webui: append network.negotiate-auth.trusted-uris

https://fedorahosted.org/freeipa/ticket/4478

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
install: create ff krb extension on every install, replica install and upgrade

We don't want to copy the extension from master to replica because the
replica may use newer version of FreeIPA and therefore the extension
code might be obsolete. Same reason for upgrades.

https://fedorahosted.org/freeipa/ticket/4478

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Update qrcode support for newer python-qrcode

This substantially reduces the FreeIPA dependencies and allows
QR codes to fit in a standard terminal.

https://fedorahosted.org/freeipa/ticket/4430

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Fix typo causing ipa-upgradeconfig to fail.

Replace 'post-certsave-command' by 'cert-postsave-command'.

https://fedorahosted.org/freeipa/ticket/4529

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
webui: add measurement unit to otp token time fields

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better otp token type label

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add token from user page

Add 'Add OTP Token' action to user action menu.

This option is disabled in self-service when viewing other users.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: add i18n for the rest of QR code strings

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: display fields based on otp token type

- in adder dialog

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: better value-change reporting

- widget save() save method should try to always return value even if read only
- report value-change event with actual value to allow processing of the value

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: widget initialization

- used `ctor_init` instead of `init` to avoid name collision with
  existing logic
- `ctor_init` is called right after widget instantiation. Basically support
  better inheritance for the old class system which doesn't have proper
  contructors

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide empty fields and sections

Hide widgets without a value. Must be explicitly turned on. In widget by
`hidden_if_empty` flag. Or globally by `hide_empty_widgets` flag. Global
hiding can be individually turned off by `ignore_empty_hiding` flag.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide non-readable fields

hide widgets if associated field had received attribute level rights
without 'r' right.

Explicit rights are required to avoid hiding of special widgets which
are not associated with any LDAP attribute.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
webui: hide otp fields based on token type

- uses hide empty feature

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
Update SSL ciphers configured in 389-ds-base

use configuration parameters to enable ciphers provided by NSS
and not considered weak.
This requires 389-ds version 1.3.3.2 or later

https://fedorahosted.org/freeipa/ticket/4395

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Update referential integrity config for DS 1.3.3

Hisorically DS provided defaults for the referential
integrity plugin in nsslapd-pluginArg*:

    nsslapd-pluginarg3: member
    nsslapd-pluginarg4: uniquemember
    nsslapd-pluginarg5: owner
    nsslapd-pluginarg6: seeAlso

In 389-ds 1.3.3, the multi-valued referint-membership-attr
is used instead.

The old way still works, but it requires that the values
are numbered consecutively, so IPA's defaults that started
with 7 were not taken into account.

Convert IPA defaults to use referint-membership-attr.

https://fedorahosted.org/freeipa/ticket/4537

Reviewed-By: Martin Kosek <mkosek@redhat.com>
permission plugin: Auto-add operational atttributes to read permissions

The attributes entryusn, createtimestamp, and modifytimestamp
should be readable whenever thir entry is, i.e. when we allow reading
the objectclass.
Automatically add them to every read permission that includes objectclass.

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Allow deleting obsolete permissions; remove operational attribute permissions

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Re-enable uninstall feature for ipa-kra-install

The underlying Dogtag issue (Dogtag ticket 1113) has been fixed.
We can therefore re-enable the uninstall option for ipa-kra-install.
Also, fixes an incorrect path in the ipa-pki-proxy.conf, and adds
a debug statement to provide status to the user when an uninstall
is done.  Also, re-added the no_host_dns option which is used when
unpacking a replica file.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Petr Viktorin <pviktori@redhat.com>