Also remove references to the DP service from the sssd.conf
manpages.

This adds a new option (offline_credentials_expiration) to the
[PAM] section of the sssd.conf

If the user does not perform an online authentication within the
timeout (in days), they will be denied auth once the timeout
passes.

Create and populate user directories on useradd, delete them on userdel

Fixes: #212

First step generate ldap options from ipa options.
Add sssd-ipa man page too.

If auth_provider or access_provider is ont set explicitly id_provider is
used if it can handle auth or access control requests respectively. If
not auth defaults to 'none' and the access_provider is set to 'permit'.

The option 'deny' is added for the access_provider to explicitly deny
access.

- if chpass_provider is not given in the configuration file but an
  auth_provider and the auth_provider can also handle change password
  requests it is used as chpass_provider.

In sssd only local is a native mpg domain, and it is forced.
All other providers will have to unroll mpg users into a user/group pair of
entries in the db. This allows the provider to automatically establish if
the remote server provides mpg users w/o possibily conflicting manual
configurations on the client trying to force an mpg behavior where none
is provided.

- add a hint to the man page about permissions on sssd.conf
- add a test if a symbolic link can be opened

Inits krb5 credentials, if sasl mech is GSSAPI.
Tested with GSSAPI and host keytab as well as user credentials.
Updates also manpages with the new options.