Fix: HBAC Test tab is missing

Caused by typo in metadata provider source path.

No metadata -> no HBAC test entity -> no tab

https://fedorahosted.org/freeipa/ticket/3627
Remove leading zero from IPA_NUM_VERSION

The numeric IPA_NUM_VERSION contained a leading zero, so it was treated
as octal value in Python code instead of decimal.

https://fedorahosted.org/freeipa/ticket/3622
Set KRB5CCNAME so that dirsrv can work with newer krb5-server

The DIR ccache format is now the default in krb5-server 1.11.2-4
but /run/user/<uid> isn't created for Apache by anything so it
has no ccache (and it doesn't have SELinux permissions to write here
either).

Use KRB5CCNAME to set a file path instead in /etc/sysconfig/dirsrv.

https://fedorahosted.org/freeipa/ticket/3628
Remove redundancy from hbactest help text

I modified the SID in the second example so that result corresponds
with the 5. example.

https://fedorahosted.org/freeipa/ticket/3625
Prompt for nameserver IP address in dnszone-add

Prompt for nameserver IP address in interactive mode of dnszone-add.

Add a corresponding field to dnszone creation dialog in the web UI.

This parameter is required if and only if:
* New zone is a forward zone
* Nameserver is defined inside the new zone

Add a new unit test to cover this functionality.

https://fedorahosted.org/freeipa/ticket/3603
Add ipaUserAuthType and ipaUserAuthTypeClass

This schema addition will be useful for future commits. It allows us to
define permitted external authentication methods on both the user and
global config. The implementation is generic, but the immediate usage
is for otp support.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
Add IPA OTP schema and ACLs

This commit adds schema support for two factor authentication via
OTP devices, including RADIUS or TOTP. This schema will be used
by future patches which will enable two factor authentication
directly.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
ipa-kdb: Add OTP support

If OTP is enabled for a user, then:
  1. Long-term keys are not provided to KDB
  2. The user string 'otp' is defined to KDB

Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string to a known default
('[]') which enables the default configuration in the KDC.

https://fedorahosted.org/freeipa/ticket/3561
http://freeipa.org/page/V3/OTP
Add the krb5/FreeIPA RADIUS companion daemon

This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.

https://fedorahosted.org/freeipa/ticket/3366
http://freeipa.org/page/V3/OTP
Remove unnecessary prefixes from ipa-pwd-extop files
Add OTP support to ipa-pwd-extop

During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.

    https://fedorahosted.org/freeipa/ticket/3367
    http://freeipa.org/page/V3/OTP
Do not display success message on failure in web UI

https://fedorahosted.org/freeipa/ticket/3591
Move spec modifications from facet factories to pre_ops

Spec modifications in factories makes inheritance and extensibility more difficult.

Moving them to pre_ops allows modification of their output by other pre_ops.

https://fedorahosted.org/freeipa/ticket/3605
Unite and move facet pre_ops to related modules

Facet pre_ops defined in ./facet module were moved to modules where facet are actually defined. Moved pre_ops were united with the ones defined for the facets in these modules.

The move simplifies module dependencies - there is no reason to have general facet module dependent on specialized facet modules.

Pre_ops uniting makes the code simpler.

https://fedorahosted.org/freeipa/ticket/3605
Web UI: move ./_base/metadata_provider.js to ./metadata.js

Metadata provider is IPA specific object, not a framework object, so it should not be in _base directory.

https://fedorahosted.org/freeipa/ticket/3604
ipa-client-install: Add 'debug' and 'show' statements to nsupdate commands

https://fedorahosted.org/freeipa/ticket/3629
Relax getkeytab test to allow additional messages on stderr

https://fedorahosted.org/freeipa/ticket/3633
Handle DIR type CCACHEs in test_cmdline properly

Pass a whole krbV.CCache object to ldap2 connect() method so that
it can properly detect both type and name of a CCAHE. Otherwise
the test fails on systems with default DIR type CCACHE.
Avoid exporting KRB5_KTNAME in dirsrv env

The variable is already defined, exporting in dirsrv systemd
environment is not needed and produces a (benign) error.
CLDAP: Fix domain handling in netlogon requests

1. Stop using getdomainname() as it is often not properly initialized
2. The code using getdomainname() was not working anyway it was trying to
look at the function call output in hostname which is always empty at that
point.
3. Always check the requested domain matches our own, we cannot reply to
anything else anyway.

Pre-requisite to fix: https://fedorahosted.org/freeipa/ticket/3639

Signed-off-by: Simo Sorce <simo@redhat.com>