Make ipa-client-automount backwards compatible

ipa-client-automount calls automountlocation-show command during the
process. Unfortunately, FreeIPA commands are forward compatible only
and thus fail the installer.

Similarly to ipa-client-install, call XML-RPC interface directly
with version fixed to 2.0 (command was already available at that
version) to fix the failure.

https://fedorahosted.org/freeipa/ticket/4290

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
webui: field and widget binding refactoring

This is a Web UI wide change. Fields and Widgets binding was refactored
to enable proper two-way binding between them. This should allow to have
one source of truth (field) for multiple consumers - widgets or something
else. One of the goal is to have fields and widget implementations
independent on each other. So that one could use a widget without field
or use one field for multiple widgets, etc..

Basically a fields logic was split into separate components:
- adapters
- parsers & formatters
- binder

Adapters
- extract data from data source (FreeIPA RPC command result)
- prepares them for commands.

Parsers
- parse extracted data to format expected by field
- parse widget value to format expected by field

Formatters
- format field value to format suitable for widgets
- format field value to format suitable for adapter

Binder
- is a communication bridge between field and widget
- listens to field's and widget's events and call appropriate methods

Some side benefits:
- better validation reporting in multivalued widget

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui: replace widget's hidden property with visible

Hidden was used only in ACI. There is no reason to have two properties
which are negations of each other.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui: change widget updated event into value change event

This change allow us to use proper two way binding between a field and
a widget. In previous implementation field was not changed if something
changed the value of a widget in 'update'. Now listeners are notified
when the widget value is changed by: calling 'update', 'set_value'
or by user change.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui-tests: binding test suite

Add basic tests for two-way binding between a field and two widgets

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
schema-compat: set precedence to 49 to allow OTP binds over compat tree

schema-compat plugin rewrites bind DN to point to the original entry
on LDAP bind operation. To work with OTP tokens this requires that
schema-compat's pre-bind callback is called before pre-bind callback of
the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have
a nsslapd-pluginprecedence value lower than (default) 50 which is used
by the ipa-pwd-extop plugin.

Note that this will only work if ticket 47699 is fixed in 389-ds.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
freeipa.spec.in: update dependencies to 389-ds and selinux-policy

389-ds-base 1.3.2.16 implements reordering of sub-plugins based on the
ordering of the main plugin. We need it to make OTP working over
compat tree.

selinux-polic 3.12.1-135 fixes issues which prevented httpd to work
with kernel keyring-based credentials caches.

This change is Fedora 20+.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Add wait_for_dns option to default.conf.

This option makes record changes in DNS tree synchronous.
IPA calls will wait until new data are visible over DNS protocol
or until timeout.

It is intended only for testing. It should prevent tests from
failing if there is bigger delay between changes in LDAP and DNS.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Make sure that remnants of PKI are removed

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: legacy_clients: Use hostname instead of external hostname for AD subdomain

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: legacy_clients: Relax regex checks

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cache

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master