ipa-migrate: avoid KeyError before attributes are normalized

The ipa-migrate tool reads the content of the source LDAP server
and processes the entries. When the entry is a tombstone it must be
discarded.

In order to detect if the entry is a tombstone, the code checks
if the objectclass attribute contains the value 'nsTombstone'.
The problem is that the key ('objectClass') is not normalized
and may either be 'objectclass' (all lowercase) or 'objectClass'.
Take both cases into account and avoid KeyError exception by
normalizing the attribute + looking for case-insensitive value.

Fixes: https://pagure.io/freeipa/issue/9910
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mark Reynolds <mreynolds@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipaserver/install/ipa_migrate.py

@@ -1472,7 +1472,9 @@ class IPAMigrate():
                 return
 
         # Skip tombstones
-        if 'nsTombstone' in entry_attrs['objectClass']:
+        # The attributes haven't been normalized yet
+        normalize_attr(entry_attrs, 'objectClass')
+        if 'nstombstone' in [oc.lower() for oc in entry_attrs['objectClass']]:
             return
 
         # Determine entry type: user, group, hbac, etc