Add hint message about --force-join option when enrollment fails

When client enrollment fails due to the fact that host entry
already exists on the server, display an message informing the
user about the possibility of using --force-join option.

https://fedorahosted.org/freeipa/ticket/3572
Avoid removing sss from nssswitch.conf during client uninstall

This patch makes sure that sss is not removed from nsswitch.conf
which causes probles with later uses of sssd. Makes sure that
authconfig with --disablesssd option is not executed during
ipa client uninstall.

https://fedorahosted.org/freeipa/ticket/3577
Add DNS records for existing masters when installing DNS for the first time.

https://fedorahosted.org/freeipa/ticket/3564
Add ipa-ca records for existing CA masters when installing DNS for the first time.

https://fedorahosted.org/freeipa/ticket/3564
Handle socket.gethostbyaddr() exceptions when verifying hostnames.

Log any socket exceptions raised and let the process continue. This
failure isn't a show-stopper. Other checks past this will catch any
other problems.

This was seen when /etc/hosts and /etc/resolv.conf were both empty.

https://fedorahosted.org/freeipa/ticket/3581
Do not display an interactive mode message in unattended mode

https://fedorahosted.org/freeipa/ticket/3576
Add missing permissions to Host Administrators privilege

The 'Host Administrators' privilege was missing two permissions
('Retrieve Certificates from the CA' and 'Revoke Certificate'), causing
the inability to remove a host with a certificate.

https://fedorahosted.org/freeipa/ticket/3585
Allow underscore in record targets

Makes record target validation less strict and allows underscore.
This is requirement for IPA sites.

https://fedorahosted.org/freeipa/ticket/3550
Make gecos field editable in Web UI

This patch exposes user entry gecos field in Web UI.

https://fedorahosted.org/freeipa/ticket/3569
Add userClass attribute for hosts

This new freeform host attribute will allow provisioning systems
to add custom tags for host objects which can be later used for
in automember rules or for additional local interpretation.

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
Ticket: https://fedorahosted.org/freeipa/ticket/3583
Fix syntax of the dc attributeType

dc syntax is changed from Directory String to IA5 String to conform
to RFC 2247.

Part of the work for https://fedorahosted.org/freeipa/ticket/3578
Fix syntax errors in schema files

- add missing closing parenthesis in idnsRecord declaration
- remove extra dollar sign from ipaSudoRule declaration
- handle missing/extraneous X-ORIGIN lines in 10-selinuxusermap.update

This does not use the schema updater because the syntax needs to be
fixed in the files themselves, otherwise 389 1.3.2+ will fail
to start.
Older DS versions transparently fix the syntax errors.

The existing ldap-updater directive for ipaSudoRule is fixed
(ldap-updater runs after upgradeconfig).

https://fedorahosted.org/freeipa/ticket/3578
Always stop dirsrv in 'ipactl stop'

Ensure that 'ipactl stop' stops the dirsrv instance, even when no other
services are running.

https://fedorahosted.org/freeipa/ticket/3574
Require version of NSS that properly parses base64-encoded certs

There were cases where a base64-encoded cert with no header/footer would
not be handled properly and rejected. This was causing the CA install
to fail.

https://fedorahosted.org/freeipa/ticket/3586
Preserve already configured options in openldap conf

We should respect already configured options present in
/etc/openldap/ldap.conf when generating our own configuration.

With this patch, we only rewrite URI, BASE and TLS_CACERT options
only if they are not configured. In the case they are, our suggested
configuration is inserted as a comment.

Also adds tab as a delimeter character in /etc/openldap/ldap.conf

https://fedorahosted.org/freeipa/ticket/3582
Add support for OpenSSH 6.2.

Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config
on openssh-server update.

https://fedorahosted.org/freeipa/ticket/3571
Fix: Certificate status is not visible in Service and Host page

https://fedorahosted.org/freeipa/ticket/3593
Drop uniqueMember mapping with nss-pam-ldapd.

nss-pam-ldapd in 0.8.4 changed the default to map uniqueMember to
member so it is no longer needed in the config file, and in fact
causes an error to be raised.

Add a Conflicts on older versions.

https://fedorahosted.org/freeipa/ticket/3589
Enforce host existence only where needed in ipa-replica-manage

In ipa-replica-manage commands, we enforce that hostnames we work
with are resolvable. However, this caused errors while deleting
or disconnecting a ipa / winsync replica, if that replica was down
and authoritative server for itself.

Also adds an --no-lookup flag to disable host existence checks.

https://fedorahosted.org/freeipa/ticket/3524
Handle connection timeout in ipa-replica-manage

When connecting to replica, ipa-replica-manage could fail with
unknown error due to connection time out. This patch properly
handles the situation

Fixed in conjunction with https://fedorahosted.org/freeipa/ticket/3524