Add requires for pki-core-10.1.1-1.fc20

Fixes PKI installation errors on Fedora 20.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Extending user plugin with inetOrgPerson fields

According to http://tools.ietf.org/html/rfc2798 ipa client
and web ui extended with inetOrgPerson fields:
- employeenumber
- employeetype
- preferredlanguage
- departmentnumber

carlicenseplate is now multivalued

https://fedorahosted.org/freeipa/ticket/4165

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Make ipa-client-automount backwards compatible

ipa-client-automount calls automountlocation-show command during the
process. Unfortunately, FreeIPA commands are forward compatible only
and thus fail the installer.

Similarly to ipa-client-install, call XML-RPC interface directly
with version fixed to 2.0 (command was already available at that
version) to fix the failure.

https://fedorahosted.org/freeipa/ticket/4290

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
webui: field and widget binding refactoring

This is a Web UI wide change. Fields and Widgets binding was refactored
to enable proper two-way binding between them. This should allow to have
one source of truth (field) for multiple consumers - widgets or something
else. One of the goal is to have fields and widget implementations
independent on each other. So that one could use a widget without field
or use one field for multiple widgets, etc..

Basically a fields logic was split into separate components:
- adapters
- parsers & formatters
- binder

Adapters
- extract data from data source (FreeIPA RPC command result)
- prepares them for commands.

Parsers
- parse extracted data to format expected by field
- parse widget value to format expected by field

Formatters
- format field value to format suitable for widgets
- format field value to format suitable for adapter

Binder
- is a communication bridge between field and widget
- listens to field's and widget's events and call appropriate methods

Some side benefits:
- better validation reporting in multivalued widget

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui: replace widget's hidden property with visible

Hidden was used only in ACI. There is no reason to have two properties
which are negations of each other.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui: change widget updated event into value change event

This change allow us to use proper two way binding between a field and
a widget. In previous implementation field was not changed if something
changed the value of a widget in 'update'. Now listeners are notified
when the widget value is changed by: calling 'update', 'set_value'
or by user change.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
webui-tests: binding test suite

Add basic tests for two-way binding between a field and two widgets

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
schema-compat: set precedence to 49 to allow OTP binds over compat tree

schema-compat plugin rewrites bind DN to point to the original entry
on LDAP bind operation. To work with OTP tokens this requires that
schema-compat's pre-bind callback is called before pre-bind callback of
the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have
a nsslapd-pluginprecedence value lower than (default) 50 which is used
by the ipa-pwd-extop plugin.

Note that this will only work if ticket 47699 is fixed in 389-ds.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
freeipa.spec.in: update dependencies to 389-ds and selinux-policy

389-ds-base 1.3.2.16 implements reordering of sub-plugins based on the
ordering of the main plugin. We need it to make OTP working over
compat tree.

selinux-polic 3.12.1-135 fixes issues which prevented httpd to work
with kernel keyring-based credentials caches.

This change is Fedora 20+.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Add wait_for_dns option to default.conf.

This option makes record changes in DNS tree synchronous.
IPA calls will wait until new data are visible over DNS protocol
or until timeout.

It is intended only for testing. It should prevent tests from
failing if there is bigger delay between changes in LDAP and DNS.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: Make sure that remnants of PKI are removed

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: legacy_clients: Use hostname instead of external hostname for AD subdomain

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: legacy_clients: Relax regex checks

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cache

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow anonymous read access to containers

All nsContainer objects, except ones in cn=etc, can now be read anonymously.
The allowed attributes are cn and objectclass.
These are the same in all IPA installations so they don't provide
any sensitive information.

Also, $SUFFIX itself can now be read anonymously.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Fix upload of CA certificate to LDAP in CA-less install.

https://fedorahosted.org/freeipa/ticket/4300

Reviewed-By: Martin Kosek <mkosek@redhat.com>
CA-less tests generate failure

CA-less test suite always generate failures when installing
revoked certificates. This is a known issue, described in
https://fedorahosted.org/freeipa/ticket/4270 , this fix skips
these tests, outputting a warning for the later ticket.

https://fedorahosted.org/freeipa/ticket/4271

Reviewed-By: Martin Kosek <mkosek@redhat.com>
ipa-pwd-extop: Fix memory leak in ipapwd_pre_bind

We need to free the entry before returning from the function.

https://fedorahosted.org/freeipa/ticket/4295
ipa-range-check: Fix memory leaks when freeing range object

When cleaning the range_info struct, simple free of the struct
is not enough, we have to free contents of char pointers in the
struct as well.

https://fedorahosted.org/freeipa/ticket/4276
Extend ipa-range-check DS plugin to handle range types

The ipa-range-check plugin used to determine the range type depending
on the value of the attributes such as RID or secondary RID base. This
approached caused variety of issues since the portfolio of ID range
types expanded.

The patch makes sure the following rules are implemented:
    * No ID range pair can overlap on base ranges, with exception
      of two ipa-ad-trust-posix ranges belonging to the same forest
    * For any ID range pair of ranges belonging to the same domain:
        * Both ID ranges must be of the same type
        * For ranges of ipa-ad-trust type or ipa-local type:
            * Primary RID ranges can not overlap
        * For ranges of ipa-local type:
            * Primary and secondary RID ranges can not overlap
            * Secondary RID ranges cannot overlap

For the implementation part, the plugin was extended with a domain ID
to forest root domain ID mapping derivation capabilities.

https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>