ipa-adtrust-install does not re-add member in adtrust agents group

When a CIFS service exists and adtrust agents group does not
have it as a member attribute (for whatever reason), re-running
ipa-adtrust-install does not fix the inconsistency.

Make the installer more robust by being able to fix the inconsistency.

https://fedorahosted.org/freeipa/ticket/4464

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ipatests: test_trust: Add test to cover lookup of trusdomains

Adds an integration tests that checks that all trustdomains are
able to be found by trustdomain-find command right after the
trust has been established.

Also moves some code to allow easier adding common test cases for
both POSIX and non-POSIX test classes.

https://fedorahosted.org/freeipa/ticket/4208

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Fix parsing of long nicknames in certutil -L output.

https://fedorahosted.org/freeipa/ticket/4453

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow to add host if AAAA record exists

http://fedorahosted.org/freeipa/ticket/4164

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Tests: host tests with dns

Test for: https://fedorahosted.org/freeipa/ticket/4164

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Convert external CA chain to PKCS#7 before passing it to pkispawn.

https://fedorahosted.org/freeipa/ticket/4397

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
User Life Cycle: create containers and scoping DS plugins

User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
		Active: cn=users,cn=accounts,$SUFFIX
		Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
		Stage:  cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX

Plugins scopes:
		krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
			cn=accounts,SUFFIX
			cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
		DNA:
			cn=accounts,SUFFIX

		Plugins exclude subtree:
		IPA UUID, Referential Integrity, memberOf:
			cn=provisioning,SUFFIX

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
webui: better error reporting

On page:
- styled to use proper line breaks
- "centered" by .container class and not by huge padding

Console:
- proper line breaks
- links in stack trace are clickable(Chrome)

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui-ci: fix table widget add

add_table_record call used old selector for add button which
caused 3 fails in CI:
- ERROR: Test automember rebuild membership feature for hosts
- ERROR: Test automember rebuild membership feature for users
- ERROR: Basic CRUD: dns

related to:
https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Change BuildRequires for Java

Requiring a specific version of Java leads to breakages, like the
one happening on nightly builds in Fedora Rawhide right now.
We should use the more generic 'java' BuildRequires instead of the
versioned one.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
webui: display expired session notification in a more visible area

The notification is a primary information of the page. It should be more highlighted.

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: improved info msgs on login/token sync/reset pwd pages

- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: login screen - improved button switching

- added cancel button to reset password view of login screen
- re-implemented buttons hiding mechanism
- switching between 'Reset Password' and 'Reset Password and Login' according to presence of value in OTP field

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: rename tooltip to title

- use title for input's elements 'title' attribute
- tooltip for Bootstrap's tooltip component

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: tooltip support

Allow to set 'tooltip' attribute in spec. It displays info icon
with Bootstrap's tooltip near field's label.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better authentication types description

Tooltips were added to "User authentication types" and "Default user
authentication types" to describe their relationship and a meaning of
not-setting a value.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Support delegating RBAC roles to service principals

https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek <mkosek@redhat.com>
service: Normalize service principal in get_dn

This will make any lookup go through the normalization.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
webui: convert widget.less indentation to spaces

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: improve rule table css

- category radio line has line-height large enough to contain
  undo button -> content doesn't move several pixels on change
- remove vertical padding from btns in table headers to maintain
  about the same height
- remove invisible border from link buttons to have the same height
  for disabled and enabled button

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>