Ticket 47653 - Need a way to allow users to create entries assigned to themselves

Bug Description:  There are cases where users need to be able to create, edit and delete
                  their own entries.  Using an ACI with the "userattr" keyword does not
                  work with ADD operations(to prevent a security hole).  This prevents IPA's
                  OTP plugin from performing some necessary operations.

Fix Description:  Added a new config attribute "nsslapd-access-userattr-strict".  The default
                  is "on" or strict.  For the IPA case, it would need to be set to "off" in
                  order to allow the desired behavior.

https://fedorahosted.org/389/ticket/47653

Reviewed by: nhosoi(Thanks!)
Ticket 47654 - Cleanup old memory leaks reported from valgrind

This patch addresses all the memory leaks reported by valgrind when just
starting and stopping the server.  Most of these were around the access control
plugin and libaccess.

https://fedorahosted.org/389/ticket/47654

Jenkins: passed
Coverity: passed
Valgrind: passed

Reviewed by: nhosoi(Thanks!)
Ticket #447 - Possible to add invalid attribute to nsslapd-allowed-to-delete-attrs

Bug description: If given value of nsslapd-allowed-to-delete-attrs are
all invalid attributes, e.g.,
  nsslapd-allowed-to-delete-attrs: invalid0 invalid1
they were logged as invalid, but accidentally set to nsslapd-allowed-
to-delete-attrs.

Fix description: This patch checks the validation result and if there
is no valid attributes given to nsslapd-allowed-to-delete-attrs, it
issues a message in the error log:
  nsslapd-allowed-to-delete-attrs: Given attributes are all invalid.
  No effects.
and it returns an error.  The modify operation fails with "DSA is
unwilling to perform".

https://fedorahosted.org/389/ticket/447

Reviewed by rmeggins@redhat.com (Thank you, Rich!)
Ticket #47571 - targetattr ACIs ignore subtype

Description:
Subtypes in targetattr, userattr in aci as well as filter and attribute list
in the search are supported.
* If targetattr contains subtypes, the base type only as well as other subtypes
  are not allowed to access (or denied to access).
* If userattr contains subtypes, the base type as well as other subtypes in
  entries do not match the userattr value.
* If attribute list in search has a base type attribute, and a targetattr has
  a type with subtypes, then only the subtyped value is returned.  E.g.,
    attribute list: sn
    targetattr: sn;en
      ==>
    sn;en: <sn-en-value> and
    sn;en;phonetic: <sn-en-phonetic-value> are returned
    but
    sn or sn;fr is not.
  If attribute list has a type with subtype, then if the targetattr allows the
  subtype, the value is returned.  E.g.,
    attribute list: sn;en
    targetattr: sn;en
      ==>
    sn;en: <sn-en-value> and
    sn;en;phonetic: <sn-en-phonetic-value> are returned
    but
    sn or sn;fr is not.
1) slapd/attr.c
   * slapi_attr_type_cmp assumed the subtype order in 2 args are identical,
     but it is not always guaranteed.  Removed the assumption.
   * Added another compare type SLAPI_TYPE_CMP_SUBTYPES to comp_cmp which is
     called by slapi_attr_type_cmp to support full subtypes comparison.
2) plugin/acl.c:
   * Changed to call slapi_attr_type_cmp with human readable macros, e.g.,
     SLAPI_TYPE_CMP_BASE, SLAPI_TYPE_CMP_SUBTYPE, etc.
   * Replaced strcasecmp with slapi_attr_type_cmp for attribute type comparison.
   * Changed to call slapi_attr_type_cmp with SLAPI_TYPE_CMP_SUBTYPES (full
     subtype comparison) in acl__get_attrEval, where the next attribute to
	 compare is determined.
3) slapd/search.c,result.c
   send_all_attrs/send_specific_attrs use a dontsendattr array to control the
   duplicate attribute types.  Replaced the logic with a simpler one by creating
   an charray with no duplicates.

https://fedorahosted.org/389/ticket/47571

Reviewed by tbordaz@redhat.com (Thank you, Thierry!)
Revert "Ticket 47653 - Need a way to allow users to create entries assigned to themselves"

This reverts commit a9cd4e78f1fd1af5de06aca46c8c10ed70bbe4e1.

Description: It turned out this patch does not satisfy the IPA's needs
and has a possibility to introduce a security issue.