Fix dnsrecord-mod raise error if last record attr is removed

Removing last record attribute causes output type validation error

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Use certmonger D-Bus API instead of messing with its files.

FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.

>=certmonger-0.75.13 is needed for this to work.

https://fedorahosted.org/freeipa/ticket/4280

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
DNSSEC: fix DS record validation

Part of: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Tests: DNS dsrecord validation

Part of: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
DNS fix NS record coexistence validator

NS can coexistent only with A, AAAA, DS, NS record

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Test: DNS NS validation

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Fix DNS record rename test

bind-dyndb-ldap's bug caused test failure
https://fedorahosted.org/bind-dyndb-ldap/ticket/123

Owners with NS record works with the bug

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
FIX DNS wildcard records (RFC4592)

Make validation more strict

* DS, NS, DNAME owners should not be a wildcard domanin name
* zone name should not be a wildcard domain name

Ticket: https://fedorahosted.org/freeipa/ticket/4488
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Tests: DNS wildcard records

Ticket: https://fedorahosted.org/freeipa/ticket/4488
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Do not restart apache server when not necessary.

https://fedorahosted.org/freeipa/ticket/4352

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add managed read permissions for compat tree

https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Make CA-less ipa-server-install option --root-ca-file optional.

The CA cert specified by --root-ca-file option must always be the CA cert of
the CA which issued the server certificates in the PKCS#12 files. As the cert
is not actually user selectable, use CA cert from the PKCS#12 files by default
if it is present.

Document --root-ca-file in ipa-server-install man page.

https://fedorahosted.org/freeipa/ticket/4457

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow user to force Kerberos realm during installation.

User can set realm not matching one resolved from DNS. This is useful especially
when DNS is missconfigured.

https://fedorahosted.org/freeipa/ticket/4444

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
webui: extract complex pkey on Add and Edit

DNS zone 'Add and Edit' failed because of new DNS name encoding.

This patch makes sure that keys are extracted properly.

https://fedorahosted.org/freeipa/ticket/4520

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Fix: Add managed read permissions for compat tree and operational attrs

This is a fix for an earlier version, which was committed by mistake as:
master: 418ce870bfbe13cea694a7b862cafe35c703f660
ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17
ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7

Thanks to Alexander Bokovoy for contributions

https://fedorahosted.org/freeipa/ticket/4521
Backup CS.cfg before modifying it

https://fedorahosted.org/freeipa/ticket/4166

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
No longer generate a machine certificate on client installs

https://fedorahosted.org/freeipa/ticket/4449

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
webui: adjust behavior of bounce url

- bounce url param was renamed from 'redirect' to 'url'
- support for 'delay' param added

Behavior:

- "Continue to next page" link is shown if 'url' is present
- page is no longer automatically redirected if 'url' is present
- automatic redirect is controlled by 'delay' param - it specifies
  number of seconds until redirection
- info message 'You will be redirected in Xs' is show to notify
  the user that something will happen. It's useful even if delay
  is 0 or negative because redirection might be slow.
- counter is decremented every second
- delay is ignored if parsed as NaN

https://fedorahosted.org/freeipa/ticket/4440

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: do not show login error when switching back from otp sync screen

Errors should reflect only a result of last operation.

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: switch associators if default doesn't work

Make association auto-magic little bit less stupid. Now it supports
adding of new attribute member with add_member and remove_member
methods only on one side of the relationship.

https://fedorahosted.org/freeipa/ticket/4507

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>