test_ldap: Read a publicly accessible attribute when testing anonymous bind

The usercertificate attribute is slated to not be readable for
anonymous users. Use associateddomain in $SUFFIX instead.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
aci-update: Trim the admin write blacklist

These attributes are removed from the blacklist, which means
high-level admins can now modify them:

- krbPrincipalAliases
- krbPrincipalType
- krbPwdPolicyReference
- krbTicketPolicyReference
- krbUPEnabled
- serverHostName

The intention is to only blacklist password attributes and attributes
that are managed by DS plugins.

Also, move the admin ACIs from ldif and trusts.update to aci.update.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
aci-update: Add ACI for read-only admin attributes

Most admin access is granted with the "Admin can manage any entry" ACI,
but before the global anonymous read ACI is removed, read-only admin
access must be explicitly given.
Add an ACI for read-only attributes.

https://fedorahosted.org/freeipa/ticket/4319

Reviewed-By: Martin Kosek <mkosek@redhat.com>
trust plugin: Remove ipatrustauth{incoming,outgoing} from default attrs

These attributes contain secrets for the trusts and should not be returned
by default.

Also, search_display_attributes is modified to better match default_attributes

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Add managed read permissions to trust

A single permission is added to cover trust, trustconfig, and trustdomain.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Make trust objects available to regular users

With global read ACI removed, some of the trust and trustdomain
attributes are not available. Make trust plugin resilient to these
missing attributes and let it return the available information.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
ipatests: Add Sudo integration test
ipatests: Setup SSSD debugging mode by default
ipatests: Enable SSSD debugging on legacy clients with SSSD
ipa-client: Set NIS domain name in the installer

Provides two new options for the ipa-client-install:
    --nisdomain: specifies the NIS domain name
    --no_nisdomain: flag to aviod setting the NIS domain name

In case no --nisdomain is specified and --no_nisdomain flag was
not set, the IPA domain is used.

Manual pages updated.

http://fedorahosted.org/freeipa/ticket/3202
ipa-client-install: Configure sudo to use SSSD as data source

Makes ipa-client-install configure SSSD as the data provider
for the sudo service by default. This behaviour can be disabled
by using --no-sudo flag.

https://fedorahosted.org/freeipa/ticket/3358
Merge branch 'ipatests_improvements' into test