Allow changing CA renewal master in ipa-csreplica-manage.

https://fedorahosted.org/freeipa/ticket/4039

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
CLIENT: Explicitly require python-backports-ssl_match_hostname

Without python-backports-ssl_match_hostname installed, an ipa-client
installation could have failed with:
    from backports.ssl_match_hostname import match_hostname
    ImportError: No module named ssl_match_hostname

This patch adds an explicit dependency to
python-backports-ssl_match_hostname.

https://fedorahosted.org/freeipa/ticket/4515

Reviewed-By: Martin Kosek <mkosek@redhat.com>
freeipa.spec.in: Add python-backports-ssl_match_hostname to BuildRequires

This patch adds an explicit build dependency to
python-backports-ssl_match_hostname.
Without it, the build-time lint would fail.

https://fedorahosted.org/freeipa/ticket/4515

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Make --target available in the CLI

This was left out by mistake when permissions were refactored.
The API is already tested.

https://fedorahosted.org/freeipa/ticket/4522
permission plugin: Improve description of the target option

https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Ensure ipaUserAuthTypeClass when needed on user creation

Also, remove the attempt to load the objectClasses when absent. This
never makes sense during an add operation.

https://fedorahosted.org/freeipa/ticket/4455

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Add record(s) to /etc/host when IPA is configured as DNS server.

This is to avoid chicken-egg problem when directory server fails to start
without resolvable hostname and named fails to provide hostname without
directory server.

https://fedorahosted.org/freeipa/ticket/4220

Reviewed-By: Petr Viktorin <pviktori@redhat.com>