Up to now the try to deploy an already deployed replica resulted in an
error. Now this ends in an end play and no error is reported.

For consitency the result_ prefix has been added to the registered result
of the py3test.py script.

With the changes for IPA enablement in the replica installer it is not
possible anymore to enable the IPA server in the same way as in the
server deployment.

The new module ipareplica_enable_ipa has been added and the link for
ipaserver_enable_ipa has been removed.

The parameter config_setup_ca has been renamed to setup_ca and added to
options. master_host_name has been added to config. Also a call for
api.Backend.ldap2.connect has been added to make sure that the backend is
connected.

The promote argument has been dropped with the final removal of domain
level 0 support in version 4.7.1. The fstore argument has been added
with the 4.7.1 version also.

The promote argument has been dropped with the final removal of domain
level 0 support in version 4.7.1. The fstore argument has been added
with the 4.7.1 version also.

The promote argument has been dropped with the final removal of domain
level 0 support in version 4.7.1. The fstore argument has been added
with the 4.7.1 version also.

Double imports and also the import of create_replica_config from
ipaserver.install.installutils have been removed. create_replica_config
is not used because the use of domain level 0 is not supported.

ntp_server and ntp_pool are now provided to ipareplica_test. A conflict
test with no_ntp has been added from the normal installer.

Also added are references to options.password and options.dm_password, but
these are commented out and not used or provided to the module.

Proper ntp_servers and ntp_pool tests are needed still.

With FreeIPA 4.7.0 there is no support for domain level 0 anymore, the
check for the minimal domain level should use MIN_DOMAIN_LEVEL instead of
DOMAIN_LEVEL_1.

Since FreeIPA version 4.7.1 there is no install_check defined anymore in
ipaserver.install.server.replicainstall.

The use of ScriptError without an error message but with rval resulted in
very limited information in ansible. The error messages from logger.error
calls have have added to these ScriptError raises.

Removed addtional empty line in ipaclient_setup_sssd sectio

default(omit) is not needed for bool values, as these need to be set either
way.

The __getattr__ method in installer_obj was used for debugging to make
sure that all needed settings in the installer object have been set.

A remain from debugging in ipaclient_test has been removed.

Deploying a client with one-time password use was failing in latest tests
using ansible 2.7 and FreeIPA 4.7 because of an encoding problem.

If the client is already installed and the allow_repair and force_join
options are not set end the playbook processing. This is useful if an
inventory file contains existing and new machines.

The advantage of this is that the krb5 configuration is created in the same
way as in the normal installers. The same functionality as in the normal
installers is used in ipaclient_setup_krb5. There is no need to adapt the
ipa-krb5 role or the the ask file for changes in how the krb5 configuration
is done. Additionally ipaclient_force is now a supported parameter as
it is in the normal installer.

New config option:

ipaclient_force

The variable has been added to ipaclient/defaults/main.yml.

The advantage of this is that the ipa default configuration is created in
the same way as in the normal installers. The same functionality as in the
normal installers is used in ipaclient_ipa_conf.

The no_ prefix for the ssh and sshd settings has been added back. The
naming of the settings should be the same all over the ipcalient role.
The exception is sssd here as it has been deprected and is used from
ipaclient_test.

The name for the setting ssh_trust_dns has been fixed to the command line
option name and not the internl optinos name.

ipaclient_setup_sssd is now using configure_sssd_conf from
ipaclient/install/client.py instead. This simplified the module a lot
and also adds more configuratino options for sssd.

These are new config options supported by ipaclient_setup_sssd:

ipaclient_no_sudo
ipassd_fixed_primary
ipassd_permit
ipassd_enable_dns_updates
ipassd_no_krb5_offline_passwords
ipassd_preserve_sssd

These variables have been added to ipaclient/defaults/main.yml.

The ipaclient_test module was not doing all tests that should be done
with the provided settings. All tests from ipaclient installer parts
are now part of ipaclient_test. There are some minor changes though to
make sure that the repair mode could still be used.

ansible_ipa_client bindings have been updated to fullfill new needs.

The import line of ansible_ipa_client was not correct and used a test
version of the binding that is not possible anymore due to the move of
the module_utils directories into the specific role locations.

The new module ipaclient_setup_ntp to configure and sync time with the NTP
server has been added. The irregular setting ipaclient_ntp has been removed.

The ipaclient_setup_ntp module is using either the new sync_time call or
for compatibility with older FreeIPA versions synconce_ntp.

The reference for ipaclient_ntp in REPLICA.md has been removed also.

This also fixes #55.

ipaclient_extras could configure several things internally according to
provided settings. These have been ssh, sshd, automount, firefox an also
nis. The ssh and sshd configuration is now plocated in ipaclient_setup_ssh,
the automount configuration in ipaclient_setup_automount, the firefox
configuration in ipaclient_setup_firefox and the nis configuration in
ipaclient_setup_nis.

The following additional settings have been added to
roles/ipaclient/defaults/main.yml to provide the same configruation options
as ipa-client-install does:

ipaclient_no_ssh: no
ipaclient_no_sshd: no
ipaclient_no_nisdomain: no
ipaclient_configure_firefox: no

The naming in the ipaclient role has not been following the naming scheme
and conventions used in the ipaserver and ipareplica roles. Also registered
results of modules and commands have not been unsing the result_ prefix as
in the other roles. All this has been fixed and the naming is consistent
now.

These are the renames:

ipahost -> ipaclient_get_otp
ipaapi -> ipaclient_api
ipaextras -> ipaclient_extras
ipafixca -> ipaclient_fix_ca
ipafstore -> ipaclient_fstore
ipa_facts -> ipaclient_get_facts
ipahost -> ipaclient_get_otp
ipajoin -> ipaclient_join
ipanss -> ipaclient_setup_nss
ipasssd -> ipaclient_setup_sssd
ipadiscovery -> ipaclient_test
ipatest -> ipaclient_test_keytab

Move module_utils to role specific locations

The use of the _no_ prefix was not good and has been fixed now.

The X_setup_firewalld settings default to yes.

With these settings for server, replica and client it is possible to skip
package installation. This is for example useful if the packages are already
installed. The settings default to yes

The setting ipareplica_no_package_install has been removed.

Fixes #51 upstream

New information about requirements, limitations, installation and usage

The ipareplica role is reusing the ipaserver_enable_ipa module. This module
needed some extensions on the server to enable the delayed services and
also to dump DNS configuration (see commit a1287265).
For replica it is not needed to dump the DNS configuration, therefore it is
simply possible to set detup_dns to no to make this module also working
for ipareplica.

This typo has been introduced with 20d25d0d in import_tasks for the
Python 2/3 test.

The use of custodiainstance.get_custodia_instance requires that
options.promote exists. As this is a server installation, promote
is set to False.

As the old way to include tasks is deprecated, replace static include
statements with import_tasks and dynamic ones with include_tasks.

Increaded the required ansible version to 2.5.0 to make sure that
include_tasks and import_tasks is working as expected.

Fixes issue #38

ipaserver_setup_adtrust was using api_Backend_ldap2_connect instead of
api_Backend_ldap2 with attribute connect set to True.

Fixes issue #39