Title: #752: upgrade: add missing DN suffix when enabling KDC proxy
This makes me wonder why don't we just use `self.api.env.basedn` in the
ldap_enable/enable_kdcproxy/enable_pkinit methods but instead rely on 3 ways
how to construct the root DN.
LGTM as a quick fix, but we need to overhaul this part service installers in
See the full comment at
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code