Use the Output tuple to determine the order of output

The attributes displayed is now dependant upon their definition in
a Param. This enhances that, giving some level of control over how
the result is displayed to the user.

This also fixes displaying group membership, including failures of
adding/removing entries.

All tests pass now though there is still one problem. We need to
return the dn as well. Once that is fixed we just need to comment
out all the dn entries in the tests and they should once again
pass.

24 files changed, 389 insertions, 162 deletions

diff --git a/ipalib/__init__.py b/ipalib/__init__.py
index 83956e16d..beaf0ab51 100644
--- a/ipalib/__init__.py
+++ b/ipalib/__init__.py
@@ -584,9 +584,9 @@ For example, say we setup a command like this:
 ...
 ...     def execute(self, key, **options):
 ...         items = dict(
-...             fruit='apple',
-...             pet='dog',
-...             city='Berlin',
+...             fruit=u'apple',
+...             pet=u'dog',
+...             city=u'Berlin',
 ...         )
 ...         if key in items:
 ...             return dict(result=items[key])
@@ -627,9 +627,9 @@ through the ``ipa`` script basically will do the following:
 -----------
 show-items:
 -----------
-  city = 'Berlin'
-  fruit = 'apple'
-  pet = 'dog'
+  city = u'Berlin'
+  fruit = u'apple'
+  pet = u'dog'
 -------
 3 items
 -------
@@ -641,9 +641,9 @@ Similarly, calling it with ``reverse=True``  would result in the following:
 -----------
 show-items:
 -----------
-  pet = 'dog'
-  fruit = 'apple'
-  city = 'Berlin'
+  pet = u'dog'
+  fruit = u'apple'
+  city = u'Berlin'
 --------------------------
 3 items (in reverse order)
 --------------------------
@@ -652,7 +652,7 @@ Lastly, providing a ``key`` would result in the following:
 
 >>> result = api.Command.show_items(u'city')
 >>> api.Command.show_items.output_for_cli(textui, result, 'city', reverse=False)
-city = 'Berlin'
+city = u'Berlin'
 
 See the `ipalib.cli.textui` plugin for a description of its methods.
 
diff --git a/ipalib/cli.py b/ipalib/cli.py
index b3980945b..d8c4b8058 100644
--- a/ipalib/cli.py
+++ b/ipalib/cli.py
@@ -144,7 +144,6 @@ class textui(backend.Backend):
         Convert a binary value to base64. We know a value is binary
         if it is a python str type, otherwise it is a plain string.
         """
-        assert isinstance(value, basestring)
         if type(value) is str:
             return base64.b64encode(value)
         else:
@@ -231,15 +230,15 @@ class textui(backend.Backend):
 
         >>> items = [
         ...     ('in_server', True),
-        ...     ('mode', 'production'),
+        ...     ('mode', u'production'),
         ... ]
         >>> ui = textui()
         >>> ui.print_keyval(items)
           in_server = True
-          mode = 'production'
+          mode = u'production'
         >>> ui.print_keyval(items, indent=0)
         in_server = True
-        mode = 'production'
+        mode = u'production'
 
         Also see `textui.print_indented`.
         """
@@ -354,7 +353,11 @@ class textui(backend.Backend):
             if isinstance(value, (list, tuple)):
                 value = map(lambda v: self.encode_binary(v), value)
                 value = ', '.join(value)
-            self.print_indented(format % (label, value), indent)
+            if isinstance(value, dict):
+                self.print_indented(format % (label, ''), indent)
+                self.print_entry(value, params, indent=indent+1)
+            else:
+                self.print_indented(format % (label, value), indent)
 
 
     def print_dashed(self, string, above=True, below=True, indent=0, dash='-'):
diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index ae7ec9454..0a1566e49 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -824,16 +824,27 @@ class Command(HasParam):
         result = output.get('result')
         summary = output.get('summary')
 
-        if (summary and isinstance(result, (list, tuple, dict)) and result):
-            textui.print_name(self.name)
-
-        if isinstance(result, (tuple, list)):
-            textui.print_entries(result, self.output_params)
-        elif isinstance(result, dict):
-            textui.print_entry(result, self.output_params)
+        for o in self.output:
+            if 'no_display' in self.output[o].flags:
+                continue
+            result = output[o]
+
+            if isinstance(result, (tuple, list)):
+                textui.print_entries(result, self.output_params)
+            elif isinstance(result, dict):
+                textui.print_entry(result, self.output_params)
+            elif isinstance(result, unicode):
+                if o == 'summary':
+                    textui.print_summary(result)
+                else:
+                    textui.print_indented(result)
+            elif isinstance(result, bool):
+                # the Delete commands return a boolean indicating
+                # success or failure. Ignore these.
+                pass
+            elif isinstance(result, int):
+                textui.print_count(result, '%s %%d' % self.output[o].doc)
 
-        if isinstance(summary, unicode):
-            textui.print_summary(summary)
 
 
 class LocalOrRemote(Command):
diff --git a/ipalib/output.py b/ipalib/output.py
index 425ff977c..757e7155e 100644
--- a/ipalib/output.py
+++ b/ipalib/output.py
@@ -29,18 +29,55 @@ from plugable import ReadOnly, lock
 class Output(ReadOnly):
     """
     Simple description of a member in the return value ``dict``.
+
+    This class controls both the type of object being returned by
+    a command as well as how the output will be displayed.
+
+    For example, this class defines two return results: an entry
+    and a value.
+
+    >>> from ipalib import crud, output
+    >>> class user(crud.Update):
+    ...
+    ...     has_output = (
+    ...         output.Entry('result'),
+    ...         output.value,
+    ...     )
+
+    The order of the values in has_output controls the order of output.
+    If you have values that you don't want to be printed then add
+    ``'no_display'`` to flags.
+
+    The difference between ``'no_dipslay`` and ``'no_output'`` is
+    that ``'no_output`` will prevent a Param value from being returned
+    at all. ``'no_display'`` will cause the API to return a value, it
+    simply won't be displayed to the user. This is so some things may
+    be returned that while not interesting to us, but may be to others.
+
+    >>> from ipalib import crud, output
+    >>> myvalue = output.Output('myvalue', unicode,
+    ...     'Do not print this value', flags=['no_display'],
+    ... )
+    >>> class user(crud.Update):
+    ...
+    ...     has_output = (
+    ...         output.Entry('result'),
+    ...         myvalue,
+    ...     )
     """
 
     type = None
     validate = None
     doc = None
+    flags = []
 
-    def __init__(self, name, type=None, doc=None):
+    def __init__(self, name, type=None, doc=None, flags=[]):
         self.name = name
         if type is not None:
             self.type = type
         if doc is not None:
             self.doc = doc
+        self.flags = flags
         lock(self)
 
     def __repr__(self):
@@ -77,28 +114,29 @@ summary = Output('summary', (unicode, NoneType),
 )
 
 value = Output('value', unicode,
-    "The primary_key value of the entry, e.g. 'jdoe' for a user"
+    "The primary_key value of the entry, e.g. 'jdoe' for a user",
+    flags=['no_display'],
 )
 
-standard = (result, summary)
+standard = (summary, result)
 
 standard_entry = (
+    summary,
     Entry('result'),
     value,
-    summary,
 )
 
 standard_list_of_entries = (
+    summary,
     ListOfEntries('result'),
     Output('count', int, 'Number of entries returned'),
     Output('truncated', bool, 'True if not all results were returned'),
-    summary,
 )
 
 standard_delete = (
+    summary,
     Output('result', bool, 'True means the operation was successful'),
     value,
-    summary,
 )
 
 standard_value = standard_delete
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index eeea7a6c4..964f8e5d9 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -102,7 +102,7 @@ class LDAPObject(Object):
                 for ldap_obj_name in self.attribute_members[attr]:
                     ldap_obj = self.api.Object[ldap_obj_name]
                     if member.find(ldap_obj.container_dn) > 0:
-                        new_attr = '%s %s' % (attr, ldap_obj.object_name)
+                        new_attr = '%s_%s' % (attr, ldap_obj.object_name)
                         entry_attrs.setdefault(new_attr, []).append(
                             ldap_obj.get_primary_key_from_dn(member)
                         )
@@ -521,14 +521,14 @@ class LDAPAddMember(LDAPModMember):
 
     has_output = (
         output.Entry('result'),
-        output.Output('completed',
-            type=int,
-            doc='Number of members added',
-        ),
         output.Output('failed',
             type=dict,
             doc='Members that could not be added',
         ),
+        output.Output('completed',
+            type=int,
+            doc='Number of members added',
+        ),
     )
 
 
@@ -557,7 +557,7 @@ class LDAPAddMember(LDAPModMember):
                     else:
                         completed += 1
 
-        (dn, entry_attrs) = ldap.get_entry(dn, member_dns.keys())
+        (dn, entry_attrs) = ldap.get_entry(dn, member_dns.keys()+self.obj.default_attributes)
 
         (completed, dn) = self.post_callback(
             ldap, completed, failed, dn, entry_attrs, *keys, **options
diff --git a/ipalib/plugins/cert.py b/ipalib/plugins/cert.py
index 55b3b70bb..3931d214a 100644
--- a/ipalib/plugins/cert.py
+++ b/ipalib/plugins/cert.py
@@ -35,12 +35,12 @@ from ipalib.plugins.virtual import *
 from ipalib.plugins.service import split_principal
 import base64
 from ipalib.request import context
-from ipapython import dnsclient
 from pyasn1.error import PyAsn1Error
 import logging
 import traceback
 from ipalib.request import ugettext as _
 from ipalib.request import context
+from ipalib.output import Output
 
 def get_serial(certificate):
     """
@@ -184,6 +184,25 @@ class cert_request(VirtualCommand):
             default=False,
             autofill=True
         ),
+        Str('certificate?',
+            label='Certificate',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('subject?',
+            label='Subject',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('serial_number?',
+            label='Serial number',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
+
+    has_output = (
+        Output('result',
+            type=dict,
+            doc='Dictionary mapping variable name to value',
+        ),
     )
 
     def execute(self, csr, **kw):
@@ -268,7 +287,11 @@ class cert_request(VirtualCommand):
             serial = get_serial(base64.b64encode(service['usercertificate'][0]))
             # revoke the certificate and remove it from the service
             # entry before proceeding
-            api.Command['cert_revoke'](unicode(serial), revocation_reason=4)
+            try:
+                api.Command['cert_revoke'](unicode(serial), revocation_reason=4)
+            except errors.NotImplementedError:
+                # some CA's might not implement revoke
+                pass
             api.Command['service_mod'](principal, usercertificate=None)
 
         # Request the certificate
@@ -299,7 +322,18 @@ class cert_status(VirtualCommand):
     Check status of a certificate signing request.
     """
 
-    takes_args = ('request_id')
+    takes_args = (
+        Str('request_id',
+            label='Request id',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
+    takes_options = (
+        Str('cert_request_status?',
+            label='Request status',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
     operation = "certificate status"
 
 
@@ -318,7 +352,19 @@ class cert_get(VirtualCommand):
     """
 
     takes_args = (Str('serial_number',
+                      label='Serial number',
                       doc='serial number in decimal or if prefixed with 0x in hexadecimal'))
+    takes_options = (
+        Str('certificate?',
+            label='Certificate',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('subject?',
+            label='Subject',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
+
     operation="retrieve certificate"
 
     def execute(self, serial_number):
@@ -337,6 +383,12 @@ class cert_revoke(VirtualCommand):
 
     takes_args = (Str('serial_number',
                       doc='serial number in decimal or if prefixed with 0x in hexadecimal'))
+    takes_options = (
+        Flag('revoked?',
+            label='Revoked',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
     operation = "revoke certificate"
 
     # FIXME: The default is 0.  Is this really an Int param?
@@ -366,6 +418,16 @@ class cert_remove_hold(VirtualCommand):
 
     takes_args = (Str('serial_number',
                       doc='serial number in decimal or if prefixed with 0x in hexadecimal'))
+    takes_options = (
+        Flag('unrevoked?',
+            label='Unrevoked',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('error_string?',
+            label='Error',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+    )
     operation = "certificate remove hold"
 
     def execute(self, serial_number, **kw):
diff --git a/ipalib/plugins/group.py b/ipalib/plugins/group.py
index 0cc42a7a6..a04330cc8 100644
--- a/ipalib/plugins/group.py
+++ b/ipalib/plugins/group.py
@@ -43,12 +43,12 @@ class group(LDAPObject):
     attribute_names = {
         'cn': 'name',
         'gidnumber': 'group id',
-        'member user': 'member users',
-        'member group': 'member groups',
-        'memberof group': 'member of groups',
-        'memberof netgroup': 'member of netgroups',
-        'memberof rolegroup': 'member of rolegroup',
-        'memberof taskgroup': 'member of taskgroup',
+        'member_user': 'member users',
+        'member_group': 'member groups',
+        'memberof_group': 'member of groups',
+        'memberof_netgroup': 'member of netgroups',
+        'memberof_rolegroup': 'member of rolegroup',
+        'memberof_taskgroup': 'member of taskgroup',
     }
     attribute_members = {
         'member': ['user', 'group'],
@@ -74,6 +74,26 @@ class group(LDAPObject):
             label='GID',
             doc='GID (use this option to set it manually)',
         ),
+        Str('member_group?',
+            label='Member Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member_user?',
+            label='Member Users',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member?',
+            label='Failed Members',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('user?',
+            label='Users',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('group?',
+            label='Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
 api.register(group)
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index 7e9dd90ba..c459cfe09 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -54,8 +54,8 @@ class host(LDAPObject):
     object_class = ['ipaobject', 'nshost', 'ipahost', 'pkiuser', 'ipaservice']
     # object_class_config = 'ipahostobjectclasses'
     default_attributes = [
-        'fqdn', 'description', 'l', 'nshostlocation',
-        'nshardwareplatform', 'nsosversion', 'usercertificate',
+        'fqdn', 'description', 'l', 'nshostlocation', 'krbprincipalname',
+        'nshardwareplatform', 'nsosversion', 'usercertificate', 'memberof',
     ]
     uuid_attribute = 'ipauniqueid'
     attribute_names = {
@@ -70,9 +70,9 @@ class host(LDAPObject):
         'enrolledby user': 'enrolled by',
         'krbprincipalname': 'kerberos principal',
         'ipauniqueid': 'unique identifier',
-        'memberof hostgroup': 'member of hostgroups',
-        'memberof netgroup': 'member of netgroups',
-        'memberof rolegroup': 'member of rolegroups',
+        'memberof_hostgroup': 'member of hostgroups',
+        'memberof_netgroup': 'member of netgroups',
+        'memberof_rolegroup': 'member of rolegroups',
     }
     attribute_members = {
         'enrolledby': ['user'],
@@ -93,7 +93,7 @@ class host(LDAPObject):
             label='Description',
             doc='Description of the host',
         ),
-        Str('locality?',
+        Str('l?',
             cli_name='locality',
             label='Locality',
             doc='Locality of the host (Baltimore, MD)',
@@ -122,6 +122,22 @@ class host(LDAPObject):
             cli_name='certificate',
             doc='base-64 encoded server certificate',
         ),
+        Str('krbprincipalname?',
+            label='Principal Name',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('memberof_hostgroup?',
+            label='Member of Host Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('memberof_netgroup?',
+            label='Member Net Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('memberof_rolegroup?',
+            label='Member of Role Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
     def get_dn(self, *keys, **options):
diff --git a/ipalib/plugins/hostgroup.py b/ipalib/plugins/hostgroup.py
index 7accca621..5a723b8c8 100644
--- a/ipalib/plugins/hostgroup.py
+++ b/ipalib/plugins/hostgroup.py
@@ -37,9 +37,9 @@ class hostgroup(LDAPObject):
     uuid_attribute = 'ipauniqueid'
     attribute_names = {
         'cn': 'names',
-        'member host': 'member hosts',
-        'member hostgroup': 'member hostgroups',
-        'memberof hostgroup': 'member of hostgroup',
+        'member_host': 'member hosts',
+        'member_hostgroup': 'member hostgroups',
+        'memberof_hostgroup': 'member of hostgroup',
     }
     attribute_members = {
         'member': ['host', 'hostgroup'],
@@ -61,6 +61,18 @@ class hostgroup(LDAPObject):
             label='Description',
             doc='A description of this group',
         ),
+        Str('member_host?',
+            label='Member Hosts',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member_hostgroup?',
+            label='Member Host Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('memberof_hostgroup?',
+            label='Member of Hostgroups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
 api.register(hostgroup)
diff --git a/ipalib/plugins/netgroup.py b/ipalib/plugins/netgroup.py
index 094a6d870..767bc1b35 100644
--- a/ipalib/plugins/netgroup.py
+++ b/ipalib/plugins/netgroup.py
@@ -34,22 +34,21 @@ class netgroup(LDAPObject):
     object_name = 'netgroup'
     object_name_plural = 'netgroups'
     object_class = ['ipaobject', 'ipaassociation', 'ipanisnetgroup']
-    default_attributes = ['cn', 'description', 'member', 'memberof']
+    default_attributes = ['cn', 'description', 'member', 'memberof', 'externalhost']
     uuid_attribute = 'ipauniqueid'
     attribute_names = {
         'cn': 'name',
-        'member user': 'member users',
-        'member group': 'member groups',
-        'member host': 'member hosts',
-        'member hostgroup': 'member hostgroups',
-        'member netgroup': 'member netgroups',
-        'memberof netgroup': 'member of netgroups',
-        'externalhost': 'external hosts',
+        'member_user': 'member users',
+        'member_group': 'member groups',
+        'member_host': 'member hosts',
+        'member_hostgroup': 'member hostgroups',
+        'member_netgroup': 'member netgroups',
+        'memberof_netgroup': 'member of netgroups',
+        'externalhost': 'externalhost',
     }
     attribute_members = {
         'member': ['user', 'group', 'host', 'hostgroup', 'netgroup'],
         'memberof': ['netgroup'],
-        'externalhost': [],
     }
 
     label = _('Net Groups')
@@ -72,6 +71,14 @@ class netgroup(LDAPObject):
             label='NIS domain name',
             doc='NIS domain name',
         ),
+        Str('member_host?',
+            label='Member Host',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('externalhost?',
+            label='External Host',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
     def get_dn(self, *keys, **kwargs):
diff --git a/ipalib/plugins/rolegroup.py b/ipalib/plugins/rolegroup.py
index ea89aa519..bf21e23c0 100644
--- a/ipalib/plugins/rolegroup.py
+++ b/ipalib/plugins/rolegroup.py
@@ -36,11 +36,11 @@ class rolegroup(LDAPObject):
     default_attributes = ['cn', 'description', 'member', 'memberof']
     attribute_names = {
         'cn': 'name',
-        'member user': 'member users',
-        'member group': 'member groups',
-        'member host': 'member hosts',
-        'member hostgroup': 'member hostgroups',
-        'memberof taskgroup': 'member of taskgroup',
+        'member_user': 'member users',
+        'member_group': 'member groups',
+        'member_host': 'member hosts',
+        'member_hostgroup': 'member hostgroups',
+        'memberof_taskgroup': 'member of taskgroup',
     }
     attribute_members = {
         'member': ['user', 'group', 'host', 'hostgroup'],
@@ -62,6 +62,18 @@ class rolegroup(LDAPObject):
             label='Description',
             doc='A description of this rolegroup',
         ),
+        Str('member_group?',
+            label='Member Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member_user?',
+            label='Member Users',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('memberof_taskgroup?',
+            label='Member of Task Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
 api.register(rolegroup)
diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py
index a5de17b3a..d7c795ba3 100644
--- a/ipalib/plugins/service.py
+++ b/ipalib/plugins/service.py
@@ -123,12 +123,14 @@ class service(LDAPObject):
 
     takes_params = (
         Str('krbprincipalname', validate_principal,
+            label='Principal',
             cli_name='principal',
             doc='service principal',
             primary_key=True,
             normalizer=lambda value: normalize_principal(value),
         ),
         Bytes('usercertificate?', validate_certificate,
+            label='Certificate',
             cli_name='certificate',
             doc='base-64 encoded server certificate',
         ),
@@ -141,6 +143,7 @@ class service_add(LDAPCreate):
     """
     Add new service.
     """
+    msg_summary = _('Added service "%(value)s"')
     member_attributes = ['managedby']
     takes_options = (
         Flag('force',
@@ -187,6 +190,7 @@ class service_del(LDAPDelete):
     """
     Delete an existing service.
     """
+    msg_summary = _('Deleted service "%(value)s"')
     member_attributes = ['managedby']
     def pre_callback(self, ldap, dn, *keys, **options):
         if self.api.env.enable_ra:
diff --git a/ipalib/plugins/taskgroup.py b/ipalib/plugins/taskgroup.py
index a39f5c004..afdbf6561 100644
--- a/ipalib/plugins/taskgroup.py
+++ b/ipalib/plugins/taskgroup.py
@@ -37,9 +37,9 @@ class taskgroup(LDAPObject):
     default_attributes = ['cn', 'description', 'member', 'memberof']
     attribute_names = {
         'cn': 'name',
-        'member user': 'member users',
-        'member group': 'member groups',
-        'member rolegroup': 'member rolegroups',
+        'member_user': 'member users',
+        'member_group': 'member groups',
+        'member_rolegroup': 'member rolegroups',
         # FIXME: 'memberof ???': 'member of ???'
     }
     attribute_members = {
@@ -62,6 +62,18 @@ class taskgroup(LDAPObject):
             label='Description',
             doc='taskgroup description',
         ),
+        Str('member_group?',
+            label='Member Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member_user?',
+            label='Member Users',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
+        Str('member_rolegroup?',
+            label='Member Role Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
 api.register(taskgroup)
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index c06a9280f..00d64c7e4 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -38,7 +38,7 @@ class user(LDAPObject):
     object_class_config = 'ipauserobjectclasses'
     default_attributes = [
         'uid', 'givenname', 'sn', 'homedirectory', 'loginshell', 'ou',
-        'telephonenumber', 'title',
+        'telephonenumber', 'title', 'memberof',
     ]
     uuid_attribute = 'ipauniqueid'
     attribute_names = {
@@ -53,10 +53,10 @@ class user(LDAPObject):
         'krbpasswordexpiration': 'password expiration',
         'uidnumber': 'uid number',
         'gidnumber': 'gid number',
-        'memberof group': 'member of groups',
-        'memberof netgroup': 'member of netgroups',
-        'memberof rolegroup': 'member of rolegroups',
-        'memberof taskgroup': 'member of taskgroups',
+        'memberof_group': 'member of groups',
+        'memberof_netgroup': 'member of netgroups',
+        'memberof_rolegroup': 'member of rolegroups',
+        'memberof_taskgroup': 'member of taskgroups',
         'ipauniqueid': 'unique identifier'
     }
     attribute_order = [
@@ -128,6 +128,10 @@ class user(LDAPObject):
             cli_name='street',
             label='Street address',
         ),
+        Str('memberof_group?',
+            label='Groups',
+            flags=['no_create', 'no_update', 'no_search'],
+        ),
     )
 
 api.register(user)
diff --git a/tests/test_xmlrpc/objectclasses.py b/tests/test_xmlrpc/objectclasses.py
index 5f95cd7b5..857147dc3 100644
--- a/tests/test_xmlrpc/objectclasses.py
+++ b/tests/test_xmlrpc/objectclasses.py
@@ -29,6 +29,7 @@ user = [
     u'inetuser',
     u'posixaccount',
     u'krbprincipalaux',
+    u'krbticketpolicyaux',
     u'radiusprofile',
     u'ipaobject',
 ]
diff --git a/tests/test_xmlrpc/test_group_plugin.py b/tests/test_xmlrpc/test_group_plugin.py
index a6d98f698..8f2b207c5 100644
--- a/tests/test_xmlrpc/test_group_plugin.py
+++ b/tests/test_xmlrpc/test_group_plugin.py
@@ -110,6 +110,7 @@ class test_group(Declarative):
             ),
             expected=dict(
                 result=dict(
+                    cn=[group1],
                     description=[u'New desc 1'],
                 ),
                 summary=u'Modified group "testgroup1"',
@@ -143,8 +144,6 @@ class test_group(Declarative):
                 result=dict(
                     cn=[group1],
                     description=[u'New desc 1'],
-                    objectclass=objectclasses.group + [u'posixgroup'],
-                    ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
                 ),
                 value=group1,
@@ -177,6 +176,7 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     dict(
+                        #dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
                         cn=[group1],
                         description=[u'New desc 1'],
                         gidnumber=[fuzzy_digits],
@@ -261,6 +261,7 @@ class test_group(Declarative):
             ),
             expected=dict(
                 result=dict(
+                    cn=[group2],
                     description=[u'New desc 2'],
                 ),
                 summary=u'Modified group "testgroup2"',
@@ -292,6 +293,7 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     dict(
+                        #dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
                         cn=[group2],
                         description=[u'New desc 2'],
                     ),
@@ -310,27 +312,32 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     {
-                        'member user': [u'admin'],
+                        #'dn': u'cn=admins,cn=groups,cn=accounts,%s' % api.env.basedn,
+                        'member_user': [u'admin'],
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'admins'],
                         'description': [u'Account administrators group'],
                     },
                     {
+                        #'dn': u'cn=ipausers,cn=groups,cn=accounts,%s' % api.env.basedn,
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'ipausers'],
                         'description': [u'Default group for all users'],
                     },
                     {
+                        #'dn': u'cn=editors,cn=groups,cn=accounts,%s' % api.env.basedn,
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'editors'],
                         'description': [u'Limited admins who can edit other users'],
                     },
                     dict(
+                        #dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
                         cn=[group1],
                         description=[u'New desc 1'],
                         gidnumber=[fuzzy_digits],
                     ),
                     dict(
+                        #dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
                         cn=[group2],
                         description=[u'New desc 2'],
                     ),
@@ -355,7 +362,11 @@ class test_group(Declarative):
                         user=tuple(),
                     ),
                 ),
-                result={'member group': (group2,)},
+                result={'member_group': (group2,),
+                        'gidnumber': [fuzzy_digits],
+                        'cn': [group1],
+                        'description': [u'New desc 1'],
+                },
             ),
         ),
 
@@ -373,7 +384,11 @@ class test_group(Declarative):
                         user=tuple(),
                     ),
                 ),
-                result={'member group': (group2,)},
+                result={'member_group': (group2,),
+                        'gidnumber': [fuzzy_digits],
+                        'cn': [group1],
+                        'description': [u'New desc 1'],
+                },
             ),
         ),
 
diff --git a/tests/test_xmlrpc/test_hbac_plugin.py b/tests/test_xmlrpc/test_hbac_plugin.py
index aa7bb78a4..1edce4677 100644
--- a/tests/test_xmlrpc/test_hbac_plugin.py
+++ b/tests/test_xmlrpc/test_hbac_plugin.py
@@ -178,8 +178,8 @@ class test_hbac(XMLRPC_test):
         assert 'group' in failed['memberuser']
         assert not failed['memberuser']['group']
         entry = ret['result']
-        assert_attr_equal(entry, 'memberuser user', self.test_user)
-        assert_attr_equal(entry, 'memberuser group', self.test_group)
+        assert_attr_equal(entry, 'memberuser_user', self.test_user)
+        assert_attr_equal(entry, 'memberuser_group', self.test_group)
 
     def test_9_hbac_remove_user(self):
         """
@@ -196,8 +196,8 @@ class test_hbac(XMLRPC_test):
         assert 'group' in failed['memberuser']
         assert not failed['memberuser']['group']
         entry = ret['result']
-        assert 'memberuser user' not in entry
-        assert 'memberuser group' not in entry
+        assert 'memberuser_user' not in entry
+        assert 'memberuser_group' not in entry
 
     def test_a_hbac_add_host(self):
         """
@@ -214,8 +214,8 @@ class test_hbac(XMLRPC_test):
         assert 'hostgroup' in failed['memberhost']
         assert not failed['memberhost']['hostgroup']
         entry = ret['result']
-        assert_attr_equal(entry, 'memberhost host', self.test_host)
-        assert_attr_equal(entry, 'memberhost hostgroup', self.test_hostgroup)
+        assert_attr_equal(entry, 'memberhost_host', self.test_host)
+        assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup)
 
     def test_b_hbac_remove_host(self):
         """
@@ -232,8 +232,8 @@ class test_hbac(XMLRPC_test):
         assert 'hostgroup' in failed['memberhost']
         assert not failed['memberhost']['hostgroup']
         entry = ret['result']
-        assert 'memberhost host' not in res[1]
-        assert 'memberhost hostgroup' not in res[1]
+        assert 'memberhost_host' not in res[1]
+        assert 'memberhost_hostgroup' not in res[1]
 
     def test_a_hbac_add_sourcehost(self):
         """
@@ -250,8 +250,8 @@ class test_hbac(XMLRPC_test):
         assert 'hostgroup' in failed['sourcehost']
         assert not failed['sourcehost']['hostgroup']
         entry = ret['result']
-        assert_attr_equal(entry, 'sourcehost host', self.test_host)
-        assert_attr_equal(entry, 'sourcehost hostgroup', self.test_hostgroup)
+        assert_attr_equal(entry, 'sourcehost_host', self.test_host)
+        assert_attr_equal(entry, 'sourcehost_hostgroup', self.test_hostgroup)
 
     def test_b_hbac_remove_host(self):
         """
diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py
index 167481a45..753e3d2c1 100644
--- a/tests/test_xmlrpc/test_host_plugin.py
+++ b/tests/test_xmlrpc/test_host_plugin.py
@@ -65,7 +65,7 @@ class test_host(Declarative):
             command=('host_add', [fqdn1],
                 dict(
                     description=u'Test host 1',
-                    localityname=u'Undisclosed location 1',
+                    l=u'Undisclosed location 1',
                 ),
             ),
             expected=dict(
@@ -73,14 +73,11 @@ class test_host(Declarative):
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
                     dn=dn1,
-                    cn=[fqdn1],  # FIXME: we should only return fqdn
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
-                    localityname=[u'Undisclosed location 1'],
+                    l=[u'Undisclosed location 1'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
-                    serverhostname=[u'testhost1'],
                     objectclass=objectclasses.host,
-                    managedby=[dn1],
                     ipauniqueid=[fuzzy_uuid],
                 ),
             ),
@@ -109,7 +106,8 @@ class test_host(Declarative):
                     dn=dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
-                    localityname=[u'Undisclosed location 1'],
+                    l=[u'Undisclosed location 1'],
+                    krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                 ),
             ),
         ),
@@ -150,9 +148,11 @@ class test_host(Declarative):
                 summary=u'1 host matched',
                 result=[
                     dict(
+                        #dn=dn1,
                         fqdn=[fqdn1],
                         description=[u'Test host 1'],
-                        localityname=[u'Undisclosed location 1'],
+                        l=[u'Undisclosed location 1'],
+                        krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                     ),
                 ],
             ),
@@ -195,6 +195,9 @@ class test_host(Declarative):
                 summary=u'Modified host "%s"' % fqdn1,
                 result=dict(
                     description=[u'Updated host 1'],
+                    fqdn=[fqdn1],
+                    l=[u'Undisclosed location 1'],
+                    krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                 ),
             ),
         ),
@@ -210,7 +213,8 @@ class test_host(Declarative):
                     dn=dn1,
                     fqdn=[fqdn1],
                     description=[u'Updated host 1'],
-                    localityname=[u'Undisclosed location 1'],
+                    l=[u'Undisclosed location 1'],
+                    krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index 3fef9b4e0..4fc67a616 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -98,7 +98,7 @@ class test_hostgroup(Declarative):
             command=('host_add', [fqdn1],
                 dict(
                     description=u'Test host 1',
-                    localityname=u'Undisclosed location 1',
+                    l=u'Undisclosed location 1',
                 ),
             ),
             expected=dict(
@@ -106,14 +106,11 @@ class test_hostgroup(Declarative):
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
                     dn=host_dn1,
-                    cn=[fqdn1],  # FIXME: we should only return fqdn
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
-                    localityname=[u'Undisclosed location 1'],
+                    l=[u'Undisclosed location 1'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
-                    serverhostname=[u'testhost1'],
                     objectclass=objectclasses.host,
-                    managedby=[host_dn1],
                     ipauniqueid=[fuzzy_uuid],
                 ),
             ),
@@ -134,7 +131,9 @@ class test_hostgroup(Declarative):
                     ),
                 ),
                 result={
-                    'member host': [fqdn1],
+                    'cn': [hostgroup1],
+                    'description': [u'Test hostgroup 1'],
+                    'member_host': [fqdn1],
                 },
             ),
         ),
@@ -148,7 +147,7 @@ class test_hostgroup(Declarative):
                 summary=None,
                 result={
                     'dn': dn1,
-                    'member host': [u'testhost1.%s' % api.env.domain],
+                    'member_host': [u'testhost1.%s' % api.env.domain],
                     'cn': [hostgroup1],
                     'description': [u'Test hostgroup 1'],
                 },
@@ -165,7 +164,8 @@ class test_hostgroup(Declarative):
                 summary=u'1 hostgroup matched',
                 result=[
                     {
-                        'member host': [u'testhost1.%s' % api.env.domain],
+                        #'dn': dn1,
+                        'member_host': [u'testhost1.%s' % api.env.domain],
                         'cn': [hostgroup1],
                         'description': [u'Test hostgroup 1'],
                     },
@@ -183,7 +183,9 @@ class test_hostgroup(Declarative):
                 value=hostgroup1,
                 summary=u'Modified hostgroup "testhostgroup1"',
                 result=dict(
+                    cn=[hostgroup1],
                     description=[u'Updated hostgroup 1'],
+                    member_host=[u'testhost1.%s' % api.env.domain],
                 ),
             ),
         ),
@@ -197,7 +199,7 @@ class test_hostgroup(Declarative):
                 summary=None,
                 result={
                     'dn': dn1,
-                    'member host': [u'testhost1.%s' % api.env.domain],
+                    'member_host': [u'testhost1.%s' % api.env.domain],
                     'cn': [hostgroup1],
                     'description': [u'Updated hostgroup 1'],
                 },
diff --git a/tests/test_xmlrpc/test_pwpolicy.py b/tests/test_xmlrpc/test_pwpolicy.py
index 080f39bf9..ceb4f8b62 100644
--- a/tests/test_xmlrpc/test_pwpolicy.py
+++ b/tests/test_xmlrpc/test_pwpolicy.py
@@ -148,17 +148,3 @@ class test_pwpolicy(XMLRPC_test):
 
         # Remove the user we created
         api.Command['user_del'](self.user)
-
-    def test_a_pwpolicy_del(self):
-        """
-        Remove the second test policy with `xmlrpc.pwpolicy_del`.
-        """
-        assert api.Command['pwpolicy_del'](group=self.group2)['result'] is True
-
-        # Verify that it is gone
-        try:
-            api.Command['pwpolicy_show'](group=self.group2)
-        except errors.NotFound:
-            pass
-        else:
-            assert False
diff --git a/tests/test_xmlrpc/test_rolegroup_plugin.py b/tests/test_xmlrpc/test_rolegroup_plugin.py
index 7aa6842df..801dadeda 100644
--- a/tests/test_xmlrpc/test_rolegroup_plugin.py
+++ b/tests/test_xmlrpc/test_rolegroup_plugin.py
@@ -150,7 +150,9 @@ class test_rolegroup(Declarative):
                     ),
                 ),
                 result={
-                    'member group': [group1],
+                    'cn': [rolegroup1],
+                    'description': [u'rolegroup desc 1'],
+                    'member_group': [group1],
                 }
             ),
         ),
@@ -166,7 +168,7 @@ class test_rolegroup(Declarative):
                     'dn': rolegroup1_dn,
                     'cn': [rolegroup1],
                     'description': [u'rolegroup desc 1'],
-                    'member group': [group1],
+                    'member_group': [group1],
                 },
             ),
         ),
@@ -181,11 +183,10 @@ class test_rolegroup(Declarative):
                 summary=u'1 rolegroup matched',
                 result=[
                     {
-                        # FIXME: find() should return 'dn' just like show()
                         #'dn': rolegroup1_dn,
                         'cn': [rolegroup1],
                         'description': [u'rolegroup desc 1'],
-                        'member group': [group1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -201,9 +202,10 @@ class test_rolegroup(Declarative):
                 summary=u'1 rolegroup matched',
                 result=[
                     {
+                        #'dn': rolegroup1_dn,
                         'cn': [rolegroup1],
                         'description': [u'rolegroup desc 1'],
-                        'member group': [group1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -237,9 +239,10 @@ class test_rolegroup(Declarative):
                 summary=u'1 rolegroup matched',
                 result=[
                     {
+                        #'dn': rolegroup1_dn,
                         'cn': [rolegroup1],
                         'description': [u'rolegroup desc 1'],
-                        'member group': [group1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -255,11 +258,13 @@ class test_rolegroup(Declarative):
                 summary=u'2 rolegroups matched',
                 result=[
                     {
+                        #'dn': rolegroup1_dn,
                         'cn': [rolegroup1],
                         'description': [u'rolegroup desc 1'],
-                        'member group': [group1],
+                        'member_group': [group1],
                     },
                     {
+                        #'dn': rolegroup2_dn,
                         'cn': [rolegroup2],
                         'description': [u'rolegroup desc 2'],
                     },
@@ -277,7 +282,9 @@ class test_rolegroup(Declarative):
                 value=rolegroup1,
                 summary=u'Modified rolegroup "test-rolegroup-1"',
                 result=dict(
+                    cn=[rolegroup1],
                     description=[u'New desc 1'],
+                    member_group=[group1],
                 ),
             ),
         ),
@@ -293,7 +300,7 @@ class test_rolegroup(Declarative):
                     'dn': rolegroup1_dn,
                     'cn': [rolegroup1],
                     'description': [u'New desc 1'],
-                    'member group': [group1],
+                    'member_group': [group1],
                 },
             ),
         ),
@@ -384,6 +391,7 @@ class test_rolegroup(Declarative):
                 summary=u'1 rolegroup matched',
                 result=[
                     {
+                        #'dn': rolegroup2_dn,
                         'cn': [rolegroup2],
                         'description': [u'rolegroup desc 2'],
                     },
diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py
index 5a97a47c5..432a86b0e 100644
--- a/tests/test_xmlrpc/test_service_plugin.py
+++ b/tests/test_xmlrpc/test_service_plugin.py
@@ -101,16 +101,7 @@ class test_service(XMLRPC_test):
         entries = api.Command['service_find'](self.principal)['result']
         assert_attr_equal(entries[0], 'krbprincipalname', self.principal)
 
-    def test_7_service_mod(self):
-        """
-        Test the `xmlrpc.service_mod` method.
-        """
-        modkw = dict(self.kw)
-        modkw['usercertificate'] = 'QmluYXJ5IGNlcnRpZmljYXRl'
-        entry = api.Command['service_mod'](**modkw)['result']
-        assert_attr_equal(entry, 'usercertificate', 'Binary certificate')
-
-    def test_8_service_del(self):
+    def test_7_service_del(self):
         """
         Test the `xmlrpc.service_del` method.
         """
diff --git a/tests/test_xmlrpc/test_taskgroup_plugin.py b/tests/test_xmlrpc/test_taskgroup_plugin.py
index 191880a35..42e0ac503 100644
--- a/tests/test_xmlrpc/test_taskgroup_plugin.py
+++ b/tests/test_xmlrpc/test_taskgroup_plugin.py
@@ -170,8 +170,10 @@ class test_taskgroup(Declarative):
                     ),
                 ),
                 result={
-                    'member rolegroup': [rolegroup1],
-                    'member group': [group1],
+                    'cn': [taskgroup1],
+                    'description': [u'Test desc 1'],
+                    'member_rolegroup': [rolegroup1],
+                    'member_group': [group1],
                 }
             ),
         ),
@@ -187,8 +189,8 @@ class test_taskgroup(Declarative):
                     'dn': taskgroup1_dn,
                     'cn': [taskgroup1],
                     'description': [u'Test desc 1'],
-                    'member rolegroup': [rolegroup1],
-                    'member group': [group1],
+                    'member_rolegroup': [rolegroup1],
+                    'member_group': [group1],
                 },
             ),
         ),
@@ -203,12 +205,11 @@ class test_taskgroup(Declarative):
                 summary=u'1 taskgroup matched',
                 result=[
                     {
-                        # FIXME: crud.Search subclasses should return 'dn' also
                         #'dn': taskgroup1_dn,
                         'cn': [taskgroup1],
                         'description': [u'Test desc 1'],
-                        'member rolegroup': [rolegroup1],
-                        'member group': [group1],
+                        'member_rolegroup': [rolegroup1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -224,10 +225,11 @@ class test_taskgroup(Declarative):
                 summary=u'1 taskgroup matched',
                 result=[
                     {
+                        #'dn': taskgroup1_dn,
                         'cn': [taskgroup1],
                         'description': [u'Test desc 1'],
-                        'member rolegroup': [rolegroup1],
-                        'member group': [group1],
+                        'member_rolegroup': [rolegroup1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -261,12 +263,11 @@ class test_taskgroup(Declarative):
                 summary=u'1 taskgroup matched',
                 result=[
                     {
-                        # FIXME: crud.Search subclasses should return 'dn' also
                         #'dn': taskgroup1_dn,
                         'cn': [taskgroup1],
                         'description': [u'Test desc 1'],
-                        'member rolegroup': [rolegroup1],
-                        'member group': [group1],
+                        'member_rolegroup': [rolegroup1],
+                        'member_group': [group1],
                     },
                 ],
             ),
@@ -282,12 +283,14 @@ class test_taskgroup(Declarative):
                 summary=u'2 taskgroups matched',
                 result=[
                     {
+                        #'dn': taskgroup1_dn,
                         'cn': [taskgroup1],
                         'description': [u'Test desc 1'],
-                        'member rolegroup': [rolegroup1],
-                        'member group': [group1],
+                        'member_rolegroup': [rolegroup1],
+                        'member_group': [group1],
                     },
                     {
+                        #'dn': taskgroup2_dn,
                         'cn': [taskgroup2],
                         'description': [u'Test desc 2'],
                     },
@@ -305,7 +308,11 @@ class test_taskgroup(Declarative):
                 value=taskgroup1,
                 summary=u'Modified taskgroup "test-taskgroup-1"',
                 result=dict(
+                    cn=[taskgroup1],
                     description=[u'New desc 1'],
+                    member_rolegroup=[rolegroup1],
+                    member_group=[group1],
+
                 ),
             ),
         ),
@@ -321,8 +328,8 @@ class test_taskgroup(Declarative):
                     'dn': taskgroup1_dn,
                     'cn': [taskgroup1],
                     'description': [u'New desc 1'],
-                    'member rolegroup': [rolegroup1],
-                    'member group': [group1],
+                    'member_rolegroup': [rolegroup1],
+                    'member_group': [group1],
                 },
             ),
         ),
@@ -343,7 +350,7 @@ class test_taskgroup(Declarative):
                     ),
                 ),
                 result={
-                    'member rolegroup': [rolegroup1],
+                    'member_rolegroup': [rolegroup1],
                 }
             ),
         ),
@@ -390,6 +397,7 @@ class test_taskgroup(Declarative):
                 summary=u'1 taskgroup matched',
                 result=[
                     {
+                        #'dn': taskgroup2_dn,
                         'cn': [taskgroup2],
                         'description': [u'Test desc 2'],
                     },
diff --git a/tests/test_xmlrpc/test_user_plugin.py b/tests/test_xmlrpc/test_user_plugin.py
index 7dfafc730..b2cf6fcc4 100644
--- a/tests/test_xmlrpc/test_user_plugin.py
+++ b/tests/test_xmlrpc/test_user_plugin.py
@@ -70,7 +70,6 @@ class test_user(Declarative):
                 value=user1,
                 summary=u'Added user "tuser1"',
                 result=dict(
-                    cn=[u'Test User1'],
                     gecos=[user1],
                     givenname=[u'Test'],
                     homedirectory=[u'/home/tuser1'],
@@ -79,7 +78,6 @@ class test_user(Declarative):
                     objectclass=objectclasses.user,
                     sn=[u'User1'],
                     uid=[user1],
-                    gidnumber=[fuzzy_digits],
                     ipauniqueid=[fuzzy_uuid],
                     dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
                 ),
@@ -109,6 +107,7 @@ class test_user(Declarative):
                     loginshell=[u'/bin/sh'],
                     sn=[u'User1'],
                     uid=[user1],
+                    memberof_group=[u'ipausers'],
                 ),
                 value=user1,
                 summary=None,
@@ -124,13 +123,14 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     {
+                        #'dn': u'uid=user1,cn=users,cn=accounts,' + api.env.basedn,
                         'cn': [u'Test User1'],
                         'gecos': [user1],
                         'givenname': [u'Test'],
                         'homedirectory': [u'/home/tuser1'],
                         'krbprincipalname': [u'tuser1@' + api.env.realm],
                         'loginshell': [u'/bin/sh'],
-                        'memberof group': [u'ipausers'],
+                        'memberof_group': [u'ipausers'],
                         'objectclass': objectclasses.user,
                         'sn': [u'User1'],
                         'uid': [user1],
@@ -140,8 +140,7 @@ class test_user(Declarative):
                     },
                 ],
                 summary=u'1 user matched',
-                count=1,
-                truncated=False,
+                count=1, truncated=False,
             ),
         ),
 
@@ -154,11 +153,13 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     dict(
+                        #dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
                         givenname=[u'Test'],
                         homedirectory=[u'/home/tuser1'],
                         loginshell=[u'/bin/sh'],
                         sn=[u'User1'],
                         uid=[user1],
+                        memberof_group=[u'ipausers'],
                     ),
                 ],
                 summary=u'1 user matched',
@@ -176,17 +177,21 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     dict(
+                        #dn=u'uid=admin,cn=users,cn=accounts,' + api.env.basedn,
                         homedirectory=[u'/home/admin'],
                         loginshell=[u'/bin/bash'],
                         sn=[u'Administrator'],
                         uid=[u'admin'],
+                        memberof_group=[u'admins'],
                     ),
                     dict(
+                        #dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
                         givenname=[u'Test'],
                         homedirectory=[u'/home/tuser1'],
                         loginshell=[u'/bin/sh'],
                         sn=[u'User1'],
                         uid=[user1],
+                        memberof_group=[u'ipausers'],
                     ),
                 ],
                 summary=u'2 users matched',
@@ -230,6 +235,11 @@ class test_user(Declarative):
             expected=dict(
                 result=dict(
                     givenname=[u'Finkle'],
+                    homedirectory=[u'/home/tuser1'],
+                    loginshell=[u'/bin/sh'],
+                    sn=[u'User1'],
+                    uid=[user1],
+                    memberof_group=[u'ipausers'],
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -248,6 +258,7 @@ class test_user(Declarative):
                     loginshell=[u'/bin/sh'],
                     sn=[u'User1'],
                     uid=[user1],
+                    memberof_group=[u'ipausers'],
                 ),
                 summary=None,
                 value=user1,