Only require libsss_nss_idmap-python in Fedora 19+

The package is only available in Fedora 19.
This means SID resolution in the UI won't work in Fedora 18.
Set KRB5CCNAME so httpd s4u2proxy can with with newer krb5-server

The DIR ccache format is now the default in krb5-server 1.11.2-4
but /run/user/<uid> isn't created for Apache by anything so it
has no ccache (and it doesn't have SELinux permissions to write here
either).

Use KRB5CCNAME to set a file path instead in /etc/sysconfig/httpd.

https://fedorahosted.org/freeipa/ticket/3607
Do not add ipa-ca records on CA-less installs

ipa-dns-install crashed when it was run on a CA-less server.

https://fedorahosted.org/freeipa/ticket/3617
Fix ipa-ca DNS name creation

Previous fix (6d06a7e) did not work properly on a CA-less replica
with CA-powered master.

https://fedorahosted.org/freeipa/ticket/3617
Update translations from Transifex
Fix SASL_NOCANON behavior for LDAPI

Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON
behavior for socket based connections (#960222).
Become 3.2.0
Bump version for development branch to 3.2.99
Fix: HBAC Test tab is missing

Caused by typo in metadata provider source path.

No metadata -> no HBAC test entity -> no tab

https://fedorahosted.org/freeipa/ticket/3627
Remove leading zero from IPA_NUM_VERSION

The numeric IPA_NUM_VERSION contained a leading zero, so it was treated
as octal value in Python code instead of decimal.

https://fedorahosted.org/freeipa/ticket/3622
Set KRB5CCNAME so that dirsrv can work with newer krb5-server

The DIR ccache format is now the default in krb5-server 1.11.2-4
but /run/user/<uid> isn't created for Apache by anything so it
has no ccache (and it doesn't have SELinux permissions to write here
either).

Use KRB5CCNAME to set a file path instead in /etc/sysconfig/dirsrv.

https://fedorahosted.org/freeipa/ticket/3628
Remove redundancy from hbactest help text

I modified the SID in the second example so that result corresponds
with the 5. example.

https://fedorahosted.org/freeipa/ticket/3625
Prompt for nameserver IP address in dnszone-add

Prompt for nameserver IP address in interactive mode of dnszone-add.

Add a corresponding field to dnszone creation dialog in the web UI.

This parameter is required if and only if:
* New zone is a forward zone
* Nameserver is defined inside the new zone

Add a new unit test to cover this functionality.

https://fedorahosted.org/freeipa/ticket/3603
Add ipaUserAuthType and ipaUserAuthTypeClass

This schema addition will be useful for future commits. It allows us to
define permitted external authentication methods on both the user and
global config. The implementation is generic, but the immediate usage
is for otp support.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
Add IPA OTP schema and ACLs

This commit adds schema support for two factor authentication via
OTP devices, including RADIUS or TOTP. This schema will be used
by future patches which will enable two factor authentication
directly.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
ipa-kdb: Add OTP support

If OTP is enabled for a user, then:
  1. Long-term keys are not provided to KDB
  2. The user string 'otp' is defined to KDB

Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string to a known default
('[]') which enables the default configuration in the KDC.

https://fedorahosted.org/freeipa/ticket/3561
http://freeipa.org/page/V3/OTP
Add the krb5/FreeIPA RADIUS companion daemon

This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.

https://fedorahosted.org/freeipa/ticket/3366
http://freeipa.org/page/V3/OTP
Remove unnecessary prefixes from ipa-pwd-extop files
Add OTP support to ipa-pwd-extop

During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.

    https://fedorahosted.org/freeipa/ticket/3367
    http://freeipa.org/page/V3/OTP
Do not display success message on failure in web UI

https://fedorahosted.org/freeipa/ticket/3591