ipatests: Fix incorrect order of operations when restoring backup

When restoring files from backup, we do use an incorrect order of
operations - we first restore SELinux context and then copy the
files from backup, when we need to do the exact opposite.

https://fedorahosted.org/freeipa/ticket/4133

Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
bindinstance: make sure zone manager is initialized in add_master_dns_records

Bind instance is configured using a short-circuited way when replica is set up.
Make sure required properties are in place for that.

https://fedorahosted.org/freeipa/ticket/4186

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipa-kdb: in case of delegation use original client's database entry, not the proxy

https://fedorahosted.org/freeipa/ticket/4195

Reviewed-By: Tomáš Babej <tbabej@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
ipa-kdb: make sure we don't produce MS-PAC in case of authdata flag cleared by admin

When admin clears authdata flag for the service principal, KDC will pass
NULL client pointer (service proxy) to the DAL driver.

Make sure we bail out correctly.

Reviewed-By: Tomáš Babej <tbabej@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
trustdomain_find: make sure we skip short entries when --pkey-only is specified

With --pkey-only only primary key is returned. It makes no sense to check and
replace boolean values then.

https://fedorahosted.org/freeipa/ticket/4196

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Too big font in input fields

In Firefox 27, default font size has bigger priority than body css,
text input font size is therefore explicitly set to 1em. Also
checkbox/radiobutton styling fixed.

https://fedorahosted.org/freeipa/ticket/4180

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
trust: make sure we always discover topology of the forest trust

Even though we are creating idranges for subdomains only in case
there is algorithmic ID mapping in use, we still need to fetch
list of subdomains for all other cases.

https://fedorahosted.org/freeipa/ticket/4205
ipaserver/dcerpc: catch the case of insuffient permissions when establishing trust

We attempt to delete the trust that might exist already. If there are not enough
privileges to do so, we wouldn't be able to create trust at the next step and it will fail.
However, failure to create trust will be due to the name collision as we already had
the trust with the same name before. Thus, raise access denied exception here
to properly indicate wrong access level instead of returning NT_STATUS_OBJECT_NAME_COLLISION.

https://fedorahosted.org/freeipa/ticket/4202

Reviewed-By: Martin Kosek <mkosek@redhat.com>