Don't add another nsDS5ReplicaId on updates if one already exists

Modify update file to use default: rather than add: in
cn=replication,cn=etc,$SUFFIX.

Drop quotes around nsDS5ReplicaRoot because default: values
are not parsed as CSV.

https://fedorahosted.org/freeipa/ticket/3394
Take into consideration services when deleting replicas

When deleting a replica from IPA domain:
* Abort if the installation is about to be left without CA
* Warn if the installation is about to be left without DNS

Ticket: https://fedorahosted.org/freeipa/ticket/2879
Add LDAP server fallback to client installer

Change the discovery code to validate all servers, regardless of where
the originated (either via SRV records or --server). This will prevent
the client installer from failing if one of those records points to a
server that is either not running or is not an IPA server.

If a server is not available it is not removed from the list of configured
servers, simply moved to the end of the list.

If a server is not an IPA server it is removed.

https://fedorahosted.org/freeipa/ticket/3388
Raise ValidationError on invalid CSV values.

https://fedorahosted.org/freeipa/ticket/3323
Prevent integer overflow when setting krbPasswordExpiration

Since in Kerberos V5 are used 32-bit unix timestamps, setting
maxlife in pwpolicy to values such as 9999 days would cause
integer overflow in krbPasswordExpiration attribute.

This would result into unpredictable behaviour such as users
not being able to log in after password expiration if password
policy was changed (#3114) or new users not being able to log
in at all (#3312).

The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver.

https://fedorahosted.org/freeipa/ticket/3312
https://fedorahosted.org/freeipa/ticket/3114
Prevent a crash when no entries are successfully migrated.

It would fail in _update_default_group() because migrate_cnt wasn't
defined in context.

https://fedorahosted.org/freeipa/ticket/3386
Fix permission_find test error

Remove extraneous memberindirect_role attribute from permission_find
unit test to avoid false negative test result.
Add custom mapping object for LDAP entry data.
Remove some unused imports

Remove all unused LDAP-related imports, plus some other ones.

This should make it easier to quickly check what uses which LDAP wrapper
Remove unused methods from Entry, Entity, and IPAdmin

These classes are deprecated, there's no use keeping unused methods around.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Derive Entity class from Entry, and move it to ldapupdate

The two classes were nearly identical, and the updater is
the only code that uses Entity.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Use explicit loggers in ldap2 code

This change makes it easier to see what is going on, in addition
to getting rid of pylint exceptions.

Also, make logging imports use explicit names instead of `import *`.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Move LDAPEntry to ipaserver.ipaldap and derive Entry from it

Legacy Entry methods such as setValue are added to LDAPEntry directly,
so that we can use connection classes that return LDAPEntry with
code that expects Entries.

The Entry and its unique __init__ are still kept for compatibility.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Remove connection-creating code from ShemaCache

The connection code depends on the api object. If we want to use
the cache in installer code, where the api object is not always
available, the dependency must be removed.

Luckily, SchemaCache.get_schema is currently always given a connection.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Move the decision to force schema updates out of IPASimpleLDAPObject

This decision used the api object, which might not be available
in installer code. Move the decision to callers.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Move SchemaCache and IPASimpleLDAPObject to ipaserver.ipaldap

The ldap2 plugin should only contain the actual CRUDBackend plugin.
Common LDAP classes are moved to ipaldap.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Start LDAPConnection, a common base for ldap2 and IPAdmin

The first method to be extracted is handle_errors

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Make IPAdmin not inherit from IPASimpleLDAPObject

Instead of inheritance, the LDAPObject is kept in a `conn` attribute,
as the ldap2 class does it.
However, all IPASimpleLDAPObject methods are still available as before
(using __getattr__-based proxying).

Also, remove the IPAEntryLDAPObject class. The methods it overrode
were never called in ways that would make them behave differently than
the superclass.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Move schema-related methods to LDAPConnection

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
Move DN handling methods to LDAPConnection

ldap2 has "DN normalization" functionality, which silently adds the base
DN to DNs that don't already end with it.
This functionality is left in the ldap2 class only.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660