Merge conflicts between rob and kevin patches

23 files changed, 1913 insertions, 64 deletions

diff --git a/ipa-admintools/ipa-findgroup b/ipa-admintools/ipa-findgroup
index 43171e424..92b3b25b1 100644
--- a/ipa-admintools/ipa-findgroup
+++ b/ipa-admintools/ipa-findgroup
@@ -50,7 +50,9 @@ def main():
         client = ipaclient.IPAClient()
         groups = client.find_groups(args[1])
 
-        if len(groups) == 0:
+        counter = groups[0]
+        groups = groups[1:]
+        if counter == 0:
             print "No entries found for", args[1]
             return 0
 
diff --git a/ipa-python/ipaclient.py b/ipa-python/ipaclient.py
index 7095aac10..880b47852 100644
--- a/ipa-python/ipaclient.py
+++ b/ipa-python/ipaclient.py
@@ -71,6 +71,8 @@ class IPAClient:
     def add_user(self,user,user_container=None):
         """Add a user. user is a ipa.user.User object"""
 
+        realm = config.config.get_realm()
+
         user_dict = user.toDict()
 
         # dn is set on the server-side
@@ -97,11 +99,11 @@ class IPAClient:
         result = self.transport.get_add_schema()
         return result
 
-    def find_users(self, criteria, sattrs=None):
+    def find_users(self, criteria, sattrs=None, searchlimit=0):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
-        result = self.transport.find_users(criteria, sattrs)
+        result = self.transport.find_users(criteria, sattrs, searchlimit)
         counter = result[0]
 
         users = [counter]
@@ -114,12 +116,16 @@ class IPAClient:
     def update_user(self,user):
         """Update a user entry."""
 
+        realm = config.config.get_realm()
+
         result = self.transport.update_user(user.origDataDict(), user.toDict())
         return result
 
     def delete_user(self,uid):
         """Delete a user entry."""
 
+        realm = config.config.get_realm()
+
         result = self.transport.delete_user(uid)
         return result
 
@@ -133,6 +139,8 @@ class IPAClient:
     def mark_user_deleted(self,uid):
         """Set a user as inactive by uid."""
 
+        realm = config.config.get_realm()
+
         result = self.transport.mark_user_deleted(uid)
         return result
 
@@ -155,6 +163,8 @@ class IPAClient:
     def add_group(self,group,group_container=None):
         """Add a group. group is a ipa.group.Group object"""
 
+        realm = config.config.get_realm()
+
         group_dict = group.toDict()
 
         # dn is set on the server-side
@@ -164,13 +174,14 @@ class IPAClient:
         result = self.transport.add_group(group_dict, group_container)
         return result
 
-    def find_groups(self, criteria, sattrs=None):
+    def find_groups(self, criteria, sattrs=None, searchlimit=0):
         """Find groups whose cn matches the criteria. Wildcards are 
            acceptable. Returns a list of Group objects."""
-        result = self.transport.find_groups(criteria, sattrs)
+        result = self.transport.find_groups(criteria, sattrs, searchlimit)
+        counter = result[0]
 
-        groups = []
-        for attrs in result:
+        groups = [counter]
+        for attrs in result[1:]:
             if attrs is not None:
                 groups.append(group.Group(attrs))
 
diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py
index bbf2745ed..21ea68bc6 100644
--- a/ipa-python/rpcclient.py
+++ b/ipa-python/rpcclient.py
@@ -150,7 +150,7 @@ class RPCClient:
     
         return ipautil.unwrap_binary_data(result)
 
-    def find_users (self, criteria, sattrs=None):
+    def find_users (self, criteria, sattrs=None, searchlimit=0):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
@@ -160,7 +160,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_users(criteria, sattrs)
+            result = server.find_users(criteria, sattrs, searchlimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
@@ -275,7 +275,7 @@ class RPCClient:
         except socket.error, (value, msg):
             raise xmlrpclib.Fault(value, msg)
 
-    def find_groups (self, criteria, sattrs=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0):
         """Return a list containing a Group object for each group that matches
            the criteria."""
     
@@ -284,7 +284,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_groups(criteria, sattrs)
+            result = server.find_groups(criteria, sattrs, searchlimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff --git a/ipa-server/ipa-gui/ipagui/controllers.py b/ipa-server/ipa-gui/ipagui/controllers.py
index a04da7a0e..c16f04c63 100644
--- a/ipa-server/ipa-gui/ipagui/controllers.py
+++ b/ipa-server/ipa-gui/ipagui/controllers.py
@@ -19,12 +19,15 @@ import ipa.ipaclient
 import ipa.user
 import xmlrpclib
 import forms.user
+import forms.group
 from helpers import userhelper
 from ipa import ipaerror
 
 ipa.config.init_config()
 user_new_form = forms.user.UserNewForm()
 user_edit_form = forms.user.UserEditForm()
+group_new_form = forms.group.GroupNewForm()
+group_edit_form = forms.group.GroupEditForm()
 
 password_chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
 
@@ -32,6 +35,8 @@ client = ipa.ipaclient.IPAClient(True)
 
 user_fields = ['*', 'nsAccountLock']
 
+group_fields = ['*']
+
 def restrict_post():
     if cherrypy.request.method != "POST":
         turbogears.flash("This method only accepts posts")
@@ -56,7 +61,7 @@ class Root(controllers.RootController):
         if kw.get('searchtype') == "Users":
             return self.userlist(uid=kw.get('searchvalue'))
         else:
-            return self.index()
+            return self.grouplist(criteria=kw.get('searchvalue'))
 
 
 
@@ -116,17 +121,21 @@ class Root(controllers.RootController):
         if tg_errors:
             turbogears.flash("There was a problem with the form!")
 
-        client.set_krbccache(os.environ["KRB5CCNAME"])
-        user = client.get_user_by_uid(uid, user_fields)
-        user_dict = user.toDict()
-        # Edit shouldn't fill in the password field.
-        if user_dict.has_key('userpassword'):
-            del(user_dict['userpassword'])
-
-        # store a copy of the original user for the update later
-        user_data = b64encode(dumps(user_dict))
-        user_dict['user_orig'] = user_data
-        return dict(form=user_edit_form, user=user_dict)
+        try:
+            client.set_krbccache(os.environ["KRB5CCNAME"])
+            user = client.get_user_by_uid(uid, user_fields)
+            user_dict = user.toDict()
+            # Edit shouldn't fill in the password field.
+            if user_dict.has_key('userpassword'):
+                del(user_dict['userpassword'])
+
+            # store a copy of the original user for the update later
+            user_data = b64encode(dumps(user_dict))
+            user_dict['user_orig'] = user_data
+            return dict(form=user_edit_form, user=user_dict)
+        except ipaerror.IPAError, e:
+            turbogears.flash("User edit failed: " + str(e))
+            raise turbogears.redirect('/usershow', uid=kw.get('uid'))
 
     @expose()
     @identity.require(identity.not_anonymous())
@@ -143,6 +152,7 @@ class Root(controllers.RootController):
             return dict(form=user_edit_form, user=kw,
                         tg_template='ipagui.templates.useredit')
 
+        password_change = False
         try:
             orig_user_dict = loads(b64decode(kw.get('user_orig')))
 
@@ -155,12 +165,11 @@ class Root(controllers.RootController):
                 new_user.setValue('nsAccountLock', 'true')
             else:
                 new_user.setValue('nsAccountLock', None)
-            if kw.get('userpassword'):
-                new_user.setValue('userpassword', kw.get('userpassword'))
-            if kw.get('uidnumber'):
-                new_user.setValue('uidnumber', kw.get('uidnumber'))
-            if kw.get('gidnumber'):
-                new_user.setValue('gidnumber', kw.get('gidnumber'))
+            if kw.get('editprotected') == 'true':
+                if kw.get('userpassword'):
+                    password_change = True
+                new_user.setValue('uidnumber', str(kw.get('uidnumber')))
+                new_user.setValue('gidnumber', str(kw.get('gidnumber')))
 
             #
             # this is a hack until we decide on the policy for names/cn/sn/givenName
@@ -170,18 +179,32 @@ class Root(controllers.RootController):
                                       new_user.getValue('sn')))
 
             rv = client.update_user(new_user)
-            turbogears.flash("%s updated!" % kw['uid'])
-            raise turbogears.redirect('/usershow', uid=kw['uid'])
+        except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST), e:
+            if not password_change:
+                turbogears.flash("User update failed: " + str(e))
+                return dict(form=user_edit_form, user=kw,
+                            tg_template='ipagui.templates.useredit')
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=user_edit_form, user=kw,
                         tg_template='ipagui.templates.useredit')
 
+        try:
+            if password_change:
+                rv = client.modifyPassword(kw['uid'], "", kw.get('userpassword'))
+        except ipaerror.IPAError, e:
+            turbogears.flash("User password change failed: " + str(e))
+            return dict(form=user_edit_form, user=kw,
+                        tg_template='ipagui.templates.useredit')
+
+        turbogears.flash("%s updated!" % kw['uid'])
+        raise turbogears.redirect('/usershow', uid=kw['uid'])
+
 
     @expose("ipagui.templates.userlist")
     @identity.require(identity.not_anonymous())
     def userlist(self, **kw):
-        """Retrieve a list of all users and display them in one huge list"""
+        """Searches for users and displays list of results"""
         client.set_krbccache(os.environ["KRB5CCNAME"])
         users = None
         counter = 0
@@ -200,6 +223,26 @@ class Root(controllers.RootController):
 
         return dict(users=users, uid=uid, fields=forms.user.UserFields())
 
+    @expose("ipagui.templates.userlistajax")
+    @identity.require(identity.not_anonymous())
+    def userlist_ajax(self, **kw):
+        """Searches for users and displays list of results in a table.
+           This method is used for ajax calls."""
+        client.set_principal(identity.current.user_name)
+        users = []
+        searchlimit = 100
+        uid = kw.get('uid')
+        if uid != None and len(uid) > 0:
+            try:
+                users = client.find_users(uid.encode('utf-8'), None, searchlimit)
+                counter = users[0]
+                users = users[1:]
+            except ipaerror.IPAError, e:
+                turbogears.flash("User list failed: " + str(e))
+
+        return dict(users=users, uid=uid, fields=forms.user.UserFields(),
+                counter=counter)
+
 
     @expose("ipagui.templates.usershow")
     @identity.require(identity.not_anonymous())
@@ -284,10 +327,12 @@ class Root(controllers.RootController):
         return ""
 
     @expose()
+    @identity.require(identity.not_anonymous())
     def suggest_email(self, givenname, sn):
         if (len(givenname) == 0) or (len(sn) == 0):
             return ""
 
+        client.set_principal(identity.current.user_name)
         givenname = givenname.lower()
         sn = sn.lower()
 
@@ -332,13 +377,256 @@ class Root(controllers.RootController):
         client.set_krbccache(os.environ["KRB5CCNAME"])
         return dict()
 
+    @expose("ipagui.templates.groupnew")
+    @identity.require(identity.not_anonymous())
+    def groupnew(self, tg_errors=None):
+        """Displays the new group form"""
+        if tg_errors:
+            turbogears.flash("There was a problem with the form!")
 
-    ############
-    # Resource #
-    ############
+        client.set_principal(identity.current.user_name)
 
-    @expose("ipagui.templates.resindex")
+        return dict(form=group_new_form)
+
+    @expose()
     @identity.require(identity.not_anonymous())
-    def resindex(self, tg_errors=None):
-        client.set_krbccache(os.environ["KRB5CCNAME"])
-        return dict()
+    def groupcreate(self, **kw):
+        """Creates a new group"""
+        restrict_post()
+        client.set_principal(identity.current.user_name)
+
+        if kw.get('submit') == 'Cancel':
+            turbogears.flash("Add group cancelled")
+            raise turbogears.redirect('/')
+
+        tg_errors, kw = self.groupcreatevalidate(**kw)
+        if tg_errors:
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+
+        try:
+            new_group = ipa.group.Group()
+            new_group.setValue('cn', kw.get('cn'))
+            new_group.setValue('description', kw.get('description'))
+
+            rv = client.add_group(new_group)
+            turbogears.flash("%s added!" % kw.get('cn'))
+            raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
+        except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE):
+            turbogears.flash("Group with name '%s' already exists" %
+                    kw.get('cn'))
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group add failed: " + str(e) + "<br/>" + str(e.detail))
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+
+
+    @expose("ipagui.templates.groupedit")
+    @identity.require(identity.not_anonymous())
+    def groupedit(self, cn, tg_errors=None):
+        """Displays the edit group form"""
+        if tg_errors:
+            turbogears.flash("There was a problem with the form!")
+
+        client.set_principal(identity.current.user_name)
+        try:
+            group = client.get_group_by_cn(cn, group_fields)
+
+            group_dict = group.toDict()
+
+            #
+            # convert members to users, for easier manipulation on the page
+            #
+            member_dns = []
+            if group_dict.has_key('uniquemember'):
+                member_dns = group_dict.get('uniquemember')
+                # remove from dict - it's not needed for update
+                # and we are storing the members in a different form
+                del group_dict['uniquemember']
+            if not(isinstance(member_dns,list) or isinstance(member_dns,tuple)):
+                member_dns = [member_dns]
+
+            # TODO: convert this into an efficient (single) function call
+            member_users = map(
+                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+                    member_dns)
+
+            # Map users into an array of dicts, which can be serialized
+            # (so we don't have to do this on each round trip)
+            member_dicts = map(lambda user: user.toDict(), member_users)
+
+            # store a copy of the original group for the update later
+            group_data = b64encode(dumps(group_dict))
+            member_data = b64encode(dumps(member_dicts))
+            group_dict['group_orig'] = group_data
+            group_dict['member_data'] = member_data
+
+            return dict(form=group_edit_form, group=group_dict, members=member_dicts)
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group edit failed: " + str(e))
+            raise turbogears.redirect('/groupshow', uid=kw.get('cn'))
+
+    @expose()
+    @identity.require(identity.not_anonymous())
+    def groupupdate(self, **kw):
+        """Updates an existing group"""
+        restrict_post()
+        client.set_principal(identity.current.user_name)
+        if kw.get('submit') == 'Cancel Edit':
+            turbogears.flash("Edit group cancelled")
+            raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
+
+        # Decode the member data, in case we need to round trip
+        member_dicts = loads(b64decode(kw.get('member_data')))
+
+
+        tg_errors, kw = self.groupupdatevalidate(**kw)
+        if tg_errors:
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        group_modified = False
+
+        #
+        # Update group itself
+        #
+        try:
+            orig_group_dict = loads(b64decode(kw.get('group_orig')))
+
+            new_group = ipa.group.Group(orig_group_dict)
+            if new_group.description != kw.get('description'):
+                group_modified = True
+                new_group.setValue('description', kw.get('description'))
+            if kw.get('editprotected') == 'true':
+                new_gid = str(kw.get('gidnumber'))
+                if new_group.gidnumber != new_gid:
+                    group_modified = True
+                    new_group.setValue('gidnumber', new_gid)
+
+            if group_modified:
+                rv = client.update_group(new_group)
+                #
+                # If the group update succeeds, but below operations fail, we
+                # need to make sure a subsequent submit doesn't try to update
+                # the group again.
+                #
+                kw['group_orig'] = b64encode(dumps(new_group.toDict()))
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        #
+        # Add members
+        #
+        failed_adds = []
+        try:
+            uidadds = kw.get('uidadd')
+            if uidadds != None:
+                if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
+                    uidadds = [uidadds]
+                failed_adds = client.add_users_to_group(uidadds, kw.get('cn'))
+                kw['uidadd'] = failed_adds
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        #
+        # Remove members
+        #
+        failed_dels = []
+        try:
+            uiddels = kw.get('uiddel')
+            if uiddels != None:
+                if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
+                    uiddels = [uiddels]
+                failed_dels = client.remove_users_from_group(uiddels, kw.get('cn'))
+                kw['uiddel'] = failed_dels
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        #
+        # TODO - check failed ops to see if it's because of another update.
+        #        handle "someone else already did it" errors better - perhaps
+        #        not even as an error
+        # TODO - update the Group Members list.
+        #        (note that we have to handle the above todo first, or else
+        #         there will be an error message, but the add/del lists will
+        #         be empty)
+        #
+        if (len(failed_adds) > 0) or (len(failed_dels) > 0):
+            message = "There was an error updating group members.<br />"
+            message += "Failures have been preserved in the add/remove lists."
+            if group_modified:
+                message = "Group Details successfully updated.<br />" + message
+            turbogears.flash(message)
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        turbogears.flash("%s updated!" % kw['cn'])
+        raise turbogears.redirect('/groupshow', cn=kw['cn'])
+
+
+    @expose("ipagui.templates.grouplist")
+    @identity.require(identity.not_anonymous())
+    def grouplist(self, **kw):
+        """Search for groups and display results"""
+        client.set_principal(identity.current.user_name)
+        groups = None
+        # counter = 0
+        criteria = kw.get('criteria')
+        if criteria != None and len(criteria) > 0:
+            try:
+                groups = client.find_groups(criteria.encode('utf-8'))
+                counter = groups[0]
+                groups = groups[1:]
+                if counter == -1:
+                    turbogears.flash("These results are truncated.<br />" +
+                                    "Please refine your search and try again.")
+            except ipaerror.IPAError, e:
+                turbogears.flash("Find groups failed: " + str(e))
+                raise turbogears.redirect("/grouplist")
+
+        return dict(groups=groups, criteria=criteria, fields=forms.group.GroupFields())
+
+    @expose("ipagui.templates.groupshow")
+    @identity.require(identity.not_anonymous())
+    def groupshow(self, cn):
+        """Retrieve a single group for display"""
+        client.set_principal(identity.current.user_name)
+        try:
+            group = client.get_group_by_cn(cn, group_fields)
+            group_dict = group.toDict()
+
+            #
+            # convert members to users, for display on the page
+            #
+            member_dns = []
+            if group_dict.has_key('uniquemember'):
+                member_dns = group_dict.get('uniquemember')
+            if not(isinstance(member_dns,list) or isinstance(member_dns,tuple)):
+                member_dns = [member_dns]
+
+            # TODO: convert this into an efficient (single) function call
+            member_users = map(
+                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+                    member_dns)
+            member_dicts = map(lambda user: user.toDict(), member_users)
+
+            return dict(group=group_dict, fields=forms.group.GroupFields(),
+                    members = member_dicts)
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group show failed: " + str(e))
+            raise turbogears.redirect("/")
+
+    @validate(form=group_new_form)
+    @identity.require(identity.not_anonymous())
+    def groupcreatevalidate(self, tg_errors=None, **kw):
+        return tg_errors, kw
+
+    @validate(form=group_edit_form)
+    @identity.require(identity.not_anonymous())
+    def groupupdatevalidate(self, tg_errors=None, **kw):
+        return tg_errors, kw
diff --git a/ipa-server/ipa-gui/ipagui/forms/group.py b/ipa-server/ipa-gui/ipagui/forms/group.py
new file mode 100644
index 000000000..20706eb6f
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py
@@ -0,0 +1,58 @@
+import turbogears
+from turbogears import validators, widgets
+
+class GroupFields():
+    cn = widgets.TextField(name="cn", label="Name")
+    gidnumber = widgets.TextField(name="gidnumber", label="GID")
+    description = widgets.TextField(name="description", label="Description")
+
+    cn_hidden = widgets.HiddenField(name="cn")
+    editprotected_hidden = widgets.HiddenField(name="editprotected")
+
+    group_orig = widgets.HiddenField(name="group_orig")
+    member_data = widgets.HiddenField(name="member_data")
+    uid_to_cn_json = widgets.HiddenField(name="uid_to_cn_json")
+
+class GroupNewValidator(validators.Schema):
+    cn = validators.String(not_empty=True)
+    description = validators.String(not_empty=False)
+
+
+class GroupNewForm(widgets.Form):
+    params = ['group']
+
+    fields = [GroupFields.cn, GroupFields.description]
+
+    validator = GroupNewValidator()
+
+    def __init__(self, *args, **kw):
+        super(GroupNewForm,self).__init__(*args, **kw)
+        (self.template_c, self.template) = widgets.meta.load_kid_template("ipagui.templates.groupnewform")
+        self.group = GroupFields
+
+    def update_params(self, params):
+        super(GroupNewForm,self).update_params(params)
+
+
+class GroupEditValidator(validators.Schema):
+    gidnumber = validators.Int(not_empty=False)
+    description = validators.String(not_empty=False)
+
+    pre_validators = [
+      validators.RequireIfPresent(required='gidnumber', present='editprotected'),
+    ]
+
+class GroupEditForm(widgets.Form):
+    params = ['members', 'group']
+
+    fields = [GroupFields.gidnumber, GroupFields.description,
+              GroupFields.cn_hidden, GroupFields.editprotected_hidden,
+              GroupFields.group_orig, GroupFields.member_data,
+              GroupFields.uid_to_cn_json]
+
+    validator = GroupEditValidator()
+
+    def __init__(self, *args, **kw):
+        super(GroupEditForm,self).__init__(*args, **kw)
+        (self.template_c, self.template) = widgets.meta.load_kid_template("ipagui.templates.groupeditform")
+        self.group = GroupFields
diff --git a/ipa-server/ipa-gui/ipagui/forms/user.py b/ipa-server/ipa-gui/ipagui/forms/user.py
index c5478bf8a..037205a17 100644
--- a/ipa-server/ipa-gui/ipagui/forms/user.py
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py
@@ -21,6 +21,7 @@ class UserFields():
     uidnumber_hidden = widgets.HiddenField(name="uidnumber")
     gidnumber_hidden = widgets.HiddenField(name="gidnumber")
     krbPasswordExpiration_hidden = widgets.HiddenField(name="krbPasswordExpiration")
+    editprotected_hidden = widgets.HiddenField(name="editprotected")
 
     user_orig = widgets.HiddenField(name="user_orig")
 
@@ -65,9 +66,16 @@ class UserEditValidator(validators.Schema):
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     mail = validators.Email(not_empty=True)
+    uidnumber = validators.Int(not_empty=False)
+    gidnumber = validators.Int(not_empty=False)
     #  validators.PhoneNumber may be a bit too picky, requiring an area code
     # telephonenumber = validators.PlainText(not_empty=False)
 
+    pre_validators = [
+      validators.RequireIfPresent(required='uidnumber', present='editprotected'),
+      validators.RequireIfPresent(required='gidnumber', present='editprotected'),
+    ]
+
     chained_validators = [
       validators.FieldsMatch('userpassword', 'userpassword_confirm')
     ]
@@ -79,6 +87,7 @@ class UserEditForm(widgets.Form):
               UserFields.uid_hidden, UserFields.user_orig,
               UserFields.uidnumber, UserFields.gidnumber,
               UserFields.krbPasswordExpiration_hidden,
+              UserFields.editprotected_hidden,
               ]
 
     validator = UserEditValidator()
diff --git a/ipa-server/ipa-gui/ipagui/proxyprovider.py b/ipa-server/ipa-gui/ipagui/proxyprovider.py
index cc9d91644..4499e797e 100644
--- a/ipa-server/ipa-gui/ipagui/proxyprovider.py
+++ b/ipa-server/ipa-gui/ipagui/proxyprovider.py
@@ -32,19 +32,19 @@ class ProxyIdentity(object):
     user= property(_get_user)
 
     def _get_user_name(self):
-        if not self.user:
+        if not self._user:
             return None
-        return self.user.user_name
+        return self._user.user_name
     user_name= property(_get_user_name)
 
-    def _get_name(self):
-        if not self.user:
+    def _get_display_name(self):
+        if not self._user:
             return None
-        return self.user.name
-    user_name= property(_get_name)
+        return self._user.display_name
+    display_name= property(_get_display_name)
 
     def _get_anonymous(self):
-        return not self.user
+        return not self._user
     anonymous= property(_get_anonymous)
 
     def _get_permissions(self):
diff --git a/ipa-server/ipa-gui/ipagui/static/css/style.css b/ipa-server/ipa-gui/ipagui/static/css/style.css
index 92379caaa..b3ed830d1 100644
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css
@@ -148,6 +148,16 @@ body {
   text-align: right;
 }
 
+.floatlist {
+  float: right;
+  width: 50%;
+}
+
+.floatheader {
+  color: #885555;
+  font-weight: bold;
+}
+
 .small {
   font-size: small;
 }
@@ -194,3 +204,37 @@ body {
 #resultstable th {
   background: #eee;
 }
+
+/*
+ * TableKit css
+ */
+
+.sortcol {
+  cursor: pointer;
+  padding-right: 20px !important;
+  background-repeat: no-repeat !important;
+  background-position: right center !important;
+}
+.sortasc {
+  background-image: url(/static/images/up.gif) !important;
+}
+.sortdesc {
+  background-image: url(/static/images/down.gif) !important;
+}
+.nosort {
+  cursor: default;
+}
+
+th.resize-handle-active {
+  cursor: e-resize;
+}
+
+div.resize-handle {
+  cursor: e-resize;
+  width: 2px;
+  border-right: 1px dashed #1E90FF;
+  position:absolute;
+  top:0;
+  left:0;
+}
+
diff --git a/ipa-server/ipa-gui/ipagui/static/images/down.gif b/ipa-server/ipa-gui/ipagui/static/images/down.gif
new file mode 100644
index 000000000..c527b4e61
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/static/images/down.gif
diff --git a/ipa-server/ipa-gui/ipagui/static/images/up.gif b/ipa-server/ipa-gui/ipagui/static/images/up.gif
new file mode 100644
index 000000000..c5ef548a1
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/static/images/up.gif
diff --git a/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js b/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js
new file mode 100644
index 000000000..2851f8431
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js
@@ -0,0 +1,846 @@
+/*
+*
+* Copyright (c) 2007 Andrew Tetlaw & Millstream Web Software
+* http://www.millstream.com.au/view/code/tablekit/
+* Version: 1.2.1 2007-03-11
+* 
+* Permission is hereby granted, free of charge, to any person
+* obtaining a copy of this software and associated documentation
+* files (the "Software"), to deal in the Software without
+* restriction, including without limitation the rights to use, copy,
+* modify, merge, publish, distribute, sublicense, and/or sell copies
+* of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+* 
+* The above copyright notice and this permission notice shall be
+* included in all copies or substantial portions of the Software.
+* 
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE.
+* * 
+*/
+
+// Use the TableKit class constructure if you'd prefer to init your tables as JS objects
+var TableKit = Class.create();
+
+TableKit.prototype = {
+	initialize : function(elm, options) {
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {
+			return;
+		}
+		TableKit.register(table,Object.extend(TableKit.options,options || {}));
+		this.id = table.id;
+		var op = TableKit.option('sortable resizable editable', this.id);
+		if(op.sortable) {
+			TableKit.Sortable.init(table);
+		} 
+		if(op.resizable) {
+			TableKit.Resizable.init(table);
+		}
+		if(op.editable) {
+			TableKit.Editable.init(table);
+		}
+	},
+	sort : function(column, order) {
+		TableKit.Sortable.sort(this.id, column, order);
+	},
+	resizeColumn : function(column, w) {
+		TableKit.Resizable.resize(this.id, column, w);
+	},
+	editCell : function(row, column) {
+		TableKit.Editable.editCell(this.id, row, column);
+	}
+};
+
+Object.extend(TableKit, {
+	getBodyRows : function(table) {
+		table = $(table);
+		var id = table.id;
+		if(!TableKit.rows[id]) {
+			TableKit.rows[id] = (table.tHead && table.tHead.rows.length > 0) ? $A(table.tBodies[0].rows) : $A(table.rows).without(table.rows[0]);
+		}
+		return TableKit.rows[id];
+	},
+	getHeaderCells : function(table, cell) {
+		if(!table) { table = $(cell).up('table'); }
+		var id = table.id;
+		if(!TableKit.heads[id]) {
+			TableKit.heads[id] = $A((table.tHead && table.tHead.rows.length > 0) ? table.tHead.rows[table.tHead.rows.length-1].cells : table.rows[0].cells);
+		}
+		return TableKit.heads[id];
+	},
+	getCellIndex : function(cell) {
+		return $A(cell.parentNode.cells).indexOf(cell);
+	},
+	getRowIndex : function(row) {
+		return $A(row.parentNode.rows).indexOf(row);
+	},
+	getCellText : function(cell, refresh) {
+		if(!cell) { return ""; }
+		TableKit.registerCell(cell);
+		var data = TableKit.cells[cell.id];
+		if(refresh || data.refresh || !data.textContent) {
+			data.textContent = cell.textContent ? cell.textContent : cell.innerText;
+			data.refresh = false;
+		}
+		return data.textContent;
+	},
+	register : function(table, options) {
+		if(!table.id) {
+			TableKit._tblcount += 1;
+			table.id = "tablekit-table-" + TableKit._tblcount;
+		}
+		var id = table.id;
+		TableKit.tables[id] = TableKit.tables[id] ? Object.extend(TableKit.tables[id], options || {}) : Object.extend({sortable:false,resizable:false,editable:false}, options || {});
+	},
+	registerCell : function(cell) {
+		if(!cell.id) {
+			TableKit._cellcount += 1;
+			cell.id = "tablekit-cell-" + TableKit._cellcount;
+		}
+		if(!TableKit.cells[cell.id]) {
+			TableKit.cells[cell.id] = {textContent : '', htmlContent : '', active : false};
+		}
+	},
+	isSortable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].sortable : false;
+	},
+	isResizable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].resizable : false;
+	},
+	isEditable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].editable : false;
+	},
+	setup : function(o) {
+		Object.extend(TableKit.options, o || {} );
+	},
+	option : function(s, id, o1, o2) {
+		o1 = o1 || TableKit.options;
+		o2 = o2 || (id ? (TableKit.tables[id] ? TableKit.tables[id] : {}) : {});
+		var key = id + s;
+		if(!TableKit._opcache[key]){
+			TableKit._opcache[key] = $A($w(s)).inject([],function(a,v){
+				a.push(a[v] = o2[v] || o1[v]);
+				return a;
+			});
+		}
+		return TableKit._opcache[key];
+	},
+	e : function(event) {
+		return event || window.event;
+	},
+	tables : {},
+	_opcache : {},
+	cells : {},
+	rows : {},
+	heads : {},
+	options : {
+		autoLoad : true,
+		stripe : true,
+		sortable : true,
+		resizable : true,
+		editable : true,
+		rowEvenClass : 'roweven',
+		rowOddClass : 'rowodd',
+		sortableSelector : ['table.sortable'],
+		columnClass : 'sortcol',
+		descendingClass : 'sortdesc',
+		ascendingClass : 'sortasc',
+		noSortClass : 'nosort',
+		sortFirstAscendingClass : 'sortfirstasc',
+		sortFirstDecendingClass : 'sortfirstdesc',
+		resizableSelector : ['table.resizable'],
+		minWidth : 10,
+		showHandle : true,
+		resizeOnHandleClass : 'resize-handle-active',
+		editableSelector : ['table.editable'],
+		formClassName : 'editable-cell-form',
+		noEditClass : 'noedit',
+		editAjaxURI : '/',
+		editAjaxOptions : {}
+	},
+	_tblcount : 0,
+	_cellcount : 0,
+	load : function() {
+		if(TableKit.options.autoLoad) {
+			if(TableKit.options.sortable) {
+				$A(TableKit.options.sortableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Sortable.init(t);
+					});
+				});
+			}
+			if(TableKit.options.resizable) {
+				$A(TableKit.options.resizableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Resizable.init(t);
+					});
+				});
+			}
+			if(TableKit.options.editable) {
+				$A(TableKit.options.editableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Editable.init(t);
+					});
+				});
+			}
+		}
+	}
+});
+
+TableKit.Rows = {
+	stripe : function(table) {
+		var rows = TableKit.getBodyRows(table);
+		rows.each(function(r,i) {
+			TableKit.Rows.addStripeClass(table,r,i);
+		});
+	},
+	addStripeClass : function(t,r,i) {
+		t = t || r.up('table');
+		var op = TableKit.option('rowEvenClass rowOddClass', t.id);
+		var css = ((i+1)%2 === 0 ? op[0] : op[1]);
+		// using prototype's assClassName/RemoveClassName was not efficient for large tables, hence:
+		var cn = r.className.split(/\s+/);
+		var newCn = [];
+		for(var x = 0, l = cn.length; x < l; x += 1) {
+			if(cn[x] !== op[0] && cn[x] !== op[1]) { newCn.push(cn[x]); }
+		}
+		newCn.push(css);
+		r.className = newCn.join(" ");
+	}
+};
+
+TableKit.Sortable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {
+			return;
+		}
+		TableKit.register(table,Object.extend(options || {},{sortable:true}));
+		var sortFirst;
+		var cells = TableKit.getHeaderCells(table);
+		var op = TableKit.option('noSortClass columnClass sortFirstAscendingClass sortFirstDecendingClass', table.id);
+		cells.each(function(c){
+			c = $(c);
+			if(!c.hasClassName(op.noSortClass)) {
+				Event.observe(c, 'mousedown', TableKit.Sortable._sort);
+				c.addClassName(op.columnClass);
+				if(c.hasClassName(op.sortFirstAscendingClass) || c.hasClassName(op.sortFirstDecendingClass)) {
+					sortFirst = c;
+				}
+			}
+		});
+
+		if(sortFirst) {
+			if(sortFirst.hasClassName(op.sortFirstAscendingClass)) {
+				TableKit.Sortable.sort(table, sortFirst, 1);
+			} else {
+				TableKit.Sortable.sort(table, sortFirst, -1);
+			}
+		} else { // just add row stripe classes
+			TableKit.Rows.stripe(table);
+		}
+	},
+	reload : function(table) {
+		table = $(table);
+		var cells = TableKit.getHeaderCells(table);
+		var op = TableKit.option('noSortClass columnClass', table.id);
+		cells.each(function(c){
+			c = $(c);
+			if(!c.hasClassName(op.noSortClass)) {
+				Event.stopObserving(c, 'mousedown', TableKit.Sortable._sort);
+				c.removeClassName(op.columnClass);
+			}
+		});
+		TableKit.Sortable.init(table);
+	},
+	_sort : function(e) {
+		if(TableKit.Resizable._onHandle) {return;}
+		e = TableKit.e(e);
+		Event.stop(e);
+		var cell = Event.element(e);
+		while(!(cell.tagName && cell.tagName.match(/td|th/gi))) {
+			cell = cell.parentNode;
+		}
+		TableKit.Sortable.sort(null, cell);
+	},
+	sort : function(table, index, order) {
+		var cell;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {
+				return;
+			}
+			table = $(table);
+			index = Math.min(table.rows[0].cells.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cell = (table.tHead && table.tHead.rows.length > 0) ? $(table.tHead.rows[table.tHead.rows.length-1].cells[index]) : $(table.rows[0].cells[index]);
+		} else {
+			cell = $(index);
+			table = table ? $(table) : cell.up('table');
+			index = TableKit.getCellIndex(cell);
+		}
+		var op = TableKit.option('noSortClass descendingClass ascendingClass', table.id);
+		
+		if(cell.hasClassName(op.noSortClass)) {return;}	
+		
+		order = order ? order : (cell.hasClassName(op.descendingClass) ? 1 : -1);
+		var rows = TableKit.getBodyRows(table);
+
+		if(cell.hasClassName(op.ascendingClass) || cell.hasClassName(op.descendingClass)) {
+			rows.reverse(); // if it was already sorted we just need to reverse it.
+		} else {
+			var datatype = TableKit.Sortable.getDataType(cell,index,table);
+			var tkst = TableKit.Sortable.types;
+			rows.sort(function(a,b) {
+				return order * tkst[datatype].compare(TableKit.getCellText(a.cells[index]),TableKit.getCellText(b.cells[index]));
+			});
+		}
+		var tb = table.tBodies[0];
+		var tkr = TableKit.Rows;
+		rows.each(function(r,i) {
+			tb.appendChild(r);
+			tkr.addStripeClass(table,r,i);
+		});
+		var hcells = TableKit.getHeaderCells(null, cell);
+		$A(hcells).each(function(c,i){
+			c = $(c);
+			c.removeClassName(op.ascendingClass);
+			c.removeClassName(op.descendingClass);
+			if(index === i) {
+				if(order === 1) {
+					c.removeClassName(op.descendingClass);
+					c.addClassName(op.ascendingClass);
+				} else {
+					c.removeClassName(op.ascendingClass);
+					c.addClassName(op.descendingClass);
+				}
+			}
+		});
+	},
+	types : {},
+	detectors : [],
+	addSortType : function() {
+		$A(arguments).each(function(o){
+			TableKit.Sortable.types[o.name] = o;
+		});
+	},
+	getDataType : function(cell,index,table) {
+		cell = $(cell);
+		index = (index || index === 0) ? index : TableKit.getCellIndex(cell);
+		
+		var colcache = TableKit.Sortable._coltypecache;
+		var cache = colcache[table.id] ? colcache[table.id] : (colcache[table.id] = {});
+		
+		if(!cache[index]) {
+			var t = '';
+			// first look for a data type id on the heading row cell
+			if(cell.id && TableKit.Sortable.types[cell.id]) {
+				t = cell.id;
+			}
+			t = cell.classNames().detect(function(n){ // then look for a data type classname on the heading row cell
+				return (TableKit.Sortable.types[n]) ? true : false;
+			});
+			if(!t) {
+				var rows = TableKit.getBodyRows(table);
+				cell = rows[0].cells[index]; // grab same index cell from body row to try and match data type
+				t = TableKit.Sortable.detectors.detect(
+						function(d){
+							return TableKit.Sortable.types[d].detect(TableKit.getCellText(cell));
+						});
+			}
+			cache[index] = t;
+		}
+		return cache[index];
+	},
+	_coltypecache : {}
+};
+
+TableKit.Sortable.detectors = $A($w('date-iso date date-eu date-au time currency datasize number casesensitivetext text')); // setting it here because Safari complained when I did it above...
+
+TableKit.Sortable.Type = Class.create();
+TableKit.Sortable.Type.prototype = {
+	initialize : function(name, options){
+		this.name = name;
+		options = Object.extend({
+			normal : function(v){
+				return v;
+			},
+			pattern : /.*/
+		}, options || {});
+		this.normal = options.normal;
+		this.pattern = options.pattern;
+		if(options.compare) {
+			this.compare = options.compare;
+		}
+		if(options.detect) {
+			this.detect = options.detect;
+		}
+	},
+	compare : function(a,b){
+		return TableKit.Sortable.Type.compare(this.normal(a), this.normal(b));
+	},
+	detect : function(v){
+		return this.pattern.test(v);
+	}
+};
+
+TableKit.Sortable.Type.compare = function(a,b) {
+	return a < b ? -1 : a === b ? 0 : 1;
+};
+
+TableKit.Sortable.addSortType(
+	new TableKit.Sortable.Type('number', {
+		pattern : /^[-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?/,
+		normal : function(v) {
+			// This will grab the first thing that looks like a number from a string, so you can use it to order a column of various srings containing numbers.
+			v = parseFloat(v.replace(/^.*?([-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?).*$/,"$1"));
+			return isNaN(v) ? 0 : v;
+		}}),
+	new TableKit.Sortable.Type('text',{
+		normal : function(v) {
+			return v ? v.toLowerCase() : '';
+		}}),
+	new TableKit.Sortable.Type('casesensitivetext',{pattern : /^[A-Z]+$/}),
+	new TableKit.Sortable.Type('datasize',{
+		pattern : /^[-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?\s?[k|m|g|t]b$/i,
+		normal : function(v) {
+			var r = v.match(/^([-+]?[\d]*\.?[\d]+([eE][-+]?[\d]+)?)\s?([k|m|g|t]?b)?/i);
+			var b = r[1] ? Number(r[1]).valueOf() : 0;
+			var m = r[3] ? r[3].substr(0,1).toLowerCase() : '';
+			var result = b;
+			switch(m) {
+				case  'k':
+					result = b * 1024;
+					break;
+				case  'm':				
+					result = b * 1024 * 1024;
+					break;
+				case  'g':
+					result = b * 1024 * 1024 * 1024;
+					break;
+				case  't':
+					result = b * 1024 * 1024 * 1024 * 1024;
+					break;
+			}
+			return result;
+		}}),
+	new TableKit.Sortable.Type('date-au',{
+		pattern : /^\d{2}\/\d{2}\/\d{4}\s?(?:\d{1,2}\:\d{2}(?:\:\d{2})?\s?[a|p]?m?)?/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})\/(\d{2})\/(\d{4})\s?(?:(\d{1,2})\:(\d{2})(?:\:(\d{2}))?\s?([a|p]?m?))?/i);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[2],10)-1;
+			var day_num = r[1];
+			var hr_num = r[4] ? r[4] : 0;
+			if(r[7] && r[7].toLowerCase().indexOf('p') !== -1) {
+				hr_num = parseInt(r[4],10) + 12;
+			}
+			var min_num = r[5] ? r[5] : 0;
+			var sec_num = r[6] ? r[6] : 0;
+			return new Date(yr_num, mo_num, day_num, hr_num, min_num, sec_num, 0).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-us',{
+		pattern : /^\d{2}\/\d{2}\/\d{4}\s?(?:\d{1,2}\:\d{2}(?:\:\d{2})?\s?[a|p]?m?)?/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})\/(\d{2})\/(\d{4})\s?(?:(\d{1,2})\:(\d{2})(?:\:(\d{2}))?\s?([a|p]?m?))?/i);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[1],10)-1;
+			var day_num = r[2];
+			var hr_num = r[4] ? r[4] : 0;
+			if(r[7] && r[7].toLowerCase().indexOf('p') !== -1) {
+				hr_num = parseInt(r[4],10) + 12;
+			}
+			var min_num = r[5] ? r[5] : 0;
+			var sec_num = r[6] ? r[6] : 0;
+			return new Date(yr_num, mo_num, day_num, hr_num, min_num, sec_num, 0).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-eu',{
+		pattern : /^\d{2}-\d{2}-\d{4}/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})-(\d{2})-(\d{4})/);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[2],10)-1;
+			var day_num = r[1];
+			return new Date(yr_num, mo_num, day_num).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-iso',{
+		pattern : /[\d]{4}-[\d]{2}-[\d]{2}(?:T[\d]{2}\:[\d]{2}(?:\:[\d]{2}(?:\.[\d]+)?)?(Z|([-+][\d]{2}:[\d]{2})?)?)?/, // 2005-03-26T19:51:34Z
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+		    var d = v.match(/([\d]{4})(-([\d]{2})(-([\d]{2})(T([\d]{2}):([\d]{2})(:([\d]{2})(\.([\d]+))?)?(Z|(([-+])([\d]{2}):([\d]{2})))?)?)?)?/);		
+		    var offset = 0;
+		    var date = new Date(d[1], 0, 1);
+		    if (d[3]) { date.setMonth(d[3] - 1) ;}
+		    if (d[5]) { date.setDate(d[5]); }
+		    if (d[7]) { date.setHours(d[7]); }
+		    if (d[8]) { date.setMinutes(d[8]); }
+		    if (d[10]) { date.setSeconds(d[10]); }
+		    if (d[12]) { date.setMilliseconds(Number("0." + d[12]) * 1000); }
+		    if (d[14]) {
+		        offset = (Number(d[16]) * 60) + Number(d[17]);
+		        offset *= ((d[15] === '-') ? 1 : -1);
+		    }
+		    offset -= date.getTimezoneOffset();
+		    if(offset !== 0) {
+		    	var time = (Number(date) + (offset * 60 * 1000));
+		    	date.setTime(Number(time));
+		    }
+			return date.valueOf();
+		}}),
+	new TableKit.Sortable.Type('date',{
+		pattern: /^(?:sun|mon|tue|wed|thu|fri|sat)\,\s\d{1,2}\s(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s\d{4}(?:\s\d{2}\:\d{2}(?:\:\d{2})?(?:\sGMT(?:[+-]\d{4})?)?)?/i, //Mon, 18 Dec 1995 17:28:35 GMT
+		compare : function(a,b) { // must be standard javascript date format
+			if(a && b) {
+				return TableKit.Sortable.Type.compare(new Date(a),new Date(b));
+			} else {
+				return TableKit.Sortable.Type.compare(a ? 1 : 0, b ? 1 : 0);
+			}
+		}}),
+	new TableKit.Sortable.Type('time',{
+		pattern : /^\d{1,2}\:\d{2}(?:\:\d{2})?(?:\s[a|p]m)?$/i,
+		compare : function(a,b) {
+			var d = new Date();
+			var ds = d.getMonth() + "/" + d.getDate() + "/" + d.getFullYear() + " ";
+			return TableKit.Sortable.Type.compare(new Date(ds + a),new Date(ds + b));
+		}}),
+	new TableKit.Sortable.Type('currency',{
+		pattern : /^[$£¥€¤]/, // dollar,pound,yen,euro,generic currency symbol
+		normal : function(v) {
+			return v ? parseFloat(v.replace(/[^-\d\.]/g,'')) : 0;
+		}})
+);
+
+TableKit.Resizable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {return;}
+		TableKit.register(table,Object.extend(options || {},{resizable:true}));		 
+		var cells = TableKit.getHeaderCells(table);
+		cells.each(function(c){
+			c = $(c);
+			Event.observe(c, 'mouseover', TableKit.Resizable.initDetect);
+			Event.observe(c, 'mouseout', TableKit.Resizable.killDetect);
+		});
+	},
+	resize : function(table, index, w) {
+		var cell;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {return;}
+			table = $(table);
+			index = Math.min(table.rows[0].cells.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cell = (table.tHead && table.tHead.rows.length > 0) ? $(table.tHead.rows[table.tHead.rows.length-1].cells[index]) : $(table.rows[0].cells[index]);
+		} else {
+			cell = $(index);
+			table = table ? $(table) : cell.up('table');
+			index = TableKit.getCellIndex(cell);
+		}
+		var pad = parseInt(cell.getStyle('paddingLeft'),10) + parseInt(cell.getStyle('paddingRight'),10);
+		w = Math.max(w-pad, TableKit.option('minWidth', table.id)[0]);
+		
+		cell.setStyle({'width' : w + 'px'});
+	},
+	initDetect : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.element(e);
+		Event.observe(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.observe(cell, 'mousedown', TableKit.Resizable.startResize);
+	},
+	detectHandle : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.element(e);
+  		if(TableKit.Resizable.pointerPos(cell,Event.pointerX(e),Event.pointerY(e))){
+  			cell.addClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+  			TableKit.Resizable._onHandle = true;
+  		} else {
+  			cell.removeClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+  			TableKit.Resizable._onHandle = false;
+  		}
+	},
+	killDetect : function(e) {
+		e = TableKit.e(e);
+		TableKit.Resizable._onHandle = false;
+		var cell = Event.element(e);
+		Event.stopObserving(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.stopObserving(cell, 'mousedown', TableKit.Resizable.startResize);
+		cell.removeClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+	},
+	startResize : function(e) {
+		e = TableKit.e(e);
+		if(!TableKit.Resizable._onHandle) {return;}
+		var cell = Event.element(e);
+		Event.stopObserving(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.stopObserving(cell, 'mousedown', TableKit.Resizable.startResize);
+		Event.stopObserving(cell, 'mouseout', TableKit.Resizable.killDetect);
+		TableKit.Resizable._cell = cell;
+		var table = cell.up('table');
+		TableKit.Resizable._tbl = table;
+		if(TableKit.option('showHandle', table.id)[0]) {
+			TableKit.Resizable._handle = $(document.createElement('div')).addClassName('resize-handle').setStyle({
+				'top' : Position.cumulativeOffset(cell)[1] + 'px',
+				'left' : Event.pointerX(e) + 'px',
+				'height' : table.getDimensions().height + 'px'
+			});
+			document.body.appendChild(TableKit.Resizable._handle);
+		}
+		Event.observe(document, 'mousemove', TableKit.Resizable.drag);
+		Event.observe(document, 'mouseup', TableKit.Resizable.endResize);
+		Event.stop(e);
+	},
+	endResize : function(e) {
+		e = TableKit.e(e);
+		var cell = TableKit.Resizable._cell;
+		TableKit.Resizable.resize(null, cell, (Event.pointerX(e) - Position.cumulativeOffset(cell)[0]));
+		Event.stopObserving(document, 'mousemove', TableKit.Resizable.drag);
+		Event.stopObserving(document, 'mouseup', TableKit.Resizable.endResize);
+		if(TableKit.option('showHandle', TableKit.Resizable._tbl.id)[0]) {
+			$$('div.resize-handle').each(function(elm){
+				document.body.removeChild(elm);
+			});
+		}
+		Event.observe(cell, 'mouseout', TableKit.Resizable.killDetect);
+		TableKit.Resizable._tbl = TableKit.Resizable._handle = TableKit.Resizable._cell = null;
+		Event.stop(e);
+	},
+	drag : function(e) {
+		e = TableKit.e(e);
+		if(TableKit.Resizable._handle === null) {
+			try {
+				TableKit.Resizable.resize(TableKit.Resizable._tbl, TableKit.Resizable._cell, (Event.pointerX(e) - Position.cumulativeOffset(TableKit.Resizable._cell)[0]));
+			} catch(e) {}
+		} else {
+			TableKit.Resizable._handle.setStyle({'left' : Event.pointerX(e) + 'px'});
+		}
+		return false;
+	},
+	pointerPos : function(element, x, y) {
+    	var offset = Position.cumulativeOffset(element);
+	    return (y >= offset[1] &&
+	            y <  offset[1] + element.offsetHeight &&
+	            x >= offset[0] + element.offsetWidth - 5 &&
+	            x <  offset[0] + element.offsetWidth);
+  	},
+	_onHandle : false,
+	_cell : null,
+	_tbl : null,
+	_handle : null
+};
+
+
+TableKit.Editable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {return;}
+		TableKit.register(table,Object.extend(options || {},{editable:true}));
+		Event.observe(table.tBodies[0], 'click', TableKit.Editable._editCell);
+	},
+	_editCell : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.findElement(e,'td');
+		TableKit.Editable.editCell(null, cell);
+	},
+	editCell : function(table, index, cindex) {
+		var cell, row;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {return;}
+			table = $(table);
+			index = Math.min(table.tBodies[0].rows.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cindex = Math.min(table.rows[0].cells.length, cindex);
+			cindex = Math.max(1, cindex);
+			cindex -= 1;
+			row = $(table.tBodies[0].rows[index]);
+			cell = $(row.cells[cindex]);
+		} else {
+			cell = $(index);
+			table = (table && table.tagName && table.tagName !== "TABLE") ? $(table) : cell.up('table');
+			row = cell.up('tr');
+		}
+		var op = TableKit.option('noEditClass', table.id);
+		if(cell.hasClassName(op.noEditClass)) {return;}
+		
+		var head = $(TableKit.getHeaderCells(table, cell)[TableKit.getCellIndex(cell)]);
+		if(head.hasClassName(op.noEditClass)) {return;}
+		
+		TableKit.registerCell(cell);
+		var data = TableKit.cells[cell.id];
+		if(data.active) {return;}
+		data.htmlContent = cell.innerHTML;
+		var ftype = TableKit.Editable.types['text-input'];
+		if(head.id && TableKit.Editable.types[head.id]) {
+			ftype = TableKit.Editable.types[head.id];
+		} else {
+			var n = head.classNames().detect(function(n){
+					return (TableKit.Editable.types[n]) ? true : false;
+			});
+			ftype = n ? TableKit.Editable.types[n] : ftype;
+		}
+		ftype.edit(cell);
+		data.active = true;
+	},
+	types : {},
+	addCellEditor : function(o) {
+		if(o && o.name) { TableKit.Editable.types[o.name] = o; }
+	}
+};
+
+TableKit.Editable.CellEditor = Class.create();
+TableKit.Editable.CellEditor.prototype = {
+	initialize : function(name, options){
+		this.name = name;
+		this.options = Object.extend({
+			element : 'input',
+			attributes : {name : 'value', type : 'text'},
+			selectOptions : [],
+			showSubmit : true,
+			submitText : 'OK',
+			showCancel : true,
+			cancelText : 'Cancel',
+			ajaxURI : null,
+			ajaxOptions : null
+		}, options || {});
+	},
+	edit : function(cell) {
+		cell = $(cell);
+		var op = this.options;
+		var table = cell.up('table');
+		
+		var form = $(document.createElement("form"));
+		form.id = cell.id + '-form';
+		form.addClassName(TableKit.option('formClassName', table.id)[0]);
+		form.onsubmit = this._submit.bindAsEventListener(this);
+		
+		var field = document.createElement(op.element);
+			$H(op.attributes).each(function(v){
+				field[v.key] = v.value;
+			});
+			switch(op.element) {
+				case 'input':
+				case 'textarea':
+				field.value = TableKit.getCellText(cell);
+				break;
+				
+				case 'select':
+				var txt = TableKit.getCellText(cell);
+				$A(op.selectOptions).each(function(v){
+					field.options[field.options.length] = new Option(v[0], v[1]);
+					if(txt === v[1]) {
+						field.options[field.options.length-1].selected = 'selected';
+					}
+				});
+				break;
+			}
+			form.appendChild(field);
+			if(op.element === 'textarea') {
+				form.appendChild(document.createElement("br"));
+			}
+			if(op.showSubmit) {
+				var okButton = document.createElement("input");
+				okButton.type = "submit";
+				okButton.value = op.submitText;
+				okButton.className = 'editor_ok_button';
+				form.appendChild(okButton);
+			}
+			if(op.showCancel) {
+				var cancelLink = document.createElement("a");
+				cancelLink.href = "#";
+				cancelLink.appendChild(document.createTextNode(op.cancelText));
+				cancelLink.onclick = this._cancel.bindAsEventListener(this);
+				cancelLink.className = 'editor_cancel';      
+				form.appendChild(cancelLink);
+			}
+			cell.innerHTML = '';
+			cell.appendChild(form);
+	},
+	_submit : function(e) {
+		var cell = Event.findElement(e,'td');
+		var form = Event.findElement(e,'form');
+		Event.stop(e);
+		this.submit(cell,form);
+	},
+	submit : function(cell, form) {
+		var op = this.options;
+		form = form ? form : cell.down('form');
+		var head = $(TableKit.getHeaderCells(null, cell)[TableKit.getCellIndex(cell)]);
+		var row = cell.up('tr');
+		var table = cell.up('table');
+		var s = '&row=' + (TableKit.getRowIndex(row)+1) + '&cell=' + (TableKit.getCellIndex(cell)+1) + '&id=' + row.id + '&field=' + head.id + '&' + Form.serialize(form);
+		this.ajax = new Ajax.Updater(cell, op.ajaxURI || TableKit.option('editAjaxURI', table.id)[0], Object.extend(op.ajaxOptions || TableKit.option('editAjaxOptions', table.id)[0], {
+			postBody : s,
+			onComplete : function() {
+				var data = TableKit.cells[cell.id];
+				data.active = false;
+				data.refresh = true; // mark cell cache for refreshing, in case cell contents has changed and sorting is applied
+			}
+		}));
+	},
+	_cancel : function(e) {
+		var cell = Event.findElement(e,'td');
+		Event.stop(e);
+		this.cancel(cell);
+	},
+	cancel : function(cell) {
+		this.ajax = null;
+		var data = TableKit.cells[cell.id];
+		cell.innerHTML = data.htmlContent;
+		data.htmlContent = '';
+		data.active = false;
+	},
+	ajax : null
+};
+
+TableKit.Editable.textInput = function(n,attributes) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'input',
+		attributes : Object.extend({name : 'value', type : 'text'}, attributes||{})
+	}));
+};
+TableKit.Editable.textInput('text-input');
+
+TableKit.Editable.multiLineInput = function(n,attributes) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'textarea',
+		attributes : Object.extend({name : 'value', rows : '5', cols : '20'}, attributes||{})
+	}));	
+};	
+TableKit.Editable.multiLineInput('multi-line-input');
+
+TableKit.Editable.selectInput = function(n,attributes,selectOptions) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'select',
+		attributes : Object.extend({name : 'value'}, attributes||{}),
+		'selectOptions' : selectOptions
+	}));	
+};
+
+/*
+TableKit.Bench = {
+	bench : [],
+	start : function(){
+		TableKit.Bench.bench[0] = new Date().getTime();
+	},
+	end : function(s){
+		TableKit.Bench.bench[1] = new Date().getTime();
+		alert(s + ' ' + ((TableKit.Bench.bench[1]-TableKit.Bench.bench[0])/1000)+' seconds.') //console.log(s + ' ' + ((TableKit.Bench.bench[1]-TableKit.Bench.bench[0])/1000)+' seconds.')
+		TableKit.Bench.bench = [];
+	}
+} */
+
+if(window.FastInit) {
+	FastInit.addOnLoad(TableKit.load);
+} else {
+	Event.observe(window, 'load', TableKit.load);
+}
\ No newline at end of file
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupedit.kid b/ipa-server/ipa-gui/ipagui/templates/groupedit.kid
new file mode 100644
index 000000000..f1d309ca9
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/groupedit.kid
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>Edit Group</title>
+</head>
+<body>
+  <div>
+    <div style="float:right">
+      <input type="checkbox" id="toggleprotected_checkbox"
+          onclick="toggleProtectedFields(this);">
+        <span class="small">edit protected fields</span>
+      </input>
+    </div>
+    <h2>Edit Group</h2>
+  </div>
+
+  ${form.display(action="groupupdate", value=group, members=members)}
+</body>
+</html>
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
new file mode 100644
index 000000000..9e388ee70
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
@@ -0,0 +1,312 @@
+<div xmlns:py="http://purl.org/kid/ns#"
+  class="simpleroster">
+  <form action="${action}" name="${name}" method="${method}" class="tableform"
+      onsubmit="preSubmit()" >
+
+
+  <?python searchurl = tg.url('/userlist_ajax') ?>
+
+  <script type="text/javascript">
+    // this is used for round-trip recontruction of the names.
+    // the hidden fields only contain uids.  
+    var uid_to_cn_hash = new Hash();
+
+    // used to filter search results.
+    // records uids already in the group
+    var member_hash = new Hash();
+
+    // used to prevent double adding
+    // records uid to be added
+    var added_hash = new Hash();
+
+
+    function toggleProtectedFields(checkbox) {
+      var gidnumberField = $('form_gidnumber');
+      if (checkbox.checked) {
+        gidnumberField.disabled = false;
+        $('form_editprotected').value = 'true';
+      } else {
+        gidnumberField.disabled = true;
+        $('form_editprotected').value = '';
+      }
+    }
+
+    /*
+     * Callback used for afterFinish in scriptaculous effect
+     */
+    function removeElement(effect) {
+      Element.remove(effect.element);
+    }
+
+    function adduser(uid, cn) {
+      uid_to_cn_hash[uid] = cn;
+
+      if ((added_hash[uid] == 1) || (member_hash[uid] == 1)) {
+        return null;
+      }
+      added_hash[uid] = 1;
+
+      var newdiv = document.createElement('div');
+      newdiv.appendChild(document.createTextNode(
+        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
+
+      var undolink = document.createElement('a');
+      undolink.setAttribute('href', '');
+      undolink.setAttribute('onclick',
+        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+        'added_hash.remove("' + uid + '");' +
+        'return false;');
+      undolink.appendChild(document.createTextNode("undo"));
+      newdiv.appendChild(undolink);
+
+      var uidInfo = document.createElement('input');
+      uidInfo.setAttribute('type', 'hidden');
+      uidInfo.setAttribute('name', 'uidadd');
+      uidInfo.setAttribute('value', uid);
+      newdiv.appendChild(uidInfo);
+
+      newdiv.style.display = 'none';
+      $('newmembers').appendChild(newdiv);
+
+      return newdiv
+    }
+
+    function adduserHandler(element, uid, cn) {
+      var newdiv = adduser(uid, cn)
+      if (newdiv != null) {
+        new Effect.Fade(Element.up(element));
+        new Effect.Appear(newdiv);
+        /* Element.up(element).remove(); */
+      }
+    }
+
+    function removeuser(uid, cn) {
+      uid_to_cn_hash[uid] = cn;
+
+      var newdiv = document.createElement('div');
+      newdiv.appendChild(document.createTextNode(
+        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
+
+      var undolink = document.createElement('a');
+      undolink.setAttribute('href', '');
+      undolink.setAttribute('onclick',
+        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+        "new Effect.Appear($('member-" + uid + "'));" +
+        'return false;');
+      undolink.appendChild(document.createTextNode("undo"));
+      newdiv.appendChild(undolink);
+
+      var uidInfo = document.createElement('input');
+      uidInfo.setAttribute('type', 'hidden');
+      uidInfo.setAttribute('name', 'uiddel');
+      uidInfo.setAttribute('value', uid);
+      newdiv.appendChild(uidInfo);
+
+      newdiv.style.display = 'none';
+      $('delmembers').appendChild(newdiv);
+
+      return newdiv
+    }
+
+    function removeuserHandler(element, uid, cn) {
+      var newdiv = removeuser(uid, cn);
+      new Effect.Fade(Element.up(element));
+      new Effect.Appear(newdiv);
+      /* Element.up(element).remove(); */
+    }
+
+    function enterDoSearch(e) {
+      var keyPressed;
+      if (window.event) {
+        keyPressed = window.event.keyCode;
+      } else {
+        keyPressed = e.which; 
+      }
+
+      if (keyPressed == 13) {
+        return doSearch();
+      } else {
+        return true;
+      }
+    }
+
+    function doSearch() {
+      $('searchresults').update("Searching...");
+      new Ajax.Updater('searchresults',
+          '${searchurl}',
+          {  asynchronous:true,
+             parameters: { uid: $('uid').value },
+             evalScripts: true });
+      return false;
+    }
+
+    function preSubmit() {
+      var json = uid_to_cn_hash.toJSON();
+      $('form_uid_to_cn_json').value = json;
+      return true;
+    }
+  </script>
+
+    <div py:for="field in hidden_fields"
+      py:replace="field.display(value_for(field), **params_for(field))" 
+      />
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.cn.field_id}"
+            py:content="group.cn.label" />:
+        </th>
+        <td>
+          <!-- <span py:replace="group.cn.display(value_for(group.cn))" />
+          <span py:if="tg.errors.get('cn')" class="fielderror"
+              py:content="tg.errors.get('cn')" /> -->
+          ${value_for(group.cn)}
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.description.field_id}"
+            py:content="group.description.label" />:
+        </th>
+        <td>
+          <span py:replace="group.description.display(value_for(group.description))" />
+          <span py:if="tg.errors.get('description')" class="fielderror"
+              py:content="tg.errors.get('description')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.gidnumber.field_id}"
+            py:content="group.gidnumber.label" />:
+        </th>
+        <td>
+          <span py:replace="group.gidnumber.display(value_for(group.gidnumber))" />
+          <span py:if="tg.errors.get('gidnumber')" class="fielderror"
+              py:content="tg.errors.get('gidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_gidnumber').disabled = true;
+          </script>
+        </td>
+      </tr>
+    </table>
+
+    <div>
+      <div class="formsection">Group Members</div>
+
+      <div class="floatlist">
+        <div class="floatheader">To Remove:</div>
+        <div id="delmembers">
+        </div>
+      </div>
+
+      <div>
+        <div py:for="member in members" id="member-${member.get('uid')}">
+          <?python
+          member_uid = member.get('uid')
+          member_name = "%s %s" % (member.get('givenname', ''),
+                                   member.get('sn', ''))
+          ?>
+          ${member_name} (${member_uid})
+          <a href="#" 
+            onclick="removeuserHandler(this, '${member_uid}', '${member_name}');
+                     return false;"
+          >remove</a>
+          <script type="text/javascript">
+            member_hash["${member_uid}"] = 1;
+          </script>
+        </div>
+      </div>
+
+    </div>
+
+    <div style="clear:both">
+      <div class="formsection">Add Persons</div>
+
+      <div class="floatlist">
+        <div class="floatheader">To Add:</div>
+        <div id="newmembers">
+        </div>
+      </div>
+
+      <div>
+        <div id="search">
+          <input id="uid" type="text" name="uid"
+            onkeypress="return enterDoSearch(event);" />
+          <input type="button" value="Find Users"
+            onclick="return doSearch();"
+          />
+        </div>
+        <div id="searchresults">
+        </div>
+      </div>
+    </div>
+
+
+
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <br />
+          <input type="submit" class="submitbutton" name="submit"
+              value="Update Group"/>
+        </th>
+        <td>
+          <br />
+          <input type="submit" class="submitbutton" name="submit"
+              value="Cancel Edit" />
+        </td>
+      </tr>
+    </table>
+
+  </form>
+
+  <script type="text/javascript">
+    /*
+     * This section restores the contents of the add and remove lists
+     * dynamically if we have to refresh the page
+     */
+    if ($('form_uid_to_cn_json').value != "") {
+      uid_to_cn_hash = new Hash($('form_uid_to_cn_json').value.evalJSON());
+    }
+
+    if ($('form_editprotected').value != "") {
+      $('toggleprotected_checkbox').checked = true;
+      toggleProtectedFields($('toggleprotected_checkbox'));
+    }
+  </script>
+
+  <?python
+  uidadds = value.get('uidadd', [])
+  if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
+      uidadds = [uidadds]
+
+  uiddels = value.get('uiddel', [])
+  if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
+      uiddels = [uiddels]
+  ?>
+
+  <script py:for="uidadd in uidadds">
+    var uid = "${uidadd}";
+    var cn = uid_to_cn_hash[uid];
+    var newdiv = adduser(uid, cn);
+    if (newdiv != null) {
+      newdiv.style.display = 'block';
+    }
+  </script>
+
+  <script py:for="uiddel in uiddels">
+    var uid = "${uiddel}";
+    var cn = uid_to_cn_hash[uid];
+    var newdiv = removeuser(uid, cn);
+    newdiv.style.display = 'block';
+    $('member-' + uid).style.display = 'none';
+  </script>
+
+</div>
diff --git a/ipa-server/ipa-gui/ipagui/templates/grouplist.kid b/ipa-server/ipa-gui/ipagui/templates/grouplist.kid
new file mode 100644
index 000000000..464208d20
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/grouplist.kid
@@ -0,0 +1,43 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+<meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+<title>Find Groups</title>
+</head>
+<body>
+    <div id="search">
+        <form action="${tg.url('/grouplist')}" method="post">
+            <input id="criteria" type="text" name="criteria" value="${criteria}" />
+            <input type="submit" value="Find Groups"/>
+        </form>
+        <script type="text/javascript">
+            document.getElementById("criteria").focus();
+        </script>
+    </div>
+    <div py:if='(groups != None) and (len(groups) > 0)'>
+        <h2>${len(groups)} results returned:</h2>
+        <table id="resultstable">
+            <tr>
+                <th>
+                    <label class="fieldlabel" py:content="fields.cn.label" />
+                </th>
+                <th>
+                    <label class="fieldlabel" py:content="fields.description.label" />
+                </th>
+            </tr>
+            <tr py:for="group in groups">
+                <td>
+                    <a href="${tg.url('/groupshow',cn=group.cn)}">${group.cn}</a>
+                </td>
+                <td>
+                    ${group.description}
+                </td>
+            </tr>
+        </table>
+    </div>
+    <div py:if='(groups != None) and (len(groups) == 0)'>
+        <h2>No results found for "${criteria}"</h2>
+    </div>
+</body>
+</html>
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupnew.kid b/ipa-server/ipa-gui/ipagui/templates/groupnew.kid
new file mode 100644
index 000000000..14c618d06
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/groupnew.kid
@@ -0,0 +1,13 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>Add Group</title>
+</head>
+<body>
+    <h2>Add Group</h2>
+
+    ${form.display(action="groupcreate")}
+</body>
+</html>
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid b/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid
new file mode 100644
index 000000000..66b7c43bb
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid
@@ -0,0 +1,55 @@
+<div xmlns:py="http://purl.org/kid/ns#"
+  class="simpleroster">
+  <form action="${action}" name="${name}" method="${method}" class="tableform">
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.cn.field_id}"
+            py:content="group.cn.label" />:
+        </th>
+        <td>
+          <span py:replace="group.cn.display(value_for(group.cn))" />
+          <span py:if="tg.errors.get('cn')" class="fielderror"
+              py:content="tg.errors.get('cn')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.description.field_id}"
+            py:content="group.description.label" />:
+        </th>
+        <td>
+          <span py:replace="group.description.display(value_for(group.description))" />
+          <span py:if="tg.errors.get('description')" class="fielderror"
+              py:content="tg.errors.get('description')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.gidnumber.field_id}"
+            py:content="group.gidnumber.label" />:
+        </th>
+        <td>
+          Generated by server
+        </td>
+      </tr>
+    </table>
+
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th></th>
+        <td>
+          <br />
+          <input type="submit" class="submitbutton" name="submit" value="Add Group"/>
+        </td>
+      </tr>
+    </table>
+
+  </form>
+</div>
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid
new file mode 100644
index 000000000..48fd36637
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid
@@ -0,0 +1,50 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>View Group</title>
+</head>
+<body>
+    <h2>View Group</h2>
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.cn.label" />:
+          </th>
+          <td>${group.get("cn")}</td>
+        </tr>
+
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.description.label" />:
+          </th>
+          <td>${group.get("description")}</td>
+        </tr>
+
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.gidnumber.label" />:
+          </th>
+          <td>${group.get("gidnumber")}</td>
+        </tr>
+    </table>
+
+    <div class="formsection">Group Members</div>
+    <div py:for="member in members">
+      <?python
+      member_name = "%s %s" % (member.get('givenname', ''),
+                               member.get('sn', ''))
+      ?>
+      ${member_name} (${member.get('uid')})
+    </div>
+
+    <br/>
+    <br/>
+
+    <a href="${tg.url('/groupedit', cn=group.get('cn'))}">edit</a>
+
+</body>
+</html>
diff --git a/ipa-server/ipa-gui/ipagui/templates/master.kid b/ipa-server/ipa-gui/ipagui/templates/master.kid
index 2d3a35f22..2675d3c40 100644
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid
@@ -69,8 +69,8 @@
         <a href="${tg.url('/userlist')}">Find People</a><br/>
         </p>
         <p>
-        <a href="${tg.url('/groupindex')}">Add Group</a><br/>
-        <a href="${tg.url('/groupindex')}">Find Groups</a><br/>
+        <a href="${tg.url('/groupnew')}">Add Group</a><br/>
+        <a href="${tg.url('/grouplist')}">Find Groups</a><br/>
         </p>
         <p>
         <a href="${tg.url('/')}">Manage Policy</a><br/>
diff --git a/ipa-server/ipa-gui/ipagui/templates/useredit.kid b/ipa-server/ipa-gui/ipagui/templates/useredit.kid
index 9e8d8f46f..b5e8447d2 100644
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid
@@ -9,7 +9,7 @@
 
   <div>
     <div style="float:right">
-      <input type="checkbox"
+      <input type="checkbox" id="toggleprotected_checkbox"
           onclick="toggleProtectedFields(this);">
         <span class="small">edit protected fields</span>
       </input>
diff --git a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
index ce92122bf..3f7db50d7 100644
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
@@ -13,11 +13,13 @@
         passwordConfirmField.disabled = false;
         uidnumberField.disabled = false;
         gidnumberField.disabled = false;
+        $('form_editprotected').value = 'true';
       } else {
         passwordField.disabled = true;
         passwordConfirmField.disabled = true;
         uidnumberField.disabled = true;
         gidnumberField.disabled = true;
+        $('form_editprotected').value = '';
       }
     }
   </script>
@@ -228,4 +230,11 @@
     </table>
 
   </form>
+
+  <script type="text/javascript">
+    if ($('form_editprotected').value != "") {
+      $('toggleprotected_checkbox').checked = true;
+      toggleProtectedFields($('toggleprotected_checkbox'));
+    }
+  </script>
 </div>
diff --git a/ipa-server/ipa-gui/ipagui/templates/userlist.kid b/ipa-server/ipa-gui/ipagui/templates/userlist.kid
index 1f3e72b00..1c244d05c 100644
--- a/ipa-server/ipa-gui/ipagui/templates/userlist.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/userlist.kid
@@ -6,6 +6,7 @@
 <title>Find People</title>
 </head>
 <body>
+    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/tablekit.js')}"></script>
     <div id="search">
         <form action="${tg.url('/userlist')}" method="post">
             <input id="uid" type="text" name="uid" value="${uid}" />
@@ -17,10 +18,11 @@
     </div>
     <div py:if='(users != None) and (len(users) > 0)'>
         <h2>${len(users)} results returned:</h2>
-        <table id="resultstable">
+        <table id="resultstable" class="sortable resizable">
+          <thead>
             <tr>
                 <th>
-                    <label class="fieldlabel" py:content="fields.uid.label" />
+                    ${fields.uid.label}
                 </th>
                 <th>
                     Name
@@ -38,6 +40,8 @@
                     License Plate
                 </th>
             </tr>
+          </thead>
+          <tbody>
             <tr py:for="user in users">
                 <td>
                     <a href="${tg.url('/usershow',uid=user.uid)}">${user.uid}</a>
@@ -58,6 +62,7 @@
                     ${user.carLicense}
                 </td>
             </tr>
+          </tbody>
         </table>
     </div>
     <div py:if='(users != None) and (len(users) == 0)'>
diff --git a/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
new file mode 100644
index 000000000..e62fb8b91
--- /dev/null
+++ b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
@@ -0,0 +1,36 @@
+<div xmlns:py="http://purl.org/kid/ns#">
+    <div id="search-results-count">
+    </div>
+    <script type="text/javascript">
+      search_string = "${uid}";
+      results_counter = 0;
+    </script>
+    <div py:if='(users != None) and (len(users) > 0)'>
+        <div py:for="user in users" id="search-${user.uid}">
+          <script type="text/javascript">
+            if ((added_hash["${user.uid}"] == 1) ||
+                (member_hash["${user.uid}"] == 1)) {
+              $("search-${user.uid}").style.display = 'none';
+            } else {
+              results_counter = results_counter + 1;
+            }
+          </script>
+          ${user.givenName} ${user.sn} (${user.uid})
+          <a href="" 
+            onclick="adduserHandler(this, '${user.uid}', '${user.cn}'); return false;"
+          >add</a>
+        </div>
+    </div>
+    <script type="text/javascript">
+      if (results_counter == 0) {
+        var message = "No results found for " + search_string;
+      } else {
+        var message =  results_counter + " results found:";
+      }
+      $('search-results-count').appendChild(document.createTextNode(message));
+    </script>
+    <script py:if="counter &lt; 0">
+      $('search-results-count').appendChild(document.createTextNode(
+        " (truncated)"));
+    </script>
+</div>
diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py
index 7fc2327b3..2b93b6b8e 100644
--- a/ipa-server/xmlrpc-server/funcs.py
+++ b/ipa-server/xmlrpc-server/funcs.py
@@ -415,7 +415,7 @@ class IPAServer:
     
         return users
 
-    def find_users (self, criteria, sattrs=None, opts=None):
+    def find_users (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Returns a list: counter followed by the results.
            If the results are truncated, counter will be set to -1."""
         # Assume the list of fields to search will come from a central
@@ -437,13 +437,13 @@ class IPAServer:
         try:
             try:
                 exact_results = conn.getListAsync(self.basedn, self.scope,
-                        exact_match_filter, sattrs)
+                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 exact_results = [0]
 
             try:
                 partial_results = conn.getListAsync(self.basedn, self.scope,
-                        partial_match_filter, sattrs)
+                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 partial_results = [0]
         finally:
@@ -605,25 +605,72 @@ class IPAServer:
         finally:
             self.releaseConnection(conn)
 
-    def find_groups (self, criteria, sattrs=None, opts=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Return a list containing a User object for each
         existing group that matches the criteria.
         """
+        # Assume the list of fields to search will come from a central
+        # configuration repository.  A good format for that would be
+        # a comma-separated list of fields
+        search_fields_conf_str = "cn,description"
+        search_fields = string.split(search_fields_conf_str, ",")
+
         criteria = self.__safe_filter(criteria)
+        criteria_words = re.split(r'\s+', criteria)
+        criteria_words = filter(lambda value:value!="", criteria_words)
+        if len(criteria_words) == 0:
+            return [0]
+
+        (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
+                search_fields, criteria_words)
 
-        filter = "(&(cn=%s)(objectClass=posixGroup))" % criteria
+        #
+        # further constrain search to just the objectClass
+        # TODO - need to parameterize this into generate_match_filters,
+        #        and work it into the field-specification search feature
+        #
+        exact_match_filter = "(&(objectClass=posixGroup)%s)" % exact_match_filter
+        partial_match_filter = "(&(objectClass=posixGroup)%s)" % partial_match_filter
+
+        #
+        # TODO - copy/paste from find_users.  needs to be refactored
+        #
         conn = self.getConnection(opts)
         try:
-            results = conn.getList(self.basedn, self.scope, filter, sattrs)
-        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
-            results = []
+            try:
+                exact_results = conn.getListAsync(self.basedn, self.scope,
+                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                exact_results = [0]
+
+            try:
+                partial_results = conn.getListAsync(self.basedn, self.scope,
+                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                partial_results = [0]
         finally:
             self.releaseConnection(conn)
 
-        groups = []
-        for u in results:
+        exact_counter = exact_results[0]
+        partial_counter = partial_results[0]
+
+        exact_results = exact_results[1:]
+        partial_results = partial_results[1:]
+
+        # Remove exact matches from the partial_match list
+        exact_dns = set(map(lambda e: e.dn, exact_results))
+        partial_results = filter(lambda e: e.dn not in exact_dns,
+                                 partial_results)
+
+        if (exact_counter == -1) or (partial_counter == -1):
+            counter = -1
+        else:
+            counter = len(exact_results) + len(partial_results)
+
+        groups = [counter]
+        for u in exact_results + partial_results:
             groups.append(self.convert_entry(u))
-    
+
         return groups
 
     def add_user_to_group(self, user, group, opts=None):
@@ -670,7 +717,7 @@ class IPAServer:
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is already in the group
                 failed.append(user)
-            except ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND):
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
                 failed.append(user)
 
@@ -728,7 +775,7 @@ class IPAServer:
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is not in the group
                 failed.append(user)
-            except ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND):
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
                 failed.append(user)