Fixed Web UI build error caused by rhino changes in F19

rhino-1.7R4-2.fc19.noarch dropped -main flag which made the build fail in rawhide (F19).

We can't use the same command for rhino-1.7R3-6 (F18) and rhino-1.7R4-2 (F19).
This patch adds check if rhino supports '-require' option. If so it calls rhino with it if not it calls rhino with -main option.

https://fedorahosted.org/freeipa/ticket/3501
Add DNS Setup Prompt to Install

Currently the only way to setup integrated DNS is by passing --setup-dns
to ipa-server-install. This patch modifies install so that if
--setup-dns is not passed, the user is asked if they want to configure
integrated dns.

http://fedorahosted.org/freeipa/ticket/2575
Use temporary CCACHE in ipa-client-install

ipa-client-install failed if user had set his own KRB5CCNAME in his
environment. Use a temporary CCACHE for the installer to avoid these
kind of errors.

https://fedorahosted.org/freeipa/ticket/3512
Improve client install LDAP cert retrieval fallback

CA certificate retrieval function did not fallback from LDAP to
HTTP based retrieval in case of an LDAP error, when for example
GSSAPI authentication failed.

https://fedorahosted.org/freeipa/ticket/3512
Process exceptions when talking to Dogtag

The problem is the ca_status() uses an HTTP GET operation to check Dogtag's
status. Under some circumstances Dogtag may take a long time to respond, so the
HTTP GET may time out much earlier than 2 minutes. And since the above code
doesn't catch the exception, the whole loop fails immediately, so it doesn't
wait for a full 2 minutes as expected.

https://fedorahosted.org/freeipa/ticket/3492
Fix lockout of LDAP bind.

There were several problems:

- A cut-n-paste error where the wrong value was being considered when
  an account was administratively unlocked.
- An off-by-one error where LDAP got one extra bind attempt.
- krbPwdPolicyReference wasn't being retrieved as a virtual attribute so
  only the global_policy was used.
- The lockout duration wasn't examined in the context of too many failed
  logins so wasn't being applied properly.
- Lockout duration wasn't used properly so a user was effectively unlocked
  when the failure interval expired.
- krbLastFailedAuth and krbLoginFailedCount are no longer updated past
  max failures.

https://fedorahosted.org/freeipa/ticket/3433
Add 389 DS plugin for special idnsSOASerial attribute handling

Default value "1" is added to replicated idnsZone objects
if idnsSOASerial attribute is missing.

https://fedorahosted.org/freeipa/ticket/3347

Signed-off-by: Petr Spacek <pspacek@redhat.com>
Configure ipa_dns DS plugin on install and upgrade

The plugin is configured unconditionally (i.e. does not check if
IPA was configured with DNS) as the plugin is needed on all
replicas to prevent objectclass violations due to missing SOA
serial in idnsZone objectclass. The violation could happen if just
one replica configured DNS and added a new zone.

https://fedorahosted.org/freeipa/ticket/3347
Use default NETBIOS name in unattended ipa-adtrust-install

Unattended ipa-adtrust-install used to fail if --netbios option
was not provided. This patches fixes this, so that instead of
failing the default NETBIOS name is used.

https://fedorahosted.org/freeipa/ticket/3497
Fix structured DNS record output

Recent LDAP refactoring replaced entry_attrs regular dict with
normalized keys (i.e. lowercase) with LDAPEntry instance which keys
may not be normalized. This broke CND command output when
--structured and --all options were used.

Force lowercase normalization of the LDAPEntry keys in DNS plugin
structured format postprocessing. Also add a missing test for
DNS record structured output.

https://fedorahosted.org/freeipa/ticket/3526
Allow host re-enrollment using delegation

A new option --force-join has been added to ipa-client-install.
It forces the host enrollment even if the host entry exists.
Old certificate is revoked, new certificate and ssh key pair
generated. See the relevant design for the re-enrollment part:
http://freeipa.org/page/V3/Forced_client_re-enrollment

https://fedorahosted.org/freeipa/ticket/3482
Add logging to join command

The following is mentioned in the log now:
  - existence of host entry (if it already does exist)
  - missing krbprincipalname and its new value (if there was no
    principal name set)

https://fedorahosted.org/freeipa/ticket/3481
Bump selinux-policy requires

The higher version is reported to fix a Fedora 17 to 18 upgrade issue.

https://fedorahosted.org/freeipa/ticket/3399
Add mkhomedir option to ipa-server-install and ipa-replica-install

Add the option to create home directories for users on their
first login to ipa-server-install and ipa-replica-install.

https://fedorahosted.org/freeipa/ticket/3515
Add support for cmocka C-Unit Test framework

cmocka is a more advanced unit test framework for C-code than the
currently used check framework. This patch adds configure checks and
makefile variables so that new unit tests can use cmocka.

Fixes https://fedorahosted.org/freeipa/ticket/3434
Clean spec file for Fedora 19

This patch includes several cleanups needed for Fedora 19 build:
* ipa-kdb is compatible with both krb5 1.10 and 1.11 which contains
  an updated DAL interface. Remove the conflict from spec file.
* Fix ipa-ldap-updater call to produce errors only to avoid
  cluttering rpm update output
* Remove httpd_conf constant which was not used

https://fedorahosted.org/freeipa/ticket/3502
Remove build warnings

Fix rpm build warnings report in Fedora 19 build.

https://fedorahosted.org/freeipa/ticket/3500
Remove syslog.target from ipa.server

This required target is no longer needed as systemd from version 38
has its own journal which is also in the basic set of service unit
requirementes.

https://fedorahosted.org/freeipa/ticket/3511
Put pid-file to named.conf

Fedora 19 has splitted /var/run and /run directories while in Fedora
18 it used to be a symlink. Thus, named may expect its PID file to be
in other direct than it really is and fail to start.

Add pid-file configuration option to named.conf both for new
installations and for upgraded machines.
Update mod_wsgi socket directory

Fedora 19 splitted /var/run and /run directories. Update mod_wsgi
configuration so that it generates its sockets in the right one.