webui: append network.negotiate-auth.trusted-uris

https://fedorahosted.org/freeipa/ticket/4478

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
install: create ff krb extension on every install, replica install and upgrade

We don't want to copy the extension from master to replica because the
replica may use newer version of FreeIPA and therefore the extension
code might be obsolete. Same reason for upgrades.

https://fedorahosted.org/freeipa/ticket/4478

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Update qrcode support for newer python-qrcode

This substantially reduces the FreeIPA dependencies and allows
QR codes to fit in a standard terminal.

https://fedorahosted.org/freeipa/ticket/4430

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Fix typo causing ipa-upgradeconfig to fail.

Replace 'post-certsave-command' by 'cert-postsave-command'.

https://fedorahosted.org/freeipa/ticket/4529

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
webui: add measurement unit to otp token time fields

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better otp token type label

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add token from user page

Add 'Add OTP Token' action to user action menu.

This option is disabled in self-service when viewing other users.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add i18n for the rest of QR code strings

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: display fields based on otp token type

- in adder dialog

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better value-change reporting

- widget save() save method should try to always return value even if read only
- report value-change event with actual value to allow processing of the value

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: widget initialization

- used `ctor_init` instead of `init` to avoid name collision with
  existing logic
- `ctor_init` is called right after widget instantiation. Basically support
  better inheritance for the old class system which doesn't have proper
  contructors

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide empty fields and sections

Hide widgets without a value. Must be explicitly turned on. In widget by
`hidden_if_empty` flag. Or globally by `hide_empty_widgets` flag. Global
hiding can be individually turned off by `ignore_empty_hiding` flag.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide non-readable fields

hide widgets if associated field had received attribute level rights
without 'r' right.

Explicit rights are required to avoid hiding of special widgets which
are not associated with any LDAP attribute.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide otp fields based on token type

- uses hide empty feature

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Update SSL ciphers configured in 389-ds-base

use configuration parameters to enable ciphers provided by NSS
and not considered weak.
This requires 389-ds version 1.3.3.2 or later

https://fedorahosted.org/freeipa/ticket/4395

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Update referential integrity config for DS 1.3.3

Hisorically DS provided defaults for the referential
integrity plugin in nsslapd-pluginArg*:

    nsslapd-pluginarg3: member
    nsslapd-pluginarg4: uniquemember
    nsslapd-pluginarg5: owner
    nsslapd-pluginarg6: seeAlso

In 389-ds 1.3.3, the multi-valued referint-membership-attr
is used instead.

The old way still works, but it requires that the values
are numbered consecutively, so IPA's defaults that started
with 7 were not taken into account.

Convert IPA defaults to use referint-membership-attr.

https://fedorahosted.org/freeipa/ticket/4537

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Auto-add operational atttributes to read permissions

The attributes entryusn, createtimestamp, and modifytimestamp
should be readable whenever thir entry is, i.e. when we allow reading
the objectclass.
Automatically add them to every read permission that includes objectclass.

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow deleting obsolete permissions; remove operational attribute permissions

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>