ipalib: idrange: Make non-implemented range types fail the validation

The ipa-ipa-trust and ipa-ad-winsync ID Range types were allowed to
pass the validation tests, however, they are not implemented nor
checked by the 389 server plugin.

https://fedorahosted.org/freeipa/ticket/4323

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Update API.txt

Additional fix for https://fedorahosted.org/freeipa/ticket/4323
Fix DNS upgrade plugin should check if DNS container exists

Fortunately this cause no error, because dnszone-find doesnt raise
exception if there is no DNS container

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
FIX: named_enable_dnssec should verify if DNS is installed

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Check if /root/ipa.csr exists when installing server with external CA.

Remove the file on uninstall.

https://fedorahosted.org/freeipa/ticket/4303

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Exclude attributelevelrights from --raw result processing in baseldap.

https://fedorahosted.org/freeipa/ticket/4371

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Fix group-remove-member crash when group is removed from a protected group

https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Martin Kosek <mkosek@redhat.com>
test group: remove group from protected group.

Related to https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Verify otptoken timespan is valid

When creating or modifying otptoken check that token validity start is not after
validity end.

https://fedorahosted.org/freeipa/ticket/4244

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Do not crash client basedn discovery when SSF not met

ipa-client-install runs anonymous search in non-rootdse space which
may raise UNWILLING_TO_PERFORM error. This case was only covered for
BIND, but not for the actual LDAP queries.

https://fedorahosted.org/freeipa/ticket/4459

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
test_ipagetkeytab: Fix assertion in negative test

The ipagetkeytab command recently changed its failure output
to accomodate pre-4.0 servers.
Update the test to reflect this.

Related: https://fedorahosted.org/freeipa/ticket/4446
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add function for checking if certificate is self-signed to ipalib.x509.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Support CA certificate renewal in dogtag-ipa-ca-renew-agent.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Allow IPA master hosts to update CA certificate in LDAP.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Automatically update CA certificate in LDAP on renewal.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Track CA certificate using dogtag-ipa-ca-renew-agent.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Add method for setting CA renewal master in LDAP to CAInstance.

Allow checking and setting CA renewal master for non-local CA instances.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Provide additional functions to ipapython.certmonger.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Move external cert validation from ipa-server-install to installutils.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Add method for verifying CA certificates to NSSDatabase.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>