RFC: API for reporting PKINIT status

[martbab]

This PR implements easily-consumable API that reports PKINIT status on masters
based on the presence of pkinitEnabled value in KDC entry's ipaConfigString
attribute.

https://pagure.io/freeipa/issue/6937

[HonzaCholasta]

LGTM.

[martbab]

@HonzaCholasta thanks for looking on API, anyone for functional review?

[stlaz]

I'll do it.

[stlaz]

Run on replica:

[slaznick@machine ~]$ ipa help pkinit
ipa: ERROR: TypeError: 'NoneType' object has no attribute '__getitem__'
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1351, in run
    sys.exit(api.Backend.cli.run(argv))
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1105, in run
    kw = self.parse(cmd, argv[1:])
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1125, in parse
    parser = self.build_parser(cmd)
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1142, in build_parser
    usage=' '.join(self.usage_iter(cmd)),
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1220, in usage_iter
    for arg in cmd.args():
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 255, in __get__
    obj.ensure_finalized()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 230, in ensure_finalized
    self.finalize()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 210, in finalize
    self._on_finalize()
  File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 733, in _on_finalize
    if c.NO_CLI:
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 247, in NO_CLI
    halp = self._schema[self.schema_key].get_help(self.full_name)
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 329, in get_help
    return self._schema.get_help(self.name, key)
  File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 520, in get_help
    return self._help[namespace][member]
TypeError: 'NoneType' object has no attribute '__getitem__'
ipa: ERROR: an internal error has occurred

[stlaz]

The above error is not related to this PR.

[stlaz]

Tested like this:

[4.5R no] -- [4.4M no] -- [4.5R no]
            | UPGRADE |
[4.5R no] -- [4.5M yes] -- [4.5R no]
                | |
[4.5R yes] -- [4.5M yes] -- [4.5R no]
                | |
[4.5R yes] -- [4.5M yes] -- [4.5R yes]

and pkinit-status always reported correctly on all servers providing the command.
For a common Franta user, 0 records are shown which I suppose is OK, even though some permission message would probably be better. I guess that's more about the framework though, so I am ACKing this.

[martbab]

Well the command is intended to be used either by administrators or by hosts themselves so I have no problem with unprivileged users not seeing anything. We can fix it in a separate PR if the need arises anyway.

[martbab]

ipa-4-5:

• c4aa3a1 Allow for multivalued server attributes
• 753f8cf Refactor the role/attribute member reporting code
• fbccb74 Add an attribute reporting client PKINIT-capable servers
• 733cef9 Add the list of PKINIT servers as a virtual attribute to global config
• 6b815aa Add pkinit-status command
• 4fa29a3 test_serverroles: Get rid of MockLDAP and use ldap2 instead

master:

• bddb90f Allow for multivalued server attributes
• cac7e49 Refactor the role/attribute member reporting code
• d8bb23a Add an attribute reporting client PKINIT-capable servers
• f805532 Add the list of PKINIT servers as a virtual attribute to global config
• 9935273 Add pkinit-status command
• 58fd229 test_serverroles: Get rid of MockLDAP and use ldap2 instead