin. The principal used by samba to
connect to the IPA directory server has the right to modify ipaNTHash
but no other password attribute. This means that the current check on
the userPassword attribute is too strict for this case and leads to a
failure of the whole operation.

With this patch the access right on ipaNTHash are checked if no other
password operations are requested.
Don't special case the Password class in Param.__init__()
test_ipalib.test_crud: Don't use a string in takes_options

Options should be Param subclasses.
Add optional_create flag
Allow multiple types in Param type validation

Int already needed to take both int and long. This makes the functionality
available for all Param classes.
Add IntEnum parameter to ipalib
Add tests for the IntEnum class

The StrEnum and Int tests are restructured to allow sharing the tests.
Individual *Enum tests are separated into methods.
Remove --no-serial-autoincrement

Deprecate this option and do not offer it in installation tools.
Without this option enabled, advanced DNS features like DNSSEC
would not work.

https://fedorahosted.org/freeipa/ticket/3962
PKI installation on replica failing due to missing proxy conf

Proxy configuration was not detected correctly. Both
ipa-pki-proxy.conf and ipa.conf need to be in place and httpd
restarted to be able to check it's status.

https://fedorahosted.org/freeipa/ticket/3964
Use consistent realm name in cainstance and dsinstance

The installers used custom self.realm_name instead of standard
self.realm defined in Service class. It caused crashes in some cases
when Service class methods expected the self.realm to be filled.

https://fedorahosted.org/freeipa/ticket/3854
Winsync re-initialize should not run memberOf fixup task

Change re-initialize command to consider memberOf fixup task only
for non-winsync replication agreements.

https://fedorahosted.org/freeipa/ticket/3854
trusts: Do not create ranges for subdomains in case of POSIX trust

For the AD trusts where the ID range for the root level domain is of
ipa-ad-trust-posix type, do not create a separate ranges for the
subdomains, since POSIX attributes provide global mapping.
ipa-upgradeconfig: Remove backed up smb.conf

Since we are not able to properly restore the Samba server to the
working state after running ipa-adtrust-install, we should not keep
the smb.conf in the fstore.

This patch makes sure that any backed up smb.conf is removed from
the backup and that this file is not backed up anymore.

Part of: https://fedorahosted.org/freeipa/ticket/3479
ipa-adtrust-install: Add warning that we will break existing samba configuration

In case /etc/samba/smb.conf exists and it was not created by ipa-adtrust-install,
print a warning that we will break existing samba configuration and ask for
a confirmation in the interactive mode.

Part of: https://fedorahosted.org/freeipa/ticket/3479
adtrustinstance: Properly handle uninstall of AD trust instance

The uninstall method of the AD trust instance was not called upon
at all in the ipa-server-install --uninstall phase.

This patch makes sure that AD trust instance is unconfigured when
the server is uninstalled.

The following steps are undertaken:
  * Remove /var/run/samba/krb5cc_samba
  * Remove our keys from /etc/samba/samba.keytab using ipa-rmkeytab
  * Remove /var/lib/samba/*.tdb files

Additionally, we make sure winbind service is stopped from within the
stop() method.

Part of: https://fedorahosted.org/freeipa/ticket/3479
adtrustinstance: Move attribute definitions from setup to init method

Majority of the attributes set in the setup method can be set in the
__init__ method where they are actually defined (and set to None).

This is true for attributes that hold constant values and for
attributes that have their values derived from api.env dictionary.

Creates a new __setup_default_attributes method, that is called
from within __init__ and setup (in case the passed values for
hostname or domain do not correspond to that what is set in api.env,
doing otherwise could cause unexpected behaviour).

Part of: https://fedorahosted.org/freeipa/ticket/3479
Added warning if cert '/etc/ipa/ca.crt' exists

https://fedorahosted.org/freeipa/ticket/3944
Load updated Web UI files after server upgrade

Issue:
* There was no caching policy specified.
* -> Browsers use their own default policy.
* -> After upgrade, some Web UI files might have been actualized some not.
* -> With schema change may result into weird bugs in Web UI

Solution considerations:

1. Detect server version change and hard-reload at runtime
Detection is easy. Problem is the reload. Obvious candidate 'window.location.reload(true)' works in Firefox but not in Chrome because expected behavior when parameter is used is not in standard and therefore Chromium/WebKit authors did not implement it.

2. Application Cache
HTML 5 technology which lets web apps to run offline. Besides weird issues with event handlers which I encountered, this would be an ideal candidate. Simple change of manifest file would lead to reload of all files (requires reload of page to used the new files).

Showstopper was usage with untrusted certificate. If user did not add exception for the cert or its CA and would visit the page for a second time, all AJAX calls would fail.

3. Set Expires to now() for everything
Web UI rarely changes so this is an overkill. Setting it to different value is not a solution either. We can't predict when the upgrade will happen and when new Web UI will be needed.

Solution:
* Implemented a mini loader which loads basic resources. Dojo loader takes action after Dojo is loaded.
* The loader adds a version parameter (?v=__NUM_VERSION__) to all requests.
* Version is defined in the loader. It's set to current in `make version-update`.
* All static pages use this loader to fetch their resources.
* Version is also passed to dojo loader as cache-bust for the same effect.
* Expire header was set to 'access time plus 1 year' for /ui folder. Exceptions are HTML files and loader (set to immediate expiration).

Possible issues:
* Images are cached but not requested with version param.
  * Images with version and without are considered different
  * -> We would have to attach version to all URIs - in CSS and in JS. But we should avoid changing jQuery UI CSS.
  * Proposed solution is to change image name when changing image. Image change is done rarely.
* Version is set by build and therefore updated just on server update. It might cause trouble with different update schedule of plugins.
  * No action taken to address this issue yet.
  * We might leave it on plugin devs (own .conf in /etc/httpd/conf.d/)
  * or set expires to now for all plugins
* running `make version-update` is required in order to use static version of UI for testing

https://fedorahosted.org/freeipa/ticket/3798
Removal of unused code