Fallback to global policy in ipa-lockout plugin

krbPwdPolicyReference is no longer filled default users. Instead, plugins
fallback to hardcoded global policy reference.

Fix ipa-lockout plugin to fallback to it instead of failing to apply
the policy.

https://fedorahosted.org/freeipa/ticket/4085
ipa-lockout: do not fail when default realm cannot be read

When ipa-lockout plugin is started during FreeIPA server installation,
the default realm may not be available and plugin should then not end
with failure.

Similarly to other plugins, start in degraded mode in this situation.
Operation is fully restored during the final services restart.

https://fedorahosted.org/freeipa/ticket/4085
integration tests OpenSSHTransport: Expand tilde to home in root_ssh_key_filename

Expand paths beginning with a tilde, such as the default ~/.ssh/id_rsa,
to the home directory.

https://fedorahosted.org/freeipa/ticket/4115
ipa tool: Print the name of the server we are connecting to with -v

The logging level for these messages was decreaed so that they
do not show up in ipa-advise output.
Reset the log level to INFO and configure ipa-advise to not display
INFO messages from xmlclient by default.

Partially reverts commit efe5a96725d3ddcd05b03a1ca9df5597eee693be

https://fedorahosted.org/freeipa/ticket/4135

Reviewed-By: Tomáš Babej <tbabej@redhat.com>
ipatests: test_legacy_clients: Change "test group" to "testgroup"

The integration test for legacy clients used incorrectly "test group"
instead of "testgroup" as group used on AD for test purposes. This
is inconsistent with the usage of "testuser".

https://fedorahosted.org/freeipa/ticket/4131

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Add records for all hosts in master's domain

All the hosts in the domain have IPA master set as their only
nameserver. However, the IPA master does not create records for
these machines by default. This is not an big issue for clients
or replicas, since those records do get created in other ways,
but external hosts using their internal hostnames will not resolve.

Adds an A record for each host in master's domain.

https://fedorahosted.org/freeipa/ticket/4130

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Run restoring backup files and restoring their context in one session

Restoring backup files and restoring their context were two separate commands,
what means that in case we use SSHTrasport, which creates a separate SSH
session for each command, we try to restore the SELinux context of the
changed files in a new session.

This causes problems, if the access to files themselves are necessary
for the creation of the new SSH session.

https://fedorahosted.org/freeipa/ticket/4133

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Migration does not add users to default group

When users with missing default group were searched, IPA suffix was
not passed so these users were searched in a wrong base DN. Thus,
no user was detected and added to default group.

https://fedorahosted.org/freeipa/ticket/4141

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Remove sourcehostcategory from the default HBAC rule.

https://fedorahosted.org/freeipa/ticket/4158

Reviewed-By: Martin Kosek <mkosek@redhat.com>