permission plugin: Do not assume attribute-level rights for new attributes are present

With the --all --raw options, the code assumed attribute-level rights
were set on ipaPermissionV2 attributes, even on permissions that did not
have the objectclass.
Add a check that the data is present before using it.

https://fedorahosted.org/freeipa/ticket/4121

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Use super() properly to avoid an exception

https://fedorahosted.org/freeipa/ticket/4099

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Clarify error message about missing DNS component in ipa-replica-prepare.

https://fedorahosted.org/freeipa/ticket/4188

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Make all ipatokenTOTP attributes mandatory

Originally we made them all optional as a workaround for the lack of SELFDN
support in 389DS. However, with the advent of SELFDN, this hack is no longer
necessary. This patch updates TOTP to match HOTP in this regard.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Always use real entry DNs for memberOf in ldap2.

https://fedorahosted.org/freeipa/ticket/4192

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Fix incorrect order of operations when restoring backup

When restoring files from backup, we do use an incorrect order of
operations - we first restore SELinux context and then copy the
files from backup, when we need to do the exact opposite.

https://fedorahosted.org/freeipa/ticket/4133

Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
Certificate search max_serial_number problem fixed

Maximum serial number field now accepts only positive numbers

https://fedorahosted.org/freeipa/ticket/4163

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Remove NULLS from constants.py

In the parameters system, we have been checking for a positive list of values
which get converted to None. The problem is that this method can in some
cases throw warnings when type coercion doesn't work (particularly, string
to unicode). Instead, any values that evaluate to False that are neither
numeric nor boolean should be converted to None.

Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
Update API.txt

This fixes commit be7b1b94e300b137c34bab80df3dc91195259c89
https://fedorahosted.org/freeipa/ticket/4163
bindinstance: make sure zone manager is initialized in add_master_dns_records

Bind instance is configured using a short-circuited way when replica is set up.
Make sure required properties are in place for that.

https://fedorahosted.org/freeipa/ticket/4186

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipa-kdb: in case of delegation use original client's database entry, not the proxy

https://fedorahosted.org/freeipa/ticket/4195

Reviewed-By: Tomáš Babej <tbabej@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
ipa-kdb: make sure we don't produce MS-PAC in case of authdata flag cleared by admin

When admin clears authdata flag for the service principal, KDC will pass
NULL client pointer (service proxy) to the DAL driver.

Make sure we bail out correctly.

Reviewed-By: Tomáš Babej <tbabej@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
webui: Focus expand/collapse link in batch_error dialog

Dialog loses focus when the links are clicked making the dialog uncontrollable by keyboard. This patch focuses the link again after expanding/collapsing the error list. Thus keeping the focus in a dialog

https://fedorahosted.org/freeipa/ticket/4097

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
trustdomain_find: make sure we skip short entries when --pkey-only is specified

With --pkey-only only primary key is returned. It makes no sense to check and
replace boolean values then.

https://fedorahosted.org/freeipa/ticket/4196

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipalib.plugins: Expose LDAPObjects' eligibility for permission --type in JSON metadata

https://fedorahosted.org/freeipa/ticket/4201

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
trusts: Remove usage of deprecated LDAP API

Remove a reference to the old deprecated LDAP API invoked by
the usage of trust_add method.

https://fedorahosted.org/freeipa/ticket/4204

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
trust: make sure we always discover topology of the
 forest trust

Even though we are creating idranges for subdomains only in case
there is algorithmic ID mapping in use, we still need to fetch
list of subdomains for all other cases.

https://fedorahosted.org/freeipa/ticket/4205
ipaserver/dcerpc: catch the case of insuffient permissions when establishing trust

We attempt to delete the trust that might exist already. If there are not enough
privileges to do so, we wouldn't be able to create trust at the next step and it will fail.
However, failure to create trust will be due to the name collision as we already had
the trust with the same name before. Thus, raise access denied exception here
to properly indicate wrong access level instead of returning NT_STATUS_OBJECT_NAME_COLLISION.

https://fedorahosted.org/freeipa/ticket/4202

Reviewed-By: Martin Kosek <mkosek@redhat.com>
adtrustinstance: make sure to stop and disable winbind in uninstall()

Reviewed-By: Martin Kosek <mkosek@redhat.com>