webui: do not offer ipa-ad-winsync and ipa-ipa-trust range types

They are not supported by API.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Use stack allocation when writing values during otp auth

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
extdom: add support for new version

Currently the extdom plugin is basically used to translate SIDs of AD
users and groups to names and POSIX IDs.

With this patch a new version is added which will return the full member
list for groups and the full list of group memberships for a user.
Additionally the gecos field, the home directory and the login shell of a
user are returned and an optional list of key-value pairs which
currently will contain the SID of the requested object if available.

https://fedorahosted.org/freeipa/ticket/4031

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Add NSSDatabase.import_files method for importing files in various formats

The files are accepted in PEM and DER certificate, PKCS#7 certificate chain,
PKCS#8 and raw private key and PKCS#12 formats.

https://fedorahosted.org/freeipa/ticket/4480
https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
External CA installer options usability fixes

The --external_cert_file and --external_ca_file options of ipa-server-install
and ipa-ca-install have been replaced by --external-cert-file option which
accepts multiple files. The files are accepted in PEM and DER certificate and
PKCS#7 certificate chain formats.

https://fedorahosted.org/freeipa/ticket/4480

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
CA-less installer options usability fixes

The --*_pkcs12 options of ipa-server-install and ipa-replica-prepare have
been replaced by --*-cert-file options which accept multiple files.
ipa-server-certinstall now accepts multiple files as well. The files are
accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and
raw private key and PKCS#12 formats.

The --root-ca-file option of ipa-server-install has been replaced by
--ca-cert-file option which accepts multiple files. The files are
accepted in PEM and DER certificate and PKCS#7 certificate chain formats.

The --*_pin options of ipa-server-install and ipa-replica-prepare have been
renamed to --*-pin.

https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow choosing CA-less server certificates by name

Added new --*-cert-name options to ipa-server-install and ipa-replica-prepare
and --cert-name option to ipa-server-certinstall. The options allows choosing
a particular certificate and private key from PKCS#12 files by its friendly
name.

https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Do stricter validation of CA certificates

Every CA certificate must have non-empty subject and basic constraints
extension with the CA flag set.

https://fedorahosted.org/freeipa/ticket/4477

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
baseldap: Fix undefined variable reference in LDAPAddReverseMember and LDAPRemoveReverseMember
idviews: Add necessary schema for the ID views

Part of: https://fedorahosted.org/freeipa/ticket/3979
idviews: Create container for ID views under cn=accounts

Part of: https://fedorahosted.org/freeipa/ticket/3979
idviews: Add ipaAssignedIDVIew reference to the host object

Part of: https://fedorahosted.org/freeipa/ticket/3979
ipalib: Remove redundant and star imports from host plugin

Also fixes incorrect error catching for UnicodeDecodeError.

Part of: https://fedorahosted.org/freeipa/ticket/3979
ipalib: PEP8 fixes for host plugin

Part of: https://fedorahosted.org/freeipa/ticket/3979
idviews: Create basic idview plugin structure

Part of: https://fedorahosted.org/freeipa/ticket/3979
idvies: Add managed permissions for idview and idoverride objects

Part of: https://fedorahosted.org/freeipa/ticket/3979
hostgroup: Add helper that returns all members of a hostgroup

Part of: https://fedorahosted.org/freeipa/ticket/3979
hostgroup: Remove redundant and star imports

Part of: https://fedorahosted.org/freeipa/ticket/3979
hostgroup: Selected PEP8 fixes for the hostgroup plugin

Part of: https://fedorahosted.org/freeipa/ticket/3979
idviews: Add ipa idview-apply and idview-unapply commands

Part of: https://fedorahosted.org/freeipa/ticket/3979