Fix upload of CA certificate to LDAP in CA-less install.

https://fedorahosted.org/freeipa/ticket/4300

Reviewed-By: Martin Kosek <mkosek@redhat.com>
CA-less tests generate failure

CA-less test suite always generate failures when installing
revoked certificates. This is a known issue, described in
https://fedorahosted.org/freeipa/ticket/4270 , this fix skips
these tests, outputting a warning for the later ticket.

https://fedorahosted.org/freeipa/ticket/4271

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-pwd-extop: Fix memory leak in ipapwd_pre_bind

We need to free the entry before returning from the function.

https://fedorahosted.org/freeipa/ticket/4295
ipa-range-check: Fix memory leaks when freeing range object

When cleaning the range_info struct, simple free of the struct
is not enough, we have to free contents of char pointers in the
struct as well.

https://fedorahosted.org/freeipa/ticket/4276
Extend ipa-range-check DS plugin to handle range types

The ipa-range-check plugin used to determine the range type depending
on the value of the attributes such as RID or secondary RID base. This
approached caused variety of issues since the portfolio of ID range
types expanded.

The patch makes sure the following rules are implemented:
    * No ID range pair can overlap on base ranges, with exception
      of two ipa-ad-trust-posix ranges belonging to the same forest
    * For any ID range pair of ranges belonging to the same domain:
        * Both ID ranges must be of the same type
        * For ranges of ipa-ad-trust type or ipa-local type:
            * Primary RID ranges can not overlap
        * For ranges of ipa-local type:
            * Primary and secondary RID ranges can not overlap
            * Secondary RID ranges cannot overlap

For the implementation part, the plugin was extended with a domain ID
to forest root domain ID mapping derivation capabilities.

https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305
ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
ipatests: Fix apache semaphores prior to installing IPA server
ipatests: tasks: Accept extra arguments when installing client
ipatests: Allow using FQDN with trailing dot as final hostname

When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.
ipatests: Fix incorrect UID/GID reference for subdomain users and groups

In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.
ipatests: Add Sudo integration test