Changes to use a single database for dogtag and IPA

New servers that are installed with dogtag 10 instances will use
a single database instance for dogtag and IPA, albeit with different
suffixes.  Dogtag will communicate with the instance through a
database user with permissions to modify the dogtag  suffix only.
This user will authenticate using client auth using the subsystem cert
for the instance.

This patch includes changes to allow the creation of masters and clones
with single ds instances.

install/tools/ipa-replica-install

@@ -479,9 +479,19 @@ def main():
 
     installutils.verify_fqdn(config.master_host_name, options.no_host_dns)
 
+    portfile = config.dir + "/dogtag_directory_port.txt"
+    if not ipautil.file_exists(portfile):
+        dogtag_master_ds_port = str(dogtag.Dogtag9Constants.DS_PORT)
+    else:
+        with open(portfile) as fd:
+            dogtag_master_ds_port = fd.read()
+
     # check connection
     if not options.skip_conncheck:
-        replica_conn_check(config.master_host_name, config.host_name, config.realm_name, options.setup_ca, options.admin_password)
+        replica_conn_check(
+            config.master_host_name, config.host_name, config.realm_name,
+            options.setup_ca, dogtag_master_ds_port, options.admin_password)
+
 
     # check replica host IP resolution
     config.ip = installutils.get_server_ip_address(config.host_name, fstore, True, options)
@@ -597,21 +607,26 @@ def main():
         ntp = ntpinstance.NTPInstance()
         ntp.create_instance()
 
+    # Configure dirsrv
+    ds = install_replica_ds(config)
+
     # Configure the CA if necessary
-    (CA, cs) = cainstance.install_replica_ca(config)
+    (CA, cs) = cainstance.install_replica_ca(config, dogtag_master_ds_port)
 
     # Always try to install DNS records
     install_dns_records(config, options)
 
-    # Configure dirsrv
-    ds = install_replica_ds(config)
-
     # We need to ldap_enable the CA now that DS is up and running
     if CA and config.setup_ca:
         CA.ldap_enable('CA', config.host_name, config.dirman_password,
                        ipautil.realm_to_suffix(config.realm_name))
-        cs.add_simple_service('dogtagldap/%s@%s' % (config.host_name, config.realm_name))
-        cs.add_cert_to_service()
+        if not dogtag.install_constants.SHARED_DB:
+            cs.add_simple_service('dogtagldap/%s@%s' %
+                (config.host_name, config.realm_name))
+            cs.add_cert_to_service()
+        else:
+            CA.enable_client_auth_to_db()
+            CA.restart()
 
     krb = install_krb(config, setup_pkinit=options.setup_pkinit)
     http = install_http(config, auto_redirect=options.ui_redirect)