dnszone-remove-permission should raise error

dnszone-remove-permission should raise NotFound error if permission was
not found (regression of 21c829ff).

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: fix regression in association facet preop

Association facet specs use 'add_method' instead of 'add command'

origin: https://fedorahosted.org/freeipa/ticket/4507
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui-ci: case-insensitive record check

Indirect association are no longer lower cased, which caused a issue in CI.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
DNS: remove --class option

This option haven't been working, it is time to remove it.

Ticket: https://fedorahosted.org/freeipa/ticket/3414
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
WebUI: DNS: remove --class option

Ticket: https://fedorahosted.org/freeipa/ticket/3414
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
FIX: ldap schmema updater needs correct ordering of the updates

Required bugfix in python-ldap 2.4.15

Updates must respect SUP objectclasses/attributes and update
dependencies first

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
test_permission_plugin: Check legacy permissions

Currently a number of v2 permissions are in $SUFFIX, which the original
test did not anticipate.

Properly check that legacy permissions are found.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
upgradeinstance: Restore listeners on failure

Allow running some installation after failure,
and use this for the upgradeinstance cleanup steps.

https://fedorahosted.org/freeipa/ticket/4499

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-replica-prepare: Wait for the DNS entry to be resolvable

It takes some time after the DNS record is added until it propagates
to Bind. In automated installations, it might happen that
replica-install is attempted before the hostname is resolvable;
in that case the connection check would fail.

Wait for the name to be resolvable at the end of replica-prepare.
Mention that this can be interrupted (Ctrl+C).
Provide an option to skip the wait.

In case DNS is not managed by IPA, this reminds the admin of the necessary
configuration and checks their work, but it's possible to skip (either by
interrupting it interactively, or by the option).

https://fedorahosted.org/freeipa/ticket/4551

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix DNS plugin to allow to add root zone

Ticket: https://fedorahosted.org/freeipa/ticket/4149
Reviewed-By: Petr Spacek <pspacek@redhat.com>
DNS test: allow '.' as zone name

https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Deprecation of --name-server and --ip-address option in DNS

Option --name-server is changing only SOA MNAME, this option has no more
effect to NS records

Option --ip-addres is just ignored

A warning message is sent after use these options

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Add correct NS records during installation

All ipa-dns capable server is added to root zones as nameserver

During uninstall all NS records pointing to particular replica are
removed.

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
DNS: autofill admin email

Admins email (SOA RNAME) is autofilled with value 'hostmaster'. Bind
will automaticaly append zone part.

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
WebUI: DNS: Remove ip-address, admin-email options

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
DNS tests: tests update to due to change in options

Affected options --name-server, --ip-address

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Remove --ip-address, --name-server otpions from DNS help

Ticket: https://fedorahosted.org/freeipa/ticket/4149
Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-kdb: fix unit tests

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Move setting SELinux booleans to platform code

Create a platform task for setting SELinux booleans.

Use an exception for the case when the booleans could not be set
(since this is an error if not handled).
Since ipaplatform should not depend on ipalib, create a new
errors module in ipapython for SetseboolError.

Handle uninstallation with the same task, which means
the booleans are now restored with a single call to
setsebool.

Preparation for: https://fedorahosted.org/freeipa/ticket/4157

Fixes: https://fedorahosted.org/freeipa/ticket/2934
Fixes: https://fedorahosted.org/freeipa/ticket/2519
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
ipa-restore: Set SELinux booleans when restoring

https://fedorahosted.org/freeipa/ticket/4157

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>