webui-build: use /usr/share/java/js.jar instead of rhino.jar

/usr/share/java/rhino.jar is a Fedora's symlink to /usr/share/java/js.jar

Debian doesn't have it. Direct usage of upstream /usr/share/java/js.jar should
work on both systems.

Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration

When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
ipalib: Use DateTime parameter class for OTP token timestamp attributes

For ipatokennotbefore and ipatokennotafter attributes use DateTime
parameter class instead of Str, since these are represented as
LDAP Generalized Time in LDAP.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
webui: change ipatokennotbefore and ipatokennotafter types to datetime

https://fedorahosted.org/freeipa/ticket/3369

Reviewed-By: Martin Kosek <mkosek@redhat.com>
test_ipagetkeytab: Fix expected error message

Reviewed-By: Martin Kosek <mkosek@redhat.com>
test_ipaserver: Add OTP token test data to ipatests package

The missing files caused test failures when running tests out of tree.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Non IDNA zonename should be normalized to lowercase

Before IDNA support zone was normalized.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix tests dns_realmdomains_integration

Added warning message about forwarders

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add Modify Realm Domains permission

The permission is required for DNS Administrators as realm domains
object is updated when a master zone is added.

https://fedorahosted.org/freeipa/ticket/4423

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix: Missing ACI for records in 40-dns.update

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Restore privileges after forward zones update

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
ldapupdate: Restore 'replace' functionality

The replace directive was made a no-op by mistake in commit 6381d76.
Restore it.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow read access to services in cn=masters to auth'd users

https://fedorahosted.org/freeipa/ticket/4425

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow to add managed permission for reverse zones

Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
webui: new navigation structure

https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Test DNS: test zone normalization

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Test DNS: TLSA record

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Test DNS: add zone with consecutive dash characters

Test for ticket: https://fedorahosted.org/freeipa/ticket/4268

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Prepare spec for 4.0 release

- Bump 389-ds-base requires to fix the deref call with new ACIs:
  https://fedorahosted.org/freeipa/ticket/4389
- Bump bind-dyndb-ldap Conflicts to fetch the DNSSEC capability
- Bump selinux-policy to fix the CRL retrieval:
  https://fedorahosted.org/freeipa/ticket/4369
- Remove conditionals for Fedora < 20 as FreeIPA 4.0 is not planned
  to be released on these platforms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
makeaci: Use the DN where the ACI is stored, not the permission's DN

Reviewed-By: Martin Basti <mbasti@redhat.com>