webui: improve usability of attributes widget

Attributes widget layour was changed from tiny table which allowed
to display only few options to a checkbox list with multiple
columns (depends on container).

Check all attributes option was removed to force the user
to read through the attributes which he selects.

Initial version authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add filter to attributes widget

Adds filter field to attribute box in permissions for better user
experience. User can then quickly find the desired attribute.

Initial version of the patch authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: optimize (re)creation of option widget

There is a case where attributes widget can contain > 1000 items.
It's about 3000 nodes. It's slow in jQuery. Simple move to dojo
speeds it up (is closer to native calls) while maintaining developer
friendliness.

Now the biggest lag is in browser's render. It's probably not worth
developer time to optimize that.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: custom attr in attributes widget

Web UI doesn't always know what are the possible attributes
for target object. This will allow to add custom attributes
if necessary.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: attr widget: get list of possible attrs from ipapermdefaultattr

Very useful for managed permissions since the list of attrs in metadata
might be smaller that default attributes. This smooths behavior if one
removes an attr from effective attrs which is not in metadata. Without
this it will disappear from the list and one has to add it manually
through 'Add'.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: option_widget_base: sort options

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: reflect readonly state

Separate update of read-only state from update of value.

It should be possible to switch from read-only UI to editable UI without
value change.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: fix add of input group class

The input-group class was added based on visibility of child elements.

This failed when it had to be determined *before* displaying the widget.

Now it's added if the buttons are not hidden by `display: none` CSS rule.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: show managed fields as readonly and not disabled

Visible read-only fields are no longer displayed as disabled in
permission details facet.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: fix selection of empty value in a select widget

Little regression - select widget could not handle empty or no array as an
input value.

It broke 'undo' operation in Permissions' 'Type' attribute while switching
between '' and some value.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: disable ipapermbindruletype if permission in a privilege

User is not able to change Bind Rule Type if permission is already
member of a privilege. Let's disable it and don't confuse user.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: fix disabled state of service's PAC type

Nested options (MS-PAC and PAD) of service's PAC type should be
disabled if no value is supplied (default value is "Inherited
from server configuration"). That was not the case - regression.

This patch fixes it and along with it simplifies the update method
of option_widget_base to be more comprehensible.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Fix login password expiration detection with OTP

The preexisting code would execute two steps. First, it would perform a kinit.
If the kinit failed, it would attempt to bind using the same credentials to
determine if the password were expired. While this method is fairly ugly, it
mostly worked in the past.

However, with OTP this breaks. This is because the OTP code is consumed by
the kinit step. But because the password is expired, the kinit step fails.
When the bind is executed, the OTP token is already consumed, so bind fails.
This causes all password expirations to be reported as invalid credentials.

After discussion with MIT, the best way to handle this case with the standard
tools is to set LC_ALL=C and check the output from the command. This
eliminates the bind step altogether. The end result is that OTP works and
all password failures are more performant.

https://fedorahosted.org/freeipa/ticket/4412

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Update freeipa-server krb5-server dependency to 1.11.5-5

Previous versions of libkrb5 can't handle expired passwords
inside the FAST tunnel. This breaks the password change UI
in FreeIPA.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Always record that pkicreate has been executed.

Record that pkicreate/pkispawn has been executed to allow cleanup even if the
installation did not finish correctly.

https://fedorahosted.org/freeipa/ticket/2796

Reviewed-By: Martin Kosek <mkosek@redhat.com>
baseldap: Remove redundant search from LDAPAddReverseMember and LDAPRemoveReverseMember

Reviewed-By: Jan Cholasta <jcholast@redhat.com>