Fix CA certificate backup and restore

Backup and restore /etc/pki/ca-trust/source/ipa.p11-kit.

Create /etc/ipa/nssdb after restore if necessary.

https://fedorahosted.org/freeipa/ticket/4711

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Fix: DNS installer adds invalid zonemgr email

Installer adds zonemgr as relative (and invalid) address.
This fix force installer to use absolute email.

Ticket: https://fedorahosted.org/freeipa/ticket/4707
Reviewed-By: David Kupka <dkupka@redhat.com>
ipaplatform: Use the dirsrv service, not target

IPA only uses one instance of the directory server. When an instance
is not specified to a call to service.start/stop/restart/...,
use IPA's instance.

Stopping a systemd service is synchronous (bby default), but stopping
a target is not. This will change ensures that the directory server
is actually down when stop() finishes.

https://fedorahosted.org/freeipa/ticket/4709

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Fix: DNS policy upgrade raises asertion error

Ticket: https://fedorahosted.org/freeipa/ticket/4708
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Search using proper scope when connecting CA instances

The wrong search scope was being used when trying to determine if
a given master had a CA installed when trying to create a new
connection.

https://fedorahosted.org/freeipa/ticket/4704

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Fix upgrade referint plugin

Mixing 'Old' and 'New' attr style for referential integrity plugin causes errors.
Now old setting are migrated to new style setting before upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4622
Reviewed-By: David Kupka <dkupka@redhat.com>
Upgrade: fix trusts objectclass violationi

Execute updates in proper ordering.
Curently ldap-updater implementation doesnt allow better fix.

Ticket: https://fedorahosted.org/freeipa/ticket/4680
Reviewed-By: David Kupka <dkupka@redhat.com>
Remove service file even if it isn't link.

(Link to) service file from /etc/systemd/system/ must be removed before masking
systemd service.

https://fedorahosted.org/freeipa/ticket/4658

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Produce better error in group-add command.

https://fedorahosted.org/freeipa/ticket/4611

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Improve otptoken help messages

https://fedorahosted.org/freeipa/ticket/4689

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Ensure users exist when assigning tokens to them

https://fedorahosted.org/freeipa/ticket/4642

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add help string on how to configure multiple DNS forwards for various cli tools

The man pages for various FreeIPA setup tools are more descriptive on how to
configure multiple DNS forwarders than the corresponding cli help. This patch
makes the cli help more verbose now for the following tools:

* ipa-dns-install
* ipa-replica-install
* ipa-server-install

https://fedorahosted.org/freeipa/ticket/4465

Reviewed-By: Martin Basti <mbasti@redhat.com>
Fix named working directory permissions

Just adding dir to specfile doesnt work, because is not guarantee the
named is installed, during RPM installation.

Ticket: https://fedorahosted.org/freeipa/ticket/4716
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add UTC date to GIT snapshot version generation

This way make rpms will always generate new packages that can be installed on
top fo older ones, regardless of alphabetic ordering of the GIT commit id.
Also make sure version and date variables are immditely resolved, so they can't
change during the build.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Fix: zonemgr must be unicode value

To support IDNA --zonemgr option must be unicode not ascii

https://fedorahosted.org/freeipa/ticket/4724

Reviewed-By: David Kupka <dkupka@redhat.com>
Enable QR code display by default in otptoken-add

This is possible because python-qrcode's output now fits in a standard
terminal. Also, update ipa-otp-import and otptoken-add-yubikey to
disable QR code output as it doesn't make sense in these contexts.

https://fedorahosted.org/freeipa/ticket/4703

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Fix warning message should not contain CLI commands

Message is now universal for both CLI and WebUI

Ticket: https://fedorahosted.org/freeipa/ticket/4647
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Fix wrong expiration date on renewed IPA CA certificates

The expiration date was always set to the expiration date of the original
certificate.

https://fedorahosted.org/freeipa/ticket/4717

Reviewed-By: David Kupka <dkupka@redhat.com>
Do not restore SELinux settings that were not backed up

https://fedorahosted.org/freeipa/ticket/4678

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Show warning instead of error if CA did not start

This is just workaround, checking if CA is working raises false positive
exception during upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4676
Reviewed-By: Simo Sorce <ssorce@redhat.com>