ipa/client: Enable VPN hosts to talk to IPA
    
    This requires the canonical names of IPA servers to be mapped to their
    IP addresses on the VPN as well as specifying the IPA server explicitly
    when enrolling clients.
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>