Add managed read permissions to HBAC objects

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Document the managed permission updater operation

The method was explained on the [Design] page, but as the updater
is extended the design page would become obsolete.
Document the operation in the docstring of the plugin itself.

Design: http://www.freeipa.org/page/V3/Managed_Read_permissions#Default_Permission_Updater
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow overriding all attributes of default permissions

Allow overriding ipapermtarget, ipapermtargetfilter, ipapermlocation,
objectclass of default managed permissions.
This allows defining permissions that are not tied to an object type.
Default values are same as before.

Also, do not reset ipapermbindruletype when updating an existing
managed permission.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
automember rebuild nowait feature added

automember-rebuild uses asynchronous 389 task, and returned
success even if the task didn't run. this patch fixes this
issue adding a --nowait parameter to 'ipa automember-rebuild',
defaulting to False, thus when the script runs without it,
it waits for the 'nstaskexitcode' attribute, which means
the task has finished. Old usage can be enabled using --nowait,
and returns the DN of the task for further polling.
New tests added also.

https://fedorahosted.org/freeipa/ticket/4239

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
plugin registration refactoring for automembership

decorators used for plugin registration in automembership
according to:
http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipalib.errors: Fix TaskTimeout doctest

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
Add managed read permissions to Sudo objects

Part of the work for: https://fedorahosted.org/freeipa/ticket/1313
and: https://fedorahosted.org/freeipa/ticket/3566
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add managed read permissions to group

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Add managed read permission to hostgroup

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305
ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
ipatests: Fix apache semaphores prior to installing IPA server
ipatests: tasks: Accept extra arguments when installing client
ipatests: Allow using FQDN with trailing dot as final hostname

When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.
ipatests: Fix incorrect UID/GID reference for subdomain users and groups

In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.
ipa-client: Set NIS domain name in the installer

Provides two new options for the ipa-client-install:
    --nisdomain: specifies the NIS domain name
    --no_nisdomain: flag to aviod setting the NIS domain name

In case no --nisdomain is specified and --no_nisdomain flag was
not set, the IPA domain is used.

Manual pages updated.

http://fedorahosted.org/freeipa/ticket/3202
ipa-client-install: Configure sudo to use SSSD as data source

Makes ipa-client-install configure SSSD as the data provider
for the sudo service by default. This behaviour can be disabled
by using --no-sudo flag.

https://fedorahosted.org/freeipa/ticket/3358
ipatests: Add Sudo integration test
ipatests: Setup SSSD debugging mode by default