Description of problem:
An administrator is able to run ipa-server-install successfully with a domain name like 'thefederation' and an IPA server name 'theenterprise.thefederation'

This is not allowed based on the pre-requisites below, but ipa-server-install succeeds and leads to broken IPA functionality

 https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/installing-ipa.html#dns-reqs

>> Per email discussion on idm mailing list.

The reason we did not I think was that in the early times (pre-Ad trust) it was still not a good idea, but most things would work still.

We definitely need to prevent new installs, we can't break existing installs though, so we'll always need to allow "bad names" with some "force" option so we can reproduce issues with the old setups if needed.

Version-Release number of selected component (if applicable):
ipa-server-4.5

How reproducible:
 ipa-server was installed successfully with this broken configuration