[freeipa PR#2697][opened] LDAPClient: Prefer LDAPI connections in installer and simplify API

[tiran]

   URL: https://github.com/freeipa/freeipa/pull/2697
Author: tiran
 Title: #2697: LDAPClient: Prefer LDAPI connections in installer and simplify API
Action: opened

PR body:
"""
On several occasions the installer uses LDAP + simple_bind rather than LDAPI with EXTERNAL
bind. LDAPI (LDAP over Unix socket) is more secure, a tiny bit faster, and is immune to
some network/DNS related issues.

The changeset simplifies the LDAPClient API by introducing additional constructors. The
new constructors are not only easier to use but also prevent some common pitfalls like
LDAP connection without StartTSL. Several code paths now use
``LDAPClient.from_realm(realm_name)`` with external bind as root instead of LDAP with DM
password.

### Add constructors to ldap client

Add LDAPClient.from_realm(), LDAPClient.from_hostname_secure(), and
LDAPClient.from_hostname_plain() constructors.

The simple_bind() method now also refuses to transmit a password over a
plain, unencrypted line.

LDAPClient.from_hostname_secure() uses start_tls and FreeIPA's CA cert
by default. The constructor also automatically disables start_tls for
ldaps and ldapi connections.

### Use new LDAPClient constructors

Replace get_ldap_uri() + LDAPClient() with new LDAPClient constructors
like LDAPClient.from_realm().

Some places now use LDAPI with external bind instead of LDAP with simple
bind. Although the FQDN *should* resolve to 127.0.0.1 / [::1], there is
no hard guarantee. The draft
tools.ietf.org/html/draft-west-let-localhost-be-localhost-04#section-5.1
specifies that applications must verify that the resulting IP is a
loopback API. LDAPI is always local and a bit more efficient, too.

The simple_bind() method also prevents the caller from sending a
password over an insecure line.

### Use LDAPS when installing CA on replica

On a replica, 389-DS is already configured for secure connections when
the CA is installed.

### Move realm_to_serverid/ldap_uri to ipaldap

The helper function realm_to_serverid() and realm_to_ldap_uri() are
useful outside the server installation framework. They are now in
ipapython.ipaldap along other helpers for LDAP handling in FreeIPA.
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2697/head:pr2697
git checkout pr2697

[freeipa PR#2697][closed] LDAPClient: Prefer LDAPI connections in installer and simplify API

[rcritten]

   URL: https://github.com/freeipa/freeipa/pull/2697
Author: tiran
 Title: #2697: LDAPClient: Prefer LDAPI connections in installer and simplify API
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2697/head:pr2697
git checkout pr2697