User Life Cycle: create containers and scoping DS plugins

User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
		Active: cn=users,cn=accounts,$SUFFIX
		Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
		Stage:  cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX

Plugins scopes:
		krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
			cn=accounts,SUFFIX
			cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
		DNA:
			cn=accounts,SUFFIX

		Plugins exclude subtree:
		IPA UUID, Referential Integrity, memberOf:
			cn=provisioning,SUFFIX

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
webui: better error reporting

On page:
- styled to use proper line breaks
- "centered" by .container class and not by huge padding

Console:
- proper line breaks
- links in stack trace are clickable(Chrome)

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui-ci: fix table widget add

add_table_record call used old selector for add button which
caused 3 fails in CI:
- ERROR: Test automember rebuild membership feature for hosts
- ERROR: Test automember rebuild membership feature for users
- ERROR: Basic CRUD: dns

related to:
https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Change BuildRequires for Java

Requiring a specific version of Java leads to breakages, like the
one happening on nightly builds in Fedora Rawhide right now.
We should use the more generic 'java' BuildRequires instead of the
versioned one.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
webui: display expired session notification in a more visible area

The notification is a primary information of the page. It should be more highlighted.

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: improved info msgs on login/token sync/reset pwd pages

- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: login screen - improved button switching

- added cancel button to reset password view of login screen
- re-implemented buttons hiding mechanism
- switching between 'Reset Password' and 'Reset Password and Login' according to presence of value in OTP field

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: rename tooltip to title

- use title for input's elements 'title' attribute
- tooltip for Bootstrap's tooltip component

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: tooltip support

Allow to set 'tooltip' attribute in spec. It displays info icon
with Bootstrap's tooltip near field's label.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better authentication types description

Tooltips were added to "User authentication types" and "Default user
authentication types" to describe their relationship and a meaning of
not-setting a value.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Support delegating RBAC roles to service principals

https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek <mkosek@redhat.com>
service: Normalize service principal in get_dn

This will make any lookup go through the normalization.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: convert widget.less indentation to spaces

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: improve rule table css

- category radio line has line-height large enough to contain
  undo button -> content doesn't move several pixels on change
- remove vertical padding from btns in table headers to maintain
  about the same height
- remove invisible border from link buttons to have the same height
  for disabled and enabled button

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: sshkey widget - usability fixes

- save one click by opening edit dialog right after adding new row
- add margin between fingerprint and "show/edit" button
- fix honoring of writable/read-only flags upon row creation

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: disable batch action buttons by default

action buttons associated with batch actions were enabled by default, but
they were disabled right after facet creation and a load of data. It caused
a visual flicker.

UX is enhanced by making them disabled by default.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: fix group type padding

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Add a KRA to IPA

This patch adds the capability of installing a Dogtag KRA
to an IPA instance.  With this patch,  a KRA is NOT configured
by default when ipa-server-install is run.  Rather, the command
ipa-kra-install must be executed on an instance on which a Dogtag
CA has already been configured.

The KRA shares the same tomcat instance and DS instance as the
Dogtag CA.  Moreover, the same admin user/agent (and agent cert) can
be used for both subsystems.  Certmonger is also confgured to
monitor the new subsystem certificates.

To create a clone KRA, simply execute ipa-kra-install <replica_file>
on a replica on which a Dogtag CA has already been replicated.
ipa-kra-install will use the security domain to detect whether the
system being installed is a replica, and will error out if a needed
replica file is not provided.

The install scripts have been refactored somewhat to minimize
duplication of code.  A new base class dogtagintance.py has
been introduced containing code that is common to KRA and CA
installs.  This will become very useful when we add more PKI
subsystems.

The KRA will install its database as a subtree of o=ipaca,
specifically o=ipakra,o=ipaca.  This means that replication
agreements created to replicate CA data will also replicate KRA
data.  No new replication agreements are required.

Added dogtag plugin for KRA.  This is an initial commit providing
the basic vault functionality needed for vault.  This plugin will
likely be modified as we create the code to call some of these
functions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

The uninstallation option in ipa-kra-install is temporarily disabled.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipa trust-add command should be interactive

- Make ipa trust-add command interactive for realm_admin and realm_passwd
- Fix 'Active directory' typo to 'Active Directory'

https://fedorahosted.org/freeipa/ticket/3034

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add man page for ipa-kra-install

https://fedorahosted.org/freeipa/ticket/4504

Reviewed-By: Petr Viktorin <pviktori@redhat.com>