Don't add another nsDS5ReplicaId on updates if one already exists

Modify update file to use default: rather than add: in
cn=replication,cn=etc,$SUFFIX.

Drop quotes around nsDS5ReplicaRoot because default: values
are not parsed as CSV.

https://fedorahosted.org/freeipa/ticket/3394
Take into consideration services when deleting replicas

When deleting a replica from IPA domain:
* Abort if the installation is about to be left without CA
* Warn if the installation is about to be left without DNS

Ticket: https://fedorahosted.org/freeipa/ticket/2879
Add LDAP server fallback to client installer

Change the discovery code to validate all servers, regardless of where
the originated (either via SRV records or --server). This will prevent
the client installer from failing if one of those records points to a
server that is either not running or is not an IPA server.

If a server is not available it is not removed from the list of configured
servers, simply moved to the end of the list.

If a server is not an IPA server it is removed.

https://fedorahosted.org/freeipa/ticket/3388
Raise ValidationError on invalid CSV values.

https://fedorahosted.org/freeipa/ticket/3323
Prevent integer overflow when setting krbPasswordExpiration

Since in Kerberos V5 are used 32-bit unix timestamps, setting
maxlife in pwpolicy to values such as 9999 days would cause
integer overflow in krbPasswordExpiration attribute.

This would result into unpredictable behaviour such as users
not being able to log in after password expiration if password
policy was changed (#3114) or new users not being able to log
in at all (#3312).

The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver.

https://fedorahosted.org/freeipa/ticket/3312
https://fedorahosted.org/freeipa/ticket/3114
Prevent a crash when no entries are successfully migrated.

It would fail in _update_default_group() because migrate_cnt wasn't
defined in context.

https://fedorahosted.org/freeipa/ticket/3386
Fix permission_find test error

Remove extraneous memberindirect_role attribute from permission_find
unit test to avoid false negative test result.
Add trusconfig-show and trustconfig-mod commands

Global trust configuration is generated ipa-adtrust-install script
is run. Add convenience commands to show auto-generated options
like SID or GUID or options chosen by user (NetBIOS). Most of these
options are not modifiable via trustconfig-mod command as it would
break current trusts.

Unit test file covering these new commands was added.

https://fedorahosted.org/freeipa/ticket/3333
ipa-kdb: add sentinel for LDAPDerefSpec allocation

Without sentinel in place, ldap_create_deref_control_value executed
an invalid read in unallocated memory.
ipa-kdb: avoid ENOMEM when all SIDs are filtered out

When all SIDs in info3.sids structure were filtered out, we tried
to talloc_realloc to zero memory size. talloc_realloc then returned
NULL pointer and filter_login_info returned with ENOMEM.

The code now rather frees the SID array and set info3.sidcount to
correct value.
ipa-kdb: reinitialize LDAP configuration for known realms

ipa-kdb did not reinitialize trusted domain configuration when it
was loaded to ipa-kdb. However, admin then would have to restart
krb5kdc if he wanted to apply the change to running krb5kdc service.

Run ipadb_reinit_mspac unconditionally every time when trusted domain
is loaded. Among the already configured 1 minute grace time, also
add a quick check if there is at least one configured trusted domain
before reinitializing the mspac structure.

https://fedorahosted.org/freeipa/ticket/3289
Add SID blacklist attributes

Update our LDAP schema and add 2 new attributes for SID blacklist
definition. These new attributes can now be set per-trust with
trustconfig command.

https://fedorahosted.org/freeipa/ticket/3289
ipa-kdb: read SID blacklist from LDAP

SIDs in incoming MS-PAC were checked and filtered with a fixed list of
well-known SIDs. Allow reading the SID blacklist from LDAP
(ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list
to mspac adtrust structure. Use the hardcoded SID list only if the LDAP
SID list is not configured.

LIMITATION: SID blacklist list is not used yet.

https://fedorahosted.org/freeipa/ticket/3289
ipa-sam: Fill SID blacklist when trust is added

Fill incoming and outgoing trust LDAP entry with default SID
blacklist value.

https://fedorahosted.org/freeipa/ticket/3289
ipa-adtrust-install should ask for SID generation

When ipa-adtrust-install is run, check if there are any objects
that need have SID generated. If yes, interactively ask the user
if the sidgen task should be run.

https://fedorahosted.org/freeipa/ticket/3195