We need to inform users when a forms-based login fails due to the
password needing to be reset. Currently there is no way to distinguish
a reset case vs an incorrect password.

This will bind the user using a simple LDAP bind over ldapi (by default)
and if that is successful, check the expiration date against the current
time.

The UI portion of this that uses this message will come later.

https://fedorahosted.org/freeipa/ticket/2608

Amend unit tests to match the latest changes in DNS (tickets 2627,
2628) and hardened exception error message checks.

dnsrecord_add interactive mode did not work correctly when more
than one DNS record part was entered as command line option. It
asked for remaining options more than once. This patch fixes
this situation and also adds tests to cover this use case
properly.

https://fedorahosted.org/freeipa/ticket/2641

The update was failing because of the case insensitivity of permission
object DN. Unit-tests added.

https://fedorahosted.org/freeipa/ticket/2571

Have the test suite check error messages.
Since XMLRPC doesn't give us structured error information, just
compare the resulting text.
Fix messages that tests expect to cause.

Minor changes:

Make netgroup-mod's NotFound message consistent with other objects
and methods.

In test_automember_plugin, test with nonexistent automember rules
of both types, instead of nonexistent users.

https://fedorahosted.org/freeipa/ticket/2549

We use custom gettext classes (e.g. GettextFactory &
NGettextFactory). We should exercise those classes with an installed
binary mo file to demonstrate we are actually returning the expected
translated strings for all strings defined as being translatable.

The test logic in install/po/test_i18n.py was recently enhanced to
make this type of testing easier and more complete.
tests/test_ipalib/test_text.py should import the new i18n test support
and run it.

Previously tests/test_ipalib/test_text.py made a feeble but incomplete
attempt to do the above but even that was often not run because the
test would skip because the necessary test files were not available
unless they had been manually created in the install/po subdir. It is
now possible to correct those deficiencies in the test.

This patch does the following:

* Moves the location of i18n test code and adjust references to it.
  install/po/test_i18n.py was moved to tests/i18n.py. This permits
  tests/test_ipalib/test_text.py to import the i18n test utilities
  in a clean fashion. The Makefile in install/po now calls this
  same file.

* Modfies test function in test_i18n.py to accept function pointers
  for retreiving a translation.

* Imports test_i18n.py from the install/po directory in the tree

* Creates a tmp directory for the test localedir

* Parses the current ipa.pot file in install/po and generates
  a test po and mo file with special unicode markers. It installs
  the test mo file in the tmp localedir. This is accomplished by
  calling create_po() from the test_i18n.py file.

* If any of the above does not work it raises nose.SkipTest with
  the reason, and skips the test.

* It sets up functions to get a translation and a plural translation
  via our text.GettextFactory class and text.NGettextFactory class
  respectively. This are the functions we use intenally to get
  translations. It set the localdir and lang which are used by those
  classes to match our test configuration. It then runs a validation
  test on every translation and it's plural found in the test.po file
  by calling po_file_iterate and passed it the function pointers to
  our internal routines.

* At the conclusion of the test it cleans up after itself.

Note: extraneous files are not created in the tree, only a tmp
directory is utilized.

Validating msgid's in C code was insufficient.

* Make the discovery of format conversions much more robust by authoring
  a new function parse_printf_fmt() that is able to discover each
  format conversion in a string and break it into it's individual
  subparts. One of those subparts is the argument selector index. In c
  code we need to know if the argumenet selector index is present to
  know if translator can reorder the substitution strings.

  This replaces the simplistic python_anonymous_substitutions_regexp
  which was insufficient to deal with other programming languages
  (e.g. c).

* Add get_prog_langs() function to return the set of programming
  languages a msgid appears in. This is necessar because the msdid
  validation is programming language specific.

https://fedorahosted.org/freeipa/ticket/2582

Attribute Patrams marked no_update never get cloned to Update commands,
and thus never receive the `attribute` flag. This makes their `encode`
method a no-op, which meant they don't get properly encoded when used
with --setattr, making the --setattr fail.

Introduce a `force` argument to encode, which overrides checking
for the attribute flag. Use this in set/add/delattr normalization,
where we know we are dealing with attributes.

https://fedorahosted.org/freeipa/ticket/2616

The DN and ACI code doesn't always escape special characters properly.
Rather than trying to fix it, this patch takes the easy way out and
enforces that the names are safe.

https://fedorahosted.org/freeipa/ticket/2585

ticket 2587

Added 'fallback' into the labels for default automember group and
hostgroup.

https://fedorahosted.org/freeipa/ticket/2354