No explicit zone specification.

https://fedorahosted.org/freeipa/ticket/4780

Reviewed-By: Martin Basti <mbasti@redhat.com>
Make token auth and sync windows configurable

This introduces two new CLI commands:
  * otpconfig-show
  * otpconfig-mod

https://fedorahosted.org/freeipa/ticket/4511

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Create an OTP help topic

This allows the various OTP related commands to be grouped together
in the IPA CLI documentation.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
hosts: Display assigned ID view by default in host-find and show commands

Makes ipaassignedidview a default attribute and takes care about the
conversion from the DN to the proper ID view name.

https://fedorahosted.org/freeipa/ticket/4774

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Prefer TCP connections to UDP in krb5 clients

In general, TCP is a better fit for FreeIPA due to large packet sizes.

However, there is also a specific need for TCP when using OTP. If a UDP
packet is delivered to the server and the server takes longer to process
it than the client timeout (likely), the OTP value will be resent.
Unfortunately, this will cause failures or even lockouts. Switching to
TCP avoids this problem altogether.

https://fedorahosted.org/freeipa/ticket/4725

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: fix service unprovisioning

Missed part of field refactoring caused that service could not be unprovisioned.

https://fedorahosted.org/freeipa/ticket/4770

Reviewed-By: Martin Basti <mbasti@redhat.com>
webui: increase duration of notification messages

by 66%

https://fedorahosted.org/freeipa/ticket/4792

Reviewed-By: Martin Basti <mbasti@redhat.com>
Upgrade fix: masking named should be executed only once

There was error in code, masking was executed more times, even it was
succesful

https://fedorahosted.org/freeipa/ticket/4755

Reviewed-By: David Kupka <dkupka@redhat.com>
Fix automatic CA cert renewal endless loop in dogtag-ipa-ca-renew-agent

Reset profile name after requesting the CA cert from Dogtag to prevent the
automatic renewal request from being restarted in subsequent calls.

https://fedorahosted.org/freeipa/ticket/4765

Reviewed-By: David Kupka <dkupka@redhat.com>
Do not renew the IPA CA cert by serial number in dogtag-ipa-ca-renew-agent

Always use the full CSR when renewing the IPA CA certificate with Dogtag. The
IPA CA certificate may be issued by an external CA, in which case renewal by
serial number does not make sense and will fail if the IPA CA was initially
installed as a subordinate of an external CA.

https://fedorahosted.org/freeipa/ticket/4784

Reviewed-By: David Kupka <dkupka@redhat.com>
Improve validation of --instance and --backend options in ipa-restore

https://fedorahosted.org/freeipa/ticket/4744

Reviewed-By: David Kupka <dkupka@redhat.com>
revert removal of cn attribute from idnsRecord

The removal, which was done in IPA-3.2, causes replication issues between IPA < 3.2 and IPA 4.1. Because IPA 4.1 adds two more attributes.

https://fedorahosted.org/freeipa/ticket/4794

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
test_integration: Use python-pytest-multihost

The core integration testing functionality was split into a separate
project. Use this project, and configure it for FreeIPA.

The "mh" (multihost) fixture is made available for integration tests.

Configuration based on environment variables is moved into a separate
module, to ease eventual deprecation.
test_integration: Use collect_log from the host, not the testing class

The testing class no longer has this method.
test_integration: Parametrize test instead of using a generator
Stop saving the master key in a stash file

This hasn't been used for a number of releases now, as ipa-kdb directly
fetches the key via LDAP.

Signed-off-by: Simo Sorce <simo@redhat.com>
Add test case for unsupported argument for ipa-advise

https://fedorahosted.org/freeipa/ticket/4029