Fix bug in adtrustinstance

Incorrect tuple unpacking in adtrustinstance was causing ipa-adtrust-install
to fail when IPA was installed with no DNS.

https://fedorahosted.org/freeipa/ticket/3746
Disable checkboxes and radios for readonly attributes

https://fedorahosted.org/freeipa/ticket/3764
Fix client install exception if /etc/ssh is missing

https://fedorahosted.org/freeipa/ticket/3766
Skip cert issuer validation in service and host commands in CA-less install.

https://fedorahosted.org/freeipa/ticket/3736
Check trust chain length in CA-less install.

https://fedorahosted.org/freeipa/ticket/3707
Use LDAP search instead of *group_show to check if a group exists.

https://fedorahosted.org/freeipa/ticket/3706
Use LDAP search instead of *group_show to check for a group objectclass.

https://fedorahosted.org/freeipa/ticket/3706
Use LDAP modify operation directly to add/remove group members.

This prevents getting full member list from LDAP and putting it back later.

https://fedorahosted.org/freeipa/ticket/3706
Add missing substring indices for attributes managed by the referint plugin.

The referint plugin does a substring search on these attributes each time an
entry is deleted, which causes a noticable slowdown for large directories if
the attributes are not indexed.

https://fedorahosted.org/freeipa/ticket/3706
Add missing equality index for ipaUniqueId.

https://fedorahosted.org/freeipa/ticket/3743
Permit reads to ipatokenRadiusProxyUser objects

This fixes an outstanding permissions issue from the OTP work.

https://fedorahosted.org/freeipa/ticket/3693
Add PAC to master host TGTs

For a proper SASL bind with GSSAPI against an AD LDAP server a PAC is
needed. To allow SSSD in ipa_server_mode to access the LDAP or GC server
of a trusted domain with the credentials of a FreeIPA server host a
PAC must be added to the TGT for the host.

We use the well know RID of the Domain Computers group (515) for the
primary gid element of the PAC, this is the same as AD uses for host
tickets.  The rid element of the PAC is set to the well know RID of the
Domain Controllers group (516). This is working for the SSSD use case
but might be improved later for more general use cases.

To determine if a host is a FreeIPA server or not it is checked if there
is an entry for the host in cn=master,cn=ipa,cn=etc,$base. Unfortunately
this requires an additional LDAP lookup. But since TGS-REQs for hosts
should be rare I think it is acceptable for the time being.

Fixes https://fedorahosted.org/freeipa/ticket/3651
extdom: replace winbind calls with POSIX/SSSD calls

With the new ipa_server_mode SSSD is able to read user and group data
from trusted AD domains directly and makes this data available via the
NSS responder. With this mode enabled winbind is not needed anymore to
lookup users and groups of trusted domains.

This patch removed the calls to winbind from the extdom plugin and
replaces them with standard POSIX calls like getpwnam() and calls from
libsss_nss_idmap to lookup SIDs.

Fixes https://fedorahosted.org/freeipa/ticket/3637 because now the
extdom plugin does not need to handle idranges anymore, but everything
is done inside SSSD.
Remove winbind client configure check

With the replacement of the winbind calls in the extdom plugin none of
the plugins is using the winbind client libraries anymore.
Make sure domain_name is also set when processing INP_NAME requests
Fix extdom plugin to provide unqualified name in response as sssd expects

extdom plugin handles external operation over which SSSD asks IPA server about
trusted domain users not found through normal paths but detected to belong
to the trusted domains associated with IPA realm.

SSSD expects that user or group name in the response will be unqualified
because domain name for the user or group is also included in the response.
Strip domain name from the name if getgrnam_r/getpwnam_r calls returned fully
qualified name which includes the domain name we are asked to handle.

The code already expects that fully-qualified names are following user@domain
convention so we are simply tracking whether '@' symbol is present and is followed
by the domain name.
Generate syntethic MS-PAC for all services running on IPA master

MS-PAC is required to be present in TGT if one wants to connect to
AD services using this TGT. Users get MS-PAC by default, SSSD in
ipa_server_mode uses host/fqdn@REALM principal to talk to AD LDAP.

This patch enables other services running on IPA master to connect
to AD services. This is required for IPA python code doing discovery
of remote AD domain settings shortly after IPA-AD trust has been
established.
Use correct DS instance in ipactl status

Make sure ipactl status check for correct DS instance. It should check for
'dirsrv@IPA-REALM' and not 'dirsrv.target'.

https://fedorahosted.org/freeipa/ticket/3730
Avoid systemd service deadlock during shutdown

https://fedorahosted.org/freeipa/ticket/3729
Add --range-type option that forces range type of the trusted domain

Adds --range-type option to ipa trust-add command. It takes two
allowed values: 'ipa-ad-trust-posix' and 'ipa-ad-trust'.

When --range-type option is not specified, the range type should be
determined by ID range discovery.

https://fedorahosted.org/freeipa/ticket/3650