Do not ask for memberindirect when updating managed permissions

One of the default_attributes of permission is memberofindirect,
a virtual attribute manufactured by ldap2, which is set when a permission
is part of a role.
When update_entry is called on an entry with memberofindirect,
ipaldap tries to add the attribute to LDAP and fails with an objectclass
violation.

Do not ask for memberindirect when retrieving the entry.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add managed read permissions to automember

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
CI - test_forced_client_reenrollment stability fix

fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19

https://fedorahosted.org/freeipa/ticket/4298

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Fix apache semaphores prior to installing IPA server

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: tasks: Accept extra arguments when installing client

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Allow using FQDN with trailing dot as final hostname

When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Fix incorrect UID/GID reference for subdomain users and groups

In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
webui: fix OTP Token add regression

OTP Token add failed because of invalid function call. qr_widget doesn't
contain `on_value_changed` method since it inherits from `IPA.widget` and
not from `IPA.input_widget`.

Emitting the event was preserved for future possible usage.

https://fedorahosted.org/freeipa/ticket/4306

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
Allow primary keys to use different type than unicode.

Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Support API version-specific RPC marshalling.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Replace get_syntax method of IPASimpleObject with new get_type method.

get_type returns the Python type for an LDAP attribute.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Use raw attribute values in command result when --raw is specified.

For backward compatibility, the values are converted to unicode, unless the
attribute is binary or the conversion fails.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Keep original name when setting attribute in LDAPEntry.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ipa_range_check: Use special attributes to determine presence of RID bases

The slapi_entry_attr_get_ulong which is used to get value of the RID base
attributes returns 0 in case the attribute is not set at all. We need
to distinguish this situation from the situation where RID base attributes
are present, but deliberately set to 0.

Otherwise this can cause false negative results of checks in the range_check
plugin.

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipa_range_check: Connect the new node of the linked list

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipa_range_check: Make a new copy of forest_root_id attribute for range_info struct

Not making a new copy of this attribute creates multiple frees caused by multiple
pointers to the same forest_root_id from all the range_info structs for all the
domains belonging to given forest.

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipa_range_check: Do not fail when no trusted domain is available

When building the domain to forest root map, we need to take the case
of IPA server having no trusted domains configured at all. Do not abort
the checks, but return an empty map instead.

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipa_range_check: Fix typo when comparing strings using strcasecmp

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipatests: Extend test suite for ID ranges

Add tests coverage for recently added ID range checks dependant
on the ID range types.

Part of: https://fedorahosted.org/freeipa/ticket/4137
ipatests: Change range_check return values from int to range_check_result_t enum

Using integers for return values that are used for complex casing can be fragile
and typo-prone. Change range_check function to return range_check_result_t enum,
whose values properly describes each of the range_check results.

Part of: https://fedorahosted.org/freeipa/ticket/4137