Do not create ipa-pki-proxy.conf if CA is not configured in ipa-upgradeconfig

This fixes upgrade from CA-less to CA-full after IPA upgrade.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
Do not fix trust flags in the DS NSS DB in ipa-upgradeconfig

It is necessary to fix trust flags only in the HTTP NSS DB, as it is used as
a source in the upload_cacrt update plugin.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
Check LDAP instead of local configuration to see if IPA CA is enabled

The check is done using a new hidden command ca_is_enabled.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
dns: fix privileges' memberof during dns install

Permissions with member attrs pointing to privileges are created before the privileges.

Run memberof plugin task to fix other ends of the relationships.

https://fedorahosted.org/freeipa/ticket/4637

Reviewed-By: Martin Kosek <mkosek@redhat.com>
keytab manipulation permission management

Adds new API:
  ipa host-allow-retrieve-keytab HOSTNAME --users=STR --groups STR
  ipa host-disallow-retrieve-keytab HOSTNAME --users=STR --groups STR
  ipa host-allow-create-keytab HOSTNAME --users=STR --groups STR
  ipa host-disallow-create-keytab HOSTNAME --users=STR --groups STR

  ipa service-allow-retrieve-keytab PRINCIPAL --users=STR --groups STR
  ipa service-disallow-retrieve-keytab PRINCIPAL --users=STR --groups STR
  ipa service-allow-create-keytab PRINCIPAL --users=STR --groups STR
  ipa service-disallow-create-keytab PRINCIPAL --users=STR --groups STR

these methods add or remove user or group DNs in `ipaallowedtoperform` attr with
`read_keys` and `write_keys` subtypes.

service|host-mod|show outputs these attrs only with --all option as:

  Users allowed to retrieve keytab: user1
  Groups allowed to retrieve keytab: group1
  Users allowed to create keytab: user1
  Groups allowed to create keytab: group1

Adding of object class is implemented as a reusable method since this code is
used on many places and most likely will be also used in new features. Older
code may be refactored later.

https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
tests: management of keytab permissions

https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
idviews: error out if appling Default Trust View on hosts

https://fedorahosted.org/freeipa/ticket/4615

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: add link to OTP token app

- display info message which points user to FreeOTP project page
- the link or the text can be easily changed by a plugin if needed

https://fedorahosted.org/freeipa/ticket/4469

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add new iduseroverride fields

- add gecos, gidnumber, loginshell, sshkeys fields

https://fedorahosted.org/freeipa/ticket/4617

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Update contributors

Add missing developers contributing to project git. Cancel "Past and
Occcasional" section and merge the people in the right categories.

Update .mailmap so that the Developer list can be easily re-generated.

Reviewed-By: Gabe Alford <redhatrises@gmail.com>
Display token type when viewing token

When viewing a token from the CLI or UI, the type of the token
should be displayed.

https://fedorahosted.org/freeipa/ticket/4563

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Create ipa-otp-counter 389DS plugin

This plugin ensures that all counter/watermark operations are atomic
and never decrement. Also, deletion is not permitted.

Because this plugin also ensures internal operations behave properly,
this also gives ipa-pwd-extop the appropriate behavior for OTP
authentication.

https://fedorahosted.org/freeipa/ticket/4493
https://fedorahosted.org/freeipa/ticket/4494

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: management of keytab permissions

https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Configure IPA OTP Last Token plugin on upgrade

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: allow --force in dnszone-mod and dnsrecord-add

Allow to use --force when changing authoritative nameserver address in DNS zone.

Same for dnsrecord-add for NS record.

https://fedorahosted.org/freeipa/ticket/4573

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: make Evented a part of base IPA.object

1. All framework objects to use event interface
2. Framework objects can be part of specification objects but they are not deep-cloned as the rest of specification objects - usually it would cause infinite loop. This make easier to add context as a $pre-op object without a need for $pre-op function.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: change order of idview's facet groups

Applied to hosts facet should not be default because, e.g., for Default Trust View it shouldn't be even visible(o use).

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide applied to hosts tab for Default Trust View

because applying Default Trust view on hosts is not allowed

https://fedorahosted.org/freeipa/ticket/4615

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide (un)apply buttons for Default Trust View

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: do not offer ipa users to Default Trust View

https://fedorahosted.org/freeipa/ticket/4616

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>