Prefer user CFLAGS/CPPFLAGS over those provided by rpmbuild in the spec file.

https://fedorahosted.org/freeipa/ticket/3896
Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file.

Remove explicitly specified hardening flags from LDFLAGS in ipa-otpd.

https://fedorahosted.org/freeipa/ticket/3896
Add stricter default CFLAGS to Makefile.

https://fedorahosted.org/freeipa/ticket/3896
Fix compilation error in ipa-cldap.

https://fedorahosted.org/freeipa/ticket/3896
Remove CFLAGS duplication.

https://fedorahosted.org/freeipa/ticket/3896
Fix license in some Web UI files

Modified web ui files had incorrect GPLv2 headers instead of GPLv3 ones.

All of the affected code is of FreeIPA origin.
Allow kernel keyring CCACHE when supported

Server and client installer should allow kernel keyring ccache when
supported.

https://fedorahosted.org/freeipa/ticket/4013
ipa-client-install: Always pass hostname to the ipa-join

The ipa-client-install script and ipa-join use different methods
of resolving the hostname, the former uses gethostbyaddr() call,
while the latter reads the "uinfo.nodename".

This can result ipa-client-install failures in case of broken PTR
records.

https://fedorahosted.org/freeipa/ticket/4027
Consolidate .gitignore entries

Clean up the .gitignore file:
- Remove no longer used .gitignore entries, like .bzr files
- Do not repeat autotools generated files over and over again
- Whitelist existent Makefiles in the repository
- Better separate the .gitignore entries
Fix internal error in the user-status command.

https://fedorahosted.org/freeipa/ticket/4066
Regression test for user_status crash

https://fedorahosted.org/freeipa/ticket/4066
test_webui: Allow False values in configuration for no_ca, no_dns, has_trusts

The driver only checked if the corresponding value was in the config, so
    no_dns: False
had the same effect as
    no_dns: True

Change the check to take the value into consideration.

This makes false-y values like False (from YAML) and empty string
(from environment) work as if the value was not specified.
ipa-cldap: Cut NetBIOS name after 15 characters

The CLDAP DS plugin uses the uppercased first segment of the fully
qualified hostname as the NetBIOS name. We need to limit its size
to 15 characters.

https://fedorahosted.org/freeipa/ticket/4028
trust: fix get_dn() to distinguish creating and re-adding trusts

Latest support for subdomains introduced regression that masked
difference between newly added trust and re-added one.

Additionally, in case no new subdomains were found, the code was
returning None instead of an empty list which later could confuse
trustdomain-find command.

https://fedorahosted.org/freeipa/ticket/4067
Allow sets for initialization of frozenset-typed Param keywords

Lists and tuples are already allowed for convenience; it is easier to write
(1, 2, 3) or [1, 2, 3] than frozenset([1, 2, 3]).
This allows the set literal syntax, {1, 2, 3}, as well.
Allow Declarative test classes to specify the API version

This makes it possible to test behavior with older clients.
Add tests for permission plugin with older clients

These tests use an old API version, which triggers
backwards-compatible behavior in the plugin.
Add new permission schema

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Permissions_V2
Rewrite the Permission plugin

Ticket: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Permissions_V2
Verify ACIs are added correctly in tests

To double-check the ACIs are correct, this uses different code
than the new permission plugin: the aci_show command.
A new option, location, is added to the command to support
these checks.