Remove NSEC3PARAM record

Revert 5b95be802c6aa12b9464813441f85eaee3e3e82b

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Add NSEC3PARAM to zone settings

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
NSEC3PARAM tests

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}

The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Do not fail if there are multiple nsDS5ReplicaId values in cn=replication,cn=etc

On systems installed before #3394 was fixed and nsDS5ReplicaId became
single-valued, there are two replica ID values stored in cn=replication:
the default (3) and the actual value we want.
Instead of failing when multiple values are found, use the largest one.

https://fedorahosted.org/freeipa/ticket/4375

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Clear NSS session cache when socket is closed

Even when NSS connection is closed, there may be still cached
certificates in the NSS lib. This may cause subsequent NSS
initialization to crash. This problem especially reproduces in the
unit tests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow to add non string values to named conf

Non string values should not start and end with '"' in options section
in named.conf

Required by ticket: https://fedorahosted.org/freeipa/ticket/4408

Reviewed-By: Petr Spacek <pspacek@redhat.com>
DNSSEC: Add experimental support for DNSSEC

Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Add warning about semantic change for zones

--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Add DNSSEC experimental support warning message

Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Use documentation addresses in dns help

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Help for forward zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Split dns docstring

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix upgrade to forward zones

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix incompatible permission name *zone-del

Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
webui-build: use /usr/share/java/js.jar instead of rhino.jar

/usr/share/java/rhino.jar is a Fedora's symlink to /usr/share/java/js.jar

Debian doesn't have it. Direct usage of upstream /usr/share/java/js.jar should
work on both systems.

Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration

When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
ipalib: Use DateTime parameter class for OTP token timestamp attributes

For ipatokennotbefore and ipatokennotafter attributes use DateTime
parameter class instead of Str, since these are represented as
LDAP Generalized Time in LDAP.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
webui: change ipatokennotbefore and ipatokennotafter types to datetime

https://fedorahosted.org/freeipa/ticket/3369

Reviewed-By: Martin Kosek <mkosek@redhat.com>
test_ipagetkeytab: Fix expected error message

Reviewed-By: Martin Kosek <mkosek@redhat.com>