Change the way we determine if the host has a password set.

When creating a host with a password we don't set a Kerberos
principal or add the Kerberos objectclasses. Those get added when the
host is enrolled. If one passed in --password= (so no password) then
we incorrectly thought the user was in fact setting a password, so the
principal and objectclasses weren't updated.

https://fedorahosted.org/freeipa/ticket/4102
sudoOrder missing in sudoers

sudoers compat plugin configuration missed the sudoOrder attribute
and it thus did not show up in ou=sudoers. Add the definion to update
file.

https://fedorahosted.org/freeipa/ticket/4107
Add missing example to sudorule

https://fedorahosted.org/freeipa/ticket/4090
Fix ipa-client-automount uninstall when fstore is empty.

https://fedorahosted.org/freeipa/ticket/4091
trust-fetch-domains: create ranges for new child domains

When trust is added, we do create ranges for discovered child domains.
However, this functionality was not available through
'trust-fetch-domains' command.

Additionally, make sure non-existing trust will report proper error in
trust-fetch-domains.

https://fedorahosted.org/freeipa/ticket/4111
https://fedorahosted.org/freeipa/ticket/4104
trustdomain-find: report status of the (sub)domain

Show status of each enumerated domain

trustdomain-find shows list of domains associated with the trust.
Each domain except the trust forest root can be enabled or disabled
with the help of trustdomain-enable and trustdomain-disable commands.

https://fedorahosted.org/freeipa/ticket/4096
CLDAP: do not prepend \\

For NETLOGON_NT_VERSION_5EX requests the prepended \\ is not expected in
the PDC NetBIOS name. In general AD seems to be smart enough to handle
the two \ signs. But if the NetBIOS name reaches the maximum of 15
character AD does not accept the responses anymore.

Fixes https://fedorahosted.org/freeipa/ticket/4028
ipaserver/install/installutils: clean up properly after yield

When a context to which we yield generates exception, the code in
private_ccache() and stopped_service() didn't get called for cleanup.
Do not start the service in stopped_service if it was not running before.

This fixes a possible NSS database corruption in renew_ca_cert.
Harmonize policy discovery to kdb driver

The KDB driver does not walk the tree back like the original password plugin.
Also we do not store the default policy in the base DN as we used to do in the
past anymore.
So doing a full subtree search and walking back the tree is just a waste of
time.
Instead hardcode the default policy like we do in the kdb driver.

Fixes: https://fedorahosted.org/freeipa/ticket/4085
Stop adding a default password policy reference

Both the password plugin and the kdb driver code automatically fall
back to the default password policy.
so stop adding an explicit reference to user objects and instead rely on the
fallback.
This way users created via the framework and users created via winsync plugin
behave the same way wrt password policies and no surprises will happen.

Also in case we need to change the default password policy DN this will allow
just code changes instead of having to change each user entry created, and
distinguish between the default policy and explicit admin changes.

Related: https://fedorahosted.org/freeipa/ticket/4085

Patch backported/updated by Martin Kosek to accomodate different ipatests
structure in ipa-3-3 branch.