Implement an IPA Foreman smartproxy server

This currently server supports only host and hostgroup commands for
retrieving, adding and deleting entries.

The incoming requests are completely unauthenticated and by default
requests must be local.

Utilize GSS-Proxy to manage the TGT.

Configuration information is in the ipa-smartproxy man page.

Design: http://www.freeipa.org/page/V3/Smart_Proxy

https://fedorahosted.org/freeipa/ticket/4128

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipalib.aci: Add support for == and != operators to ACI

This allows more natural comparisons.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Move ACI tests to the testsuite

Make old debug code into regression tests for ACI parsing and output.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
ipalib.aci: Allow alternate "aci" keyword in ACIs

Dogtag adds some ACIs that use an alternate keyword:
    version 3.0; aci
instead of
    version 3.0; acl

Add support for this so the parser does not fail on these ACIs.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Simo Sorce <simo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
webui-ci: adjust id range tests to new validator

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui: fix switching between multiple_choice_section choices

- required indicators are not present for all sections except the last
- validation has wrong color for the same sections

There was only one layout for all choices. Layout should not be reused
because `create` method will reset layout's rows therefore it worked
properly only for the last choice.

https://fedorahosted.org/freeipa/ticket/4327

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
ipalib: Add DateTime parameter

Adds a parameter that represents a DateTime format using datetime.datetime
object from python's native datetime library.

In the CLI, accepts one of the following formats:
    Accepts LDAP Generalized time without in the following format:
       '%Y%m%d%H%M%SZ'

    Accepts subset of values defined by ISO 8601:
        '%Y-%m-%dT%H:%M:%SZ'
        '%Y-%m-%dT%H:%MZ'
        '%Y-%m-%dZ'

    Also accepts above formats using ' ' (space) as a separator instead of 'T'.

As a simplification, it does not deal with timezone info and ISO 8601
values with timezone info (+-hhmm) are rejected. Values are expected
to be in the UTC timezone.

Values are saved to LDAP as LDAP Generalized time values in the format
'%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid
confusion, in addition to subset of ISO 8601 values, the LDAP generalized
time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the
format user will see on the output).

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipatests: Cover DateTime in test_parameters.py

Adds tests for newly added DateTime parameter, focusing on conversion
of accepted datetime formats.

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipalib: Expose krbPrincipalExpiration in CLI

Adds a krbPrincipalExpiration attribute to the user class
in user.py ipalib plugin as a DateTime parameter.

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipatests: Fix formatting errors in test_user_plugin.py

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipatests: Add coverage for setting krbPrincipalExpiration

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ipatests: Add test for denying expired principals

Part of: https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <simo@redhat.com>
Fixed typo how to create an example gpg key

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Fix a typo in the otptoken doc string

https://fedorahosted.org/freeipa/ticket/4289

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Fixed typo in ipa-test-task man page

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Fixed various typos in ipa-client-install man page

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Adding verb to error message to make it less confusing.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
plugin registration refactoring for pwpolicy

decorators used for plugin registration in pwpolicy
according to:
http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Trust add datetime fix

Fixes trust add, since now datetime object is returned
for 'modifytimestamp', which cannot be split like a string.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>