extdom: do not return results from the wrong domain

Resolves: https://fedorahosted.org/freeipa/ticket/4264
Reviewed-By: Tomas Babej <tbabej@redhat.com>
Proxy PKI clone /ca/ee/ca/profileSubmit URI

PKI change done in ticket https://fedorahosted.org/pki/ticket/816
requires the PKI Clone's SSL Server certificate to be issued by
it's associated PKI master.

Allow this call on IPA master.

https://fedorahosted.org/freeipa/ticket/4265

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Allow indexing API object types by class

This allows code like:
    from ipalib.plugins.dns import dnszone_mod

    api.Command[dnszone_mod]

This form should be preferred when getting specific objects
because it ensures that the appropriate plugin is imported.

https://fedorahosted.org/freeipa/ticket/4185

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission-find: Fix handling of the search term for legacy permissions

Previously the search term was only applied to the name.
Fix it so that it filters results based on any attribute.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
test_permission_plugin: Fix tests that make too broad assumptions

The test that searches with a limit of 1 assumes a specific order
LDAP returns entries in. Future patches will change this order.
Do not check the specific entry returned.

The test that searched for --bindtype assumed that no anonymous
permissions exist in a clean install. Again, this will be changed
in future patches.
Add a name to the bindtype test, and add a negatitive test to
verify the filtering works.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow modifying permissions with ":" in the name

The ":" character will be reserved for default permissions, so that
users cannot create a permission with a name that will later be
added as a default.

Allow the ":" character modifying/deleting permissions*, but not
when creating them. Also do not allow the new name to contain ":"
when renaming.

(* modify/delete have unrelated restrictions on managed permissions)

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add Object metadata and update plugin for managed permissions

The default read permission is added for Netgroup as an example.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Managed_Read_permissions
Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Add 'top' to the list of object classes

The 'top' objectclass is added by DS if not present. On every
update the managed permission updater compared the object_class
list with the state from LDAP, saw that there's an extra 'top'
value, and tried deleting it.

Add 'top' to the list to match the entry in LDAP.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Fix certificate renewal scripts to work with separate CA DS instance.

https://fedorahosted.org/freeipa/ticket/3805

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Move CACERT definition to a single place.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Do not create CA certificate files in CA-less server install.

The files are created later by ipa-client-install, there's no need to do it
twice.

This also fixes a bug in CA-less, where the CA certificate is not removed from
/etc/pki/nssdb after client uninstall, because it has a different nickname.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Use LDAP API to upload CA certificate instead of ldapmodify command.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Upload CA certificate from DS NSS database in CA-less server install.

Before, the file provided in the --root-ca-file option was used directly for
the upload. However, it is the same file which is imported to the NSS
database, so the second code path is not necessary.

Also removed now unused upload_ca_dercert method of dsinstance.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Remove unused method export_ca_cert of dsinstance.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Show progress when enabling SSL in DS in ipa-server-install output.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Use certmonger D-Bus API to configure certmonger in CA install.

Before, certmonger was configured by modifying its internal database directly.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Add new certmonger CA helper dogtag-ipa-ca-renew-agent.

The helper will be used to handle CA-related certificate renewal requests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Update pkcs10 module functions to always load CSRs and allow selecting format.

This change makes the pkcs10 module more consistent with the x509 module.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Remove unused function get_subjectaltname from the cert plugin.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Add function for parsing friendly name from certificate requests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>