Dogtag 10.2 to spec.file

Dogtag 10.2 is required due to support a Vault feature

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipaserver.install: Consolidate system user creation

Sytem users and their groups are always created together.
Also, users & groups should never be removed once they exist
on the system (see comit a5a55ce).

Use a single function for generic user creation, and specific
funtions in dsinstance and cainstance.
Remove code left over from when we used to delete the DS user.

Preparation for: https://fedorahosted.org/freeipa/ticket/3866

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ipa_restore: Split the services list

Make a proper list from the comma-separated string found in
the config.

The only current use of backup_services is in run:
    if 'CA' in self.backup_services:
Without this change, this picked up the 'CA' from 'MEMCACHE'.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
backup,restore: Don't overwrite /etc/{passwd,group}

The /etc/passwd and /etc/group files are not saved and restored.
The DS user is always created on restore, and the PKI user is created
if a CA is being restored.

https://fedorahosted.org/freeipa/ticket/3866

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ipa_backup: Log where the backup is be stored

This makes managing multiple backups & logs easier.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Fix certmonger code causing the ca_renewal_master update plugin to fail

https://fedorahosted.org/freeipa/ticket/4547

Reviewed-By: David Kupka <dkupka@redhat.com>
Allow RPM upgrade from ipa-* packages

https://fedorahosted.org/freeipa/ticket/4532

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Include ipaplatform in client-only build

https://fedorahosted.org/freeipa/ticket/4533

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Include the ipa command in client-only build

https://fedorahosted.org/freeipa/ticket/4536

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Set the default attributes for RootDSE

With 389 DS 1.3.3 upwards we can leverage the nsslapd-return-default-opattr
attribute to enumerate the list of attributes that should be returned
even if not specified explicitly. Use the behaviour to get the same attributes
returned from searches on rootDSE as in 1.3.1.

https://fedorahosted.org/freeipa/ticket/4288

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add basic test for backup & restore

https://fedorahosted.org/freeipa/ticket/3893

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Add test for backup/delete system users/restore

Regression test for: https://fedorahosted.org/freeipa/ticket/3866

Reviewed-By: Tomas Babej <tbabej@redhat.com>
JSON client: Log pretty-printed request and response with -vv or above

The whole HTTP request is now printed with -vvv or above.

Changes `verbose` in the connection to be the level from api.env,
rather than a boolean value.

For XML-RPC, the whole request will be shown already with -v.

https://fedorahosted.org/freeipa/ticket/4233

Reviewed-By: David Kupka <dkupka@redhat.com>
dnszone-remove-permission should raise error

dnszone-remove-permission should raise NotFound error if permission was
not found (regression of 21c829ff).

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: fix regression in association facet preop

Association facet specs use 'add_method' instead of 'add command'

origin: https://fedorahosted.org/freeipa/ticket/4507
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui-ci: case-insensitive record check

Indirect association are no longer lower cased, which caused a issue in CI.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
DNS: remove --class option

This option haven't been working, it is time to remove it.

Ticket: https://fedorahosted.org/freeipa/ticket/3414
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
WebUI: DNS: remove --class option

Ticket: https://fedorahosted.org/freeipa/ticket/3414
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
FIX: ldap schmema updater needs correct ordering of the updates

Required bugfix in python-ldap 2.4.15

Updates must respect SUP objectclasses/attributes and update
dependencies first

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
test_permission_plugin: Check legacy permissions

Currently a number of v2 permissions are in $SUFFIX, which the original
test did not anticipate.

Properly check that legacy permissions are found.

Reviewed-By: Martin Kosek <mkosek@redhat.com>