We dump the list retriueved from LDAP at strstup in a temporary configuration
file and always use that file afterwards.
We check (possibly different) data from LDAP only at (re)start.
This way we always shutdown exactly the services we started even if the list
changed in the meanwhile (we avoid leaving a service running even if it was
removed from LDAP as the admin decided it should not be started in future).

This should also fix a problematic deadlock with systemd when we try to read
the list of service from LDAP at shutdown.

Simo.

When executing ipa-replica-manage connect to an master that raises
NotFound error we now check if the master is at least IPA server.
If so, we inform the user that it is probably foreign or previously
deleted master. If not, we inform the user that the master is not
an IPA server at all.

https://fedorahosted.org/freeipa/ticket/3105

Fixed typo in message placeholder.

https://fedorahosted.org/freeipa/ticket/3187

Previously, ipa-replica-install tried to check DNS resolution on the master
being cloned. If that master was not a DNS server, the check failed.

Change the check to query the first available configured DNS server.

Log about the check before actually running it.
Log in the case the check is skipped (no IPA DNS servers installed).

https://fedorahosted.org/freeipa/ticket/3194

Correctly handle case where we bind using GSSAPI with an unauthorized user.

Remove extraneous except clause. We now have handle for LDAP errors.

Make it explicit in a few places what server we can't connect to.

When the remote replica is down and we are forcing its removal, remove
a duplicate entry from the list of servers to remove.

https://fedorahosted.org/freeipa/ticket/2871

Report errors just like with ipa-ldap-updater. These messages should warn
user that some parts of the upgrades may have not been successful and
he should follow up on them. Otherwise, user may not notice them at all.

ipa-upgradeconfig now has a new --quiet option to make it output only error
level log messages or higher. ipa-upgradeconfig run without options still
pring INFO log messages as it can provide a clean overview about its
actions (unlike ipa-ldap-updater).

https://fedorahosted.org/freeipa/ticket/3157

Previous fix for ticket #3161 caused ipa-{server,dns}-install to
skip creation of reverse zone when running in unattended mode. Make
sure that reverse zone is created also in unattended mode (unless
--no-reverse is specified).

https://fedorahosted.org/freeipa/ticket/3161

Instructions to generate certificate were simplified.

New instructions:

 1) Create a certificate database or use an existing one. To create a new database:
    # certutil -N -d <database path>
 2) Create a CSR with subject CN=<hostname>,O=<realm>, for example:
    # certutil -R -d <database path> -a -g <key size> -s 'CN=dev.example.com,O=DEV.EXAMPLE.COM'
 3) Copy and paste the CSR (from -----BEGIN NEW CERTIFICATE REQUEST----- to -----END NEW CERTIFICATE REQUEST-----) into the text area below:

https://fedorahosted.org/freeipa/ticket/3056

A reverse zone was always configured in the interactive installer
even if you answered "no" to the reverse zone question. The only way
to not confiugre it was the --no-reverse option.

https://fedorahosted.org/freeipa/ticket/3161

Add uninstall command to the uninstall instructions in the "already
installed" responses of ipa-server-install, ipa-client-install and
ipa-replica-install.

https://fedorahosted.org/freeipa/ticket/3065