Add hidden replica feature

A hidden replica is a replica that does not advertise its services via
DNS SRV records, ipa-ca DNS entry, or LDAP. Clients do not auto-select a
hidden replica, but are still free to explicitly connect to it.

Fixes: https://pagure.io/freeipa/issue/7892
Co-authored-by: Francois Cami <fcami@redhat.com>:
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Francois Cami <fcami@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>

install/tools/ipactl.in

@@ -29,6 +29,7 @@ import ldapurl
 from ipaserver.install import service, installutils
 from ipaserver.install.dsinstance import config_dirname
 from ipaserver.install.installutils import is_ipa_configured, ScriptError
+from ipaserver.masters import ENABLED_SERVICE, HIDDEN_SERVICE
 from ipalib import api, errors
 from ipapython.ipaldap import LDAPClient, realm_to_serverid
 from ipapython.ipautil import wait_for_open_ports, wait_for_open_socket
@@ -162,7 +163,16 @@ def version_check():
 
 def get_config(dirsrv):
     base = DN(('cn', api.env.host), ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
-    srcfilter = '(ipaConfigString=enabledService)'
+    srcfilter = LDAPClient.combine_filters(
+        [
+            LDAPClient.make_filter({'objectClass': 'ipaConfigObject'}),
+            LDAPClient.make_filter(
+                {'ipaConfigString': [ENABLED_SERVICE, HIDDEN_SERVICE]},
+                rules=LDAPClient.MATCH_ANY
+            ),
+        ],
+        rules=LDAPClient.MATCH_ALL
+    )
     attrs = ['cn', 'ipaConfigString']
     if not dirsrv.is_running():
         raise IpactlError("Failed to get list of services to probe status:\n" +