Typo in warning message where IPA realm and domain name differ

Removed 'y' from warning message.

https://fedorahosted.org/freeipa/ticket/4211

Reviewed-By: Simo Sorce <ssorce@redhat.com>
webui: Don't act on keyboard events which originated in different dialog

Fixes issue when:
1. 2 dialogs are opened
2. top dialog's close button is focused
3. user presses enter to execute 'close' action
4. dialog is immediately closed (enter key is still pressed)
5. second dialog automatically receives focus (it's top dialog now)
6. user releases the key
7. second dialog reacts to keyup event - which is by default confirmation mixin's confirm event
8. UNDESIRED behavior occurs

Now confirmation mixin remembers which keys were pressed and released and reacts only to those which originated there.

https://fedorahosted.org/freeipa/ticket/4098

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
test_integration.config: Fix crash in to_env when no replica is defined

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Do not save the input environment

Using the input environment saved in self._session_env
outside of the config loading meant that methods of
configuration other than environment variables wouldn't
be possible.

Restructure the roles/extra_roles to not depend on _session_env.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3938

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Use a more declarative approach to test-wide settings

The list of options was duplicated too many times. Consolidate.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3938

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Do not store the index in Domain and Host objects

The index is a detail of the environment variable method of
configuration, it should only be used there.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Load/store from/to dicts

Part of the work for: https://fedorahosted.org/freeipa/ticket/3938

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Add environment variables for JSON/YAML

Part of the work for: https://fedorahosted.org/freeipa/ticket/3938

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ipa-test-config: Add --json and --yaml output options

Also update the man page.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3938

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_integration.config: Convert some text values to str

When loading from file, some strings are loaded as unicode,
which would throw off assert_deepequal.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Add tests for integration test configuration

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Rework how otptoken defaults are handled

We had originally decided to provide defaults on the server side so that they
could be part of a global config for the admin. However, on further reflection,
only certain defaults really make sense given the limitations of Google
Authenticator. Similarly, other defaults may be token specific.

Attempting to handle defaults on the server side also makes both the UI and
the generated documentation unclear.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Fix token secret length RFC compliance

RFC 4226 states the following in section 4:
   R6 - The algorithm MUST use a strong shared secret.  The length of
   the shared secret MUST be at least 128 bits.  This document
   RECOMMENDs a shared secret length of 160 bits.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
fix filtering of subdomain-based trust users

https://fedorahosted.org/freeipa/ticket/4207

Reviewed-By: Simo Sorce <ssorce@redhat.com>
man: sshd should be run at least once before client enrollment

If SSH keys have not been generated prior to enrolling the client to the
IPA server, they will not be uploaded to the server, since they're not
present. Clarify this issue in the man pages.

https://fedorahosted.org/freeipa/ticket/4055

Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
ipalib.plugable: Always set the parser in bootstrap()

In cases where logging was already configured by the time
API.bootstrap() was called, saving the argument parser was
mistakenly skipped along with the logging configuration.

Always set the argument parser on the API object.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
tests: Create the testing service certificate on demand

Replace the make-testcert command with a module that creates
the certificate when it is first needed.
As a result the tests are more self-contained, and can be run from
a read-only location (such as installed from a system package).

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipa-kdb: do not fetch client principal if it is the same as existing entry

When client principal is the same as supplied client entry, don't fetch it
again.

Note that when client principal is not NULL, client entry might be NULL for
cross-realm case, so we need to make sure to not dereference NULL pointer here.

Also fix reverted condition for case when we didn't find the client principal
in the database, preventing a memory leak.

https://fedorahosted.org/freeipa/ticket/4223

Reviewed-By: Sumit Bose <sbose@redhat.com>
permission-mod: Remove attributelevelrights before reverting entry

LDAPUpdate adds the display-only 'attributelevelrights' attribute,
which doesn't exist in LDAP. Remove it before reverting entry.

https://fedorahosted.org/freeipa/ticket/4212

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Allow multiple values for memberof

Design: http://www.freeipa.org/page/V3/Multivalued_target_filters_in_permissions
Additional fix for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek <mkosek@redhat.com>