ipa-join usage instructions are incorrect

Parameter -s for ipa-join has hostame instead of hostname

https://fedorahosted.org/freeipa/ticket/3250

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Fix regular expression for LOC records in DNS.

- Fractional parts of integers are not mandatory.
- Expressions containing only size or only size + horizontal precision
  are allowed.
- N/S/W/E handling was fixed.

See RFC 1876 section 3 for details.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Modify DNS tests with LOC records to workaround bug in python-dns.

Older versions of dnspython have problems with implicit values for
size and h/v precision so our tests use explicit value.
See https://github.com/rthalley/dnspython/issues/47

This change is necessary because we want to test if data visible
over DNS protocol matches data visible over LDAP.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Improve error message on failed Kerberos authentication

When ipa client installation fails due to failed Kerberos authentication,
make sure that the message about the failed authentication is displayed last.
This makes it clear to the user that this was the reason for failed
installation.

https://fedorahosted.org/freeipa/ticket/3573

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Add support to ipa-kdb for keyless principals

https://fedorahosted.org/freeipa/ticket/3779

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ipactl can not restart ipa services if current status is stopped

fixed by starting the directory server when restarting if it is not
currently running to enable fetching running services

later restart didn't check that

also added a check, that if the directory server started at the
beginning, there is no need to restart it

https://fedorahosted.org/freeipa/ticket/4050

Reviewed-By: Martin Kosek <mkosek@redhat.com>
.mailmap: Remove spurious Kyle Baker line

<kbaker@redhat.com> is another person, entirely unrelated to FreeIPA.
permission-mod: Do not copy member attributes to new entry

Fixes: https://fedorahosted.org/freeipa/ticket/4178
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
permissions: Use multivalued targetfilter

Change the target filter to be multivalued.

Make the `type` option on permissions set location and an
(objectclass=...) targetfilter, instead of location and target.
Make changing or unsetting `type` remove existing
(objectclass=...) targetfilters only, and similarly,
changing/unsetting `memberof` to remove (memberof=...) only.

Update tests

Part of the work for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add permission_filter_objectclasses for explicit type filters

Part of the work for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add tests for multivalued filters

Reviewed-By: Martin Kosek <mkosek@redhat.com>
.mailmap: use correct name format for Adam

Name should be First-Name Last-Name. Map all Adam's contributions
to this preferred format.
Add --force option to ipactl

If an error occurs in the start up sequence in ipactl start/restart,
all the services are stopped. Using the --force option prevents
stopping of services that have successfully started, just skips the
services which can not be started.

ipactl status now shows stopped services also, if the directory
server is running.

With the contribution of Ana Krivokapic

https://fedorahosted.org/freeipa/ticket/3509

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add HOTP support

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Add OTP last token plugin

This plugin prevents the deletion or deactivation of the last
valid token for a user. This prevents the user from migrating
back to single factor authentication once OTP has been enabled.

Thanks to Mark Reynolds for helping me with this patch.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Add OTP sync support to ipa-pwd-extop

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Teach ipa-pwd-extop to respect global ipaUserAuthType settings

https://fedorahosted.org/freeipa/ticket/4105

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
libotp: do not call internal search for NULL dn

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Remove the unused ipalib.frontend.Property class

This class was built into the framework from its early days but it's
not used anywhere.
Remove it along with its tests

https://fedorahosted.org/freeipa/ticket/3460

Reviewed-By: Jan Cholasta <jcholast@redhat.com>