Do case-less comparisons when considering objectclass but store the

current value to prevent unnecessary LPAP updates (and failed writes)

Don't check against these lists on updates, only add them on new entries.

Disable the ability to configure in the UI these values for now.

438256

ipa-server/ipa-gui/ipagui/templates/ipapolicyeditform.kid

@@ -199,6 +199,7 @@ from ipagui.helpers import ipahelper
               py:content="tg.errors.get('ipadefaultemaildomain')" />
           </td>
         </tr>
+      <!--
       <tr>
         <th>
           <label class="fieldlabel" for="${ipapolicy_fields.userobjectclasses.field_id}"
@@ -265,6 +266,7 @@ from ipagui.helpers import ipahelper
           <a id="${ipapolicy_fields.groupobjectclasses.field_id}_doclink" href="javascript:ExpandingForm.addItem('${ipapolicy_fields.groupobjectclasses.field_id}');">Add Group Object Class</a>
         </td>
       </tr>
+      -->
     </table>
 
     <hr/>

ipa-server/ipa-gui/ipagui/templates/ipapolicyshow.kid

@@ -135,6 +135,7 @@ edit_url = tg.url('/ipapolicy/edit')
           </th>
           <td>${ipapolicy.get("ipadefaultemaildomain")}</td>
         </tr>
+        <!--
         <tr>
           <th>
             <label class="fieldlabel" py:content="fields.ipauserobjectclasses.label" />:
@@ -175,6 +176,7 @@ edit_url = tg.url('/ipapolicy/edit')
           </table>
           </td>
         </tr>
+        -->
     </table>
 <hr />
     <input class="submitbutton" type="button"

ipa-server/xmlrpc-server/funcs.py

@@ -998,7 +998,7 @@ class IPAServer:
         config = self.get_ipa_config(opts)
 
         # Make sure we have the latest object classes
-        newentry['objectclass'] = uniq_list(newentry.get('objectclass') + config.get('ipauserobjectclasses'))
+        # newentry['objectclass'] = uniq_list(newentry.get('objectclass') + config.get('ipauserobjectclasses'))
         
         try:
            rv = self.update_entry(oldentry, newentry, opts)
@@ -1628,7 +1628,7 @@ class IPAServer:
         config = self.get_ipa_config(opts)
 
         # Make sure we have the latest object classes
-        newentry['objectclass'] = uniq_list(newentry.get('objectclass') + config.get('ipagroupobjectclasses'))
+        # newentry['objectclass'] = uniq_list(newentry.get('objectclass') + config.get('ipagroupobjectclasses'))
 
         try:
            rv = self.update_entry(oldentry, newentry, opts)
@@ -2136,4 +2136,4 @@ def ldap_search_escape(match):
 def uniq_list(x):
     """Return a unique list, preserving order and ignoring case"""
     set = {}
-    return [set.setdefault(e.lower(),e.lower()) for e in x if e.lower() not in set]
+    return [set.setdefault(e.lower(),e) for e in x if e.lower() not in set]