Allow SASL/EXTERNAL authentication for the root user

This gives the root user low privileges so that when anonymous searches are
denied the init scripts can still search the directory via ldapi to get the
list of serevices to start.

Fixes: https://fedorahosted.org/freeipa/ticket/795

ipaserver/install/dsinstance.py

@@ -207,6 +207,7 @@ class DsInstance(service.Service):
         self.step("creating indices", self.__create_indices)
         self.step("configuring ssl for ds instance", self.__enable_ssl)
         self.step("configuring certmap.conf", self.__certmap_conf)
+        self.step("configure autobind for root", self.__root_autobind)
         self.step("restarting directory server", self.__restart_instance)
 
     def __common_post_setup(self):
@@ -728,3 +729,7 @@ class DsInstance(service.Service):
 
     def __tuning(self):
         self.tune_nofile(8192)
+
+    def __root_autobind(self):
+        self._ldap_mod("root-autobind.ldif")
+