ipa-server-install Directory Manager help incorrect

https://fedorahosted.org/freeipa/ticket/4694

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipa-restore: Don't crash if AD trust is not installed

https://fedorahosted.org/freeipa/ticket/4668

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ranges: prohibit setting --rid-base with ipa-trust-ad-posix type

We should not allow setting --rid-base for ranges of ipa-trust-ad-posix since we do not perform any RID -> UID/GID mappings for these ranges (objects have UID/GID set in AD). Thus, setting RID base makes no sense.

Since ipaBaseRID is a MUST in ipaTrustedADDomainRange object class, value '0' is allowed and used internally for 'ipa-trust-ad-posix' range type.

No schema change is done.

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
unittests: baserid for ipa-ad-trust-posix idranges

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ldapupdater: set baserid to 0 for ipa-ad-trust-posix ranges

New updater plugin which sets baserid to 0 for ranges with type ipa-ad-trust-posix

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
idrange: include raw range type in output

iparangetype output is a localized human-readable value which is not suitable for machine-based API consumers

Solved by new iparangetyperaw output attribute which contains iparangetype's raw value

Reviewed-By: Tomas Babej <tbabej@redhat.com>
webui: prohibit setting rid base with ipa-trust-ad-posix type

Base RID is no longer editable for ipa-trust-ad-posix range type

Adder dialog:
- Range type selector was moved up because it affects a field above it

Details page:
- Only fields relevant to range's type are visible

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Fix CA certificate backup and restore

Backup and restore /etc/pki/ca-trust/source/ipa.p11-kit.

Create /etc/ipa/nssdb after restore if necessary.

https://fedorahosted.org/freeipa/ticket/4711

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Fix: DNS installer adds invalid zonemgr email

Installer adds zonemgr as relative (and invalid) address.
This fix force installer to use absolute email.

Ticket: https://fedorahosted.org/freeipa/ticket/4707
Reviewed-By: David Kupka <dkupka@redhat.com>
ipaplatform: Use the dirsrv service, not target

IPA only uses one instance of the directory server. When an instance
is not specified to a call to service.start/stop/restart/...,
use IPA's instance.

Stopping a systemd service is synchronous (bby default), but stopping
a target is not. This will change ensures that the directory server
is actually down when stop() finishes.

https://fedorahosted.org/freeipa/ticket/4709

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Fix: DNS policy upgrade raises asertion error

Ticket: https://fedorahosted.org/freeipa/ticket/4708
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Search using proper scope when connecting CA instances

The wrong search scope was being used when trying to determine if
a given master had a CA installed when trying to create a new
connection.

https://fedorahosted.org/freeipa/ticket/4704

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Fix upgrade referint plugin

Mixing 'Old' and 'New' attr style for referential integrity plugin causes errors.
Now old setting are migrated to new style setting before upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4622
Reviewed-By: David Kupka <dkupka@redhat.com>
Upgrade: fix trusts objectclass violationi

Execute updates in proper ordering.
Curently ldap-updater implementation doesnt allow better fix.

Ticket: https://fedorahosted.org/freeipa/ticket/4680
Reviewed-By: David Kupka <dkupka@redhat.com>
Remove unneeded internal methods. Move code to public methods.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Remove service file even if it isn't link.

(Link to) service file from /etc/systemd/system/ must be removed before masking
systemd service.

https://fedorahosted.org/freeipa/ticket/4658

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Produce better error in group-add command.

https://fedorahosted.org/freeipa/ticket/4611

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Improve otptoken help messages

https://fedorahosted.org/freeipa/ticket/4689

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Ensure users exist when assigning tokens to them

https://fedorahosted.org/freeipa/ticket/4642

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add help string on how to configure multiple DNS forwards for various cli tools

The man pages for various FreeIPA setup tools are more descriptive on how to
configure multiple DNS forwarders than the corresponding cli help. This patch
makes the cli help more verbose now for the following tools:

* ipa-dns-install
* ipa-replica-install
* ipa-server-install

https://fedorahosted.org/freeipa/ticket/4465

Reviewed-By: Martin Basti <mbasti@redhat.com>