User Life Cycle: DNA scopes full SUFFIX

In patch 0001-3, the DNA plugins configuration was changed to scope only 'cn=accounts,SUFFIX'
This part of the fix was invalid as trust domain object (that need uid/gid allocation)
are under 'cn=trust,SUFFIX'. Revert that part of the fix.
Waiting on https://fedorahosted.org/389/ticket/47828, to exclude provisioning contains

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipaserver/dcerpc.py: if search of a closest GC failed, try to find any GC

https://fedorahosted.org/freeipa/ticket/4458

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: make PDC discovery more robust

Certain operations against AD domain controller can only be done if its
FSMO role is primary domain controller. We need to use writable DC and
PDC when creating trust and updating name suffix routing information.

https://fedorahosted.org/freeipa/ticket/4479

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: Avoid hitting issue with transitive trusts on Windows Server prior to 2012

http://msdn.microsoft.com/en-us/library/2a769a08-e023-459f-aebe-4fb3f595c0b7#id83

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: be more open to what domains can be seen through the forest trust

https://fedorahosted.org/freeipa/ticket/4463

Reviewed-By: Sumit Bose <sbose@redhat.com>
ipaserver/dcerpc.py: Make sure trust is established only to forest root domain

Part of https://fedorahosted.org/freeipa/ticket/4463

Reviewed-By: Sumit Bose <sbose@redhat.com>
pwpolicy-add: Added better error handling

    Make error message more meaningful when a password policy is added for a non
    existing group.

    https://fedorahosted.org/freeipa/ticket/4334

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Allow changing CA renewal master in ipa-csreplica-manage.

https://fedorahosted.org/freeipa/ticket/4039

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
CLIENT: Explicitly require python-backports-ssl_match_hostname

Without python-backports-ssl_match_hostname installed, an ipa-client
installation could have failed with:
    from backports.ssl_match_hostname import match_hostname
    ImportError: No module named ssl_match_hostname

This patch adds an explicit dependency to
python-backports-ssl_match_hostname.

https://fedorahosted.org/freeipa/ticket/4515

Reviewed-By: Martin Kosek <mkosek@redhat.com>
freeipa.spec.in: Add python-backports-ssl_match_hostname to BuildRequires

This patch adds an explicit build dependency to
python-backports-ssl_match_hostname.
Without it, the build-time lint would fail.

https://fedorahosted.org/freeipa/ticket/4515

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Make --target available in the CLI

This was left out by mistake when permissions were refactored.
The API is already tested.

https://fedorahosted.org/freeipa/ticket/4522
permission plugin: Improve description of the target option

https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Ensure ipaUserAuthTypeClass when needed on user creation

Also, remove the attempt to load the objectClasses when absent. This
never makes sense during an add operation.

https://fedorahosted.org/freeipa/ticket/4455

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Add record(s) to /etc/host when IPA is configured as DNS server.

This is to avoid chicken-egg problem when directory server fails to start
without resolvable hostname and named fails to provide hostname without
directory server.

https://fedorahosted.org/freeipa/ticket/4220

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Normalize external CA cert before passing it to pkispawn

https://fedorahosted.org/freeipa/ticket/4019

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
baseldap: Fix undefined variable reference in LDAPAddReverseMember and LDAPRemoveReverseMember
idviews: Add necessary schema for the ID views
idviews: Create container for ID views under cn=accounts

Part of: https://fedorahosted.org/freeipa/ticket/3979
idviews: Add ipaAssignedIDVIew reference to the host object

Part of: https://fedorahosted.org/freeipa/ticket/3979
ipalib: Remove redundant and star imports from host plugin

Also fixes incorrect error catching for UnicodeDecodeError.

Part of: https://fedorahosted.org/freeipa/ticket/3979