Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff

9 files changed, 257 insertions, 130 deletions

diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index b0ea57380..bd6ce3010 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -26,6 +26,7 @@ from ipalib import Command, Method, Object
 from ipalib import Flag, List, Str
 from ipalib.base import NameSpace
 from ipalib.cli import to_cli, from_cli
+from ipalib import output
 
 
 def validate_add_attribute(ugettext, attr):
@@ -178,9 +179,12 @@ class LDAPCreate(crud.Create):
         dn = self.post_callback(ldap, dn, entry_attrs, *keys, **options)
 
         self.obj.convert_attribute_members(entry_attrs, *keys, **options)
-        return (dn, entry_attrs)
+        return dict(
+            result=entry_attrs,
+            value=keys[0],
+        )
 
-    def output_for_cli(self, textui, entry, *keys, **options):
+    def dont_output_for_cli(self, textui, entry, *keys, **options):
         textui.print_name(self.name)
         self.obj.print_entry(textui, entry, *keys, **options)
         if len(keys) > 1:
@@ -220,6 +224,7 @@ class LDAPRetrieve(LDAPQuery):
     """
     Retrieve an LDAP entry.
     """
+
     takes_options = (
         Flag('raw',
             cli_name='raw',
@@ -231,6 +236,8 @@ class LDAPRetrieve(LDAPQuery):
         ),
     )
 
+    has_output = output.standard_entry
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -248,9 +255,14 @@ class LDAPRetrieve(LDAPQuery):
         dn = self.post_callback(ldap, dn, entry_attrs, *keys, **options)
 
         self.obj.convert_attribute_members(entry_attrs, *keys, **options)
-        return (dn, entry_attrs)
+        entry_attrs['dn'] = dn
+        return dict(
+            result=entry_attrs,
+            value=keys[0],
+        )
 
-    def output_for_cli(self, textui, entry, *keys, **options):
+
+    def dont_output_for_cli(self, textui, entry, *keys, **options):
         textui.print_name(self.name)
         self.obj.print_entry(textui, entry, *keys, **options)
 
@@ -328,9 +340,12 @@ class LDAPUpdate(LDAPQuery, crud.Update):
         dn = self.post_callback(ldap, dn, entry_attrs, *keys, **options)
 
         self.obj.convert_attribute_members(entry_attrs, *keys, **options)
-        return (dn, entry_attrs)
+        return dict(
+            result=entry_attrs,
+            value=keys[0],
+        )
 
-    def output_for_cli(self, textui, entry, *keys, **options):
+    def dont_output_for_cli(self, textui, entry, *keys, **options):
         textui.print_name(self.name)
         self.obj.print_entry(textui, entry, *keys, **options)
         if len(keys) > 1:
@@ -359,6 +374,8 @@ class LDAPDelete(LDAPQuery):
     """
     Delete an LDAP entry and all of its direct subentries.
     """
+    has_output = output.standard_delete
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -384,9 +401,13 @@ class LDAPDelete(LDAPQuery):
 
         result = self.post_callback(ldap, dn, *keys, **options)
 
-        return result
+        return dict(
+            result=result,
+            value=keys[0],
+        )
+
 
-    def output_for_cli(self, textui, result, *keys, **options):
+    def dont_output_for_cli(self, textui, result, *keys, **options):
         textui.print_name(self.name)
         if len(keys) > 1:
             textui.print_dashed(
@@ -454,7 +475,7 @@ class LDAPModMember(LDAPQuery):
                         failed[attr][ldap_obj_name].append(name)
         return (dns, failed)
 
-    def output_for_cli(self, textui, result, *keys, **options):
+    def dont_output_for_cli(self, textui, result, *keys, **options):
         (completed, failed, entry) = result
 
         for (attr, objs) in failed.iteritems():
@@ -479,6 +500,19 @@ class LDAPAddMember(LDAPModMember):
     member_param_doc = 'comma-separated list of %s to add'
     member_count_out = ('%i member added.', '%i members added.')
 
+    has_output = (
+        output.Entry('result'),
+        output.Output('completed',
+            type=int,
+            doc='Number of members added',
+        ),
+        output.Output('failed',
+            type=dict,
+            doc='Members that could not be added',
+        ),
+    )
+
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -511,7 +545,11 @@ class LDAPAddMember(LDAPModMember):
         )
 
         self.obj.convert_attribute_members(entry_attrs, *keys, **options)
-        return (completed, failed, (dn, entry_attrs))
+        return dict(
+            completed=completed,
+            failed=failed,
+            result=entry_attrs,
+        )
 
     def pre_callback(self, ldap, dn, found, not_found, *keys, **options):
         return dn
@@ -527,6 +565,18 @@ class LDAPRemoveMember(LDAPModMember):
     member_param_doc = 'comma-separated list of %s to remove'
     member_count_out = ('%i member removed.', '%i members removed.')
 
+    has_output = (
+        output.Entry('result'),
+        output.Output('completed',
+            type=int,
+            doc='Number of members removed',
+        ),
+        output.Output('failed',
+            type=dict,
+            doc='Members that could not be removed',
+        ),
+    )
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -559,7 +609,11 @@ class LDAPRemoveMember(LDAPModMember):
         )
 
         self.obj.convert_attribute_members(entry_attrs, *keys, **options)
-        return (completed, failed, (dn, entry_attrs))
+        return dict(
+            completed=completed,
+            failed=failed,
+            result=entry_attrs,
+        )
 
     def pre_callback(self, ldap, dn, found, not_found, *keys, **options):
         return dn
@@ -647,9 +701,18 @@ class LDAPSearch(crud.Search):
                     entries[i][1], *args, **options
                 )
                 entries[i] = (dn, entries[i][1])
-        return (entries, truncated)
 
-    def output_for_cli(self, textui, result, *args, **options):
+        entries = tuple(e for (dn, e) in entries)
+
+        return dict(
+            result=entries,
+            count=len(entries),
+            truncated=truncated,
+        )
+
+
+
+    def dont_output_for_cli(self, textui, result, *args, **options):
         (entries, truncated) = result
 
         textui.print_name(self.name)
diff --git a/ipalib/plugins/group.py b/ipalib/plugins/group.py
index b5cc7ca5a..322f3fa8b 100644
--- a/ipalib/plugins/group.py
+++ b/ipalib/plugins/group.py
@@ -24,6 +24,7 @@ Groups of users
 from ipalib import api
 from ipalib import Int, Str
 from ipalib.plugins.baseldap import *
+from ipalib import _, ngettext
 
 
 class group(LDAPObject):
@@ -57,16 +58,18 @@ class group(LDAPObject):
     takes_params = (
         Str('cn',
             cli_name='name',
-            doc='group name',
+            label='Group name',
             primary_key=True,
             normalizer=lambda value: value.lower(),
         ),
         Str('description',
             cli_name='desc',
-            doc='group description',
+            label='Description',
+            doc='Group description',
         ),
         Int('gidnumber?',
             cli_name='gid',
+            label='GID',
             doc='GID (use this option to set it manually)',
         ),
     )
@@ -78,6 +81,9 @@ class group_add(LDAPCreate):
     """
     Create new group.
     """
+
+    msg_summary = _('Added group "%(value)s"')
+
     takes_options = LDAPCreate.takes_options + (
         Flag('posix',
              cli_name='posix',
@@ -90,6 +96,7 @@ class group_add(LDAPCreate):
             entry_attrs['objectclass'].append('posixgroup')
         return dn
 
+
 api.register(group_add)
 
 
@@ -97,6 +104,9 @@ class group_del(LDAPDelete):
     """
     Delete group.
     """
+
+    msg_summary = _('Deleted group "%(value)s"')
+
     def pre_callback(self, ldap, dn, *keys, **options):
         config = ldap.get_ipa_config()[1]
         def_primary_group = config.get('ipadefaultprimarygroup', '')
@@ -112,6 +122,9 @@ class group_mod(LDAPUpdate):
     """
     Modify group.
     """
+
+    msg_summary = _('Modified group "%(value)s"')
+
     takes_options = LDAPUpdate.takes_options + (
         Flag('posix',
              cli_name='posix',
@@ -138,6 +151,10 @@ class group_find(LDAPSearch):
     Search for groups.
     """
 
+    msg_summary = ngettext(
+        '%(count)d group matched', '%(count)d groups matched', 0
+    )
+
 api.register(group_find)
 
 
@@ -163,4 +180,3 @@ class group_remove_member(LDAPRemoveMember):
     """
 
 api.register(group_remove_member)
-
diff --git a/ipalib/plugins/hbac.py b/ipalib/plugins/hbac.py
index 4a7cc9407..6dc13f6d5 100644
--- a/ipalib/plugins/hbac.py
+++ b/ipalib/plugins/hbac.py
@@ -35,7 +35,7 @@ class hbac(LDAPObject):
     default_attributes = [
         'cn', 'accessruletype', 'ipaenabledflag', 'servicename',
         'accesstime', 'description',
-        
+
     ]
     uuid_attribute = 'ipauniqueid'
     attribute_names = {
@@ -128,7 +128,7 @@ class hbac_add(LDAPCreate):
         if not dn.startswith('cn='):
             msg = 'HBAC rule with name "%s" already exists' % keys[-1]
             raise errors.DuplicateEntry(message=msg)
-        # HBAC rules are enabled by default 
+        # HBAC rules are enabled by default
         entry_attrs['ipaenabledflag'] = 'TRUE'
         return ldap.make_dn(
             entry_attrs, self.obj.uuid_attribute, self.obj.container_dn
@@ -184,7 +184,7 @@ class hbac_enable(LDAPQuery):
         except errors.EmptyModlist:
             pass
 
-        return True
+        return dict(result=True)
 
     def output_for_cli(self, textui, result, cn):
         textui.print_name(self.name)
@@ -208,7 +208,7 @@ class hbac_disable(LDAPQuery):
         except errors.EmptyModlist:
             pass
 
-        return True
+        return dict(result=True)
 
     def output_for_cli(self, textui, result, cn):
         textui.print_name(self.name)
@@ -242,7 +242,7 @@ class hbac_add_accesstime(LDAPQuery):
         except errors.EmptyModlist:
             pass
 
-        return True
+        return dict(result=True)
 
     def output_for_cli(self, textui, result, cn, **options):
         textui.print_name(self.name)
@@ -280,7 +280,7 @@ class hbac_remove_accesstime(LDAPQuery):
         except (ValueError, errors.EmptyModlist):
             pass
 
-        return True
+        return dict(result=True)
 
     def output_for_cli(self, textui, result, cn, **options):
         textui.print_name(self.name)
@@ -351,5 +351,3 @@ class hbac_remove_sourcehost(LDAPRemoveMember):
     member_count_out = ('%i object removed.', '%i objects removed.')
 
 api.register(hbac_remove_sourcehost)
-
-
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index 8859b5873..dd19362bd 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -29,6 +29,7 @@ from ipalib import api, errors, util
 from ipalib import Str, Flag
 from ipalib.plugins.baseldap import *
 from ipalib.plugins.service import split_principal
+from ipalib import _, ngettext
 
 
 def validate_host(ugettext, fqdn):
@@ -72,32 +73,38 @@ class host(LDAPObject):
     takes_params = (
         Str('fqdn', validate_host,
             cli_name='hostname',
-            doc='Hostname',
+            label='Hostname',
             primary_key=True,
             normalizer=lambda value: value.lower(),
         ),
         Str('description?',
             cli_name='desc',
+            label='Description',
             doc='Description of the host',
         ),
         Str('localityname?',
             cli_name='locality',
+            label='Locality',
             doc='Locality of the host (Baltimore, MD)',
         ),
         Str('nshostlocation?',
             cli_name='location',
+            label='Location',
             doc='Location of the host (e.g. Lab 2)',
         ),
         Str('nshardwareplatform?',
             cli_name='platform',
+            label='Platform',
             doc='Hardware platform of the host (e.g. Lenovo T61)',
         ),
         Str('nsosversion?',
             cli_name='os',
+            label='Operating system',
             doc='Operating System and version of the host (e.g. Fedora 9)',
         ),
         Str('userpassword?',
             cli_name='password',
+            label='User password',
             doc='Password used in bulk enrollment',
         ),
     )
@@ -125,6 +132,9 @@ class host_add(LDAPCreate):
     """
     Create new host.
     """
+
+    msg_summary = _('Added host "%(value)s"')
+
     def pre_callback(self, ldap, dn, entry_attrs, *keys, **options):
         entry_attrs['cn'] = keys[-1]
         entry_attrs['serverhostname'] = keys[-1].split('.', 1)[0]
@@ -147,16 +157,21 @@ class host_del(LDAPDelete):
     """
     Delete host.
     """
+
+    msg_summary = _('Deleted host "%(value)s"')
+
     def pre_callback(self, ldap, dn, *keys, **options):
         # Remove all service records for this host
         truncated = True
         while truncated:
             try:
-                (services, truncated) = api.Command['service_find'](keys[-1])
+                ret = api.Command['service_find'](keys[-1])
+                truncated = ret['truncated']
+                services = ret['result']
             except errors.NotFound:
                 break
             else:
-                for (dn_, entry_attrs) in services:
+                for entry_attrs in services:
                     principal = entry_attrs['krbprincipalname'][0]
                     (service, hostname, realm) = split_principal(principal)
                     if hostname.lower() == keys[-1]:
@@ -170,6 +185,9 @@ class host_mod(LDAPUpdate):
     """
     Modify host.
     """
+
+    msg_summary = _('Modified host "%(value)s"')
+
     takes_options = LDAPUpdate.takes_options + (
         Str('krbprincipalname?',
             cli_name='principalname',
@@ -201,6 +219,10 @@ class host_find(LDAPSearch):
     Search for hosts.
     """
 
+    msg_summary = ngettext(
+        '%(count)d host matched', '%(count)d hosts matched'
+    )
+
 api.register(host_find)
 
 
@@ -210,4 +232,3 @@ class host_show(LDAPRetrieve):
     """
 
 api.register(host_show)
-
diff --git a/ipalib/plugins/misc.py b/ipalib/plugins/misc.py
index 8bf9d81fd..0584654f7 100644
--- a/ipalib/plugins/misc.py
+++ b/ipalib/plugins/misc.py
@@ -22,18 +22,39 @@ Misc plugins
 """
 
 import re
-from ipalib import api, LocalOrRemote
-
-
+from ipalib import api, LocalOrRemote, _, ngettext
+from ipalib.output import Output, summary
 
 # FIXME: We should not let env return anything in_server
 # when mode == 'production'.  This would allow an attacker to see the
 # configuration of the server, potentially revealing compromising
 # information.  However, it's damn handy for testing/debugging.
+
+
 class env(LocalOrRemote):
     """Show environment variables"""
 
-    takes_args = ('variables*',)
+    msg_summary = _('%(count)d variables')
+
+    takes_args = (
+        'variables*',
+    )
+
+    has_output = (
+        Output('result',
+            type=dict,
+            doc='Dictionary mapping variable name to value',
+        ),
+        Output('total',
+            type=int,
+            doc='Total number of variables env (>= count)',
+        ),
+        Output('count',
+            type=int,
+            doc='Number of variables returned (<= total)',
+        ),
+        summary,
+    )
 
     def __find_keys(self, variables):
         keys = set()
@@ -52,20 +73,18 @@ class env(LocalOrRemote):
             keys = self.env
         else:
             keys = self.__find_keys(variables)
-        return dict(
-            (key, self.env[key]) for key in keys
+        ret = dict(
+            result=dict(
+                (key, self.env[key]) for key in keys
+            ),
+            count=len(keys),
+            total=len(self.env),
         )
-
-    def output_for_cli(self, textui, result, variables, **options):
-        if len(result) == 0:
-            return
-        result = tuple((k, result[k]) for k in sorted(result))
-        if len(result) == 1:
-            textui.print_keyval(result)
-            return
-        textui.print_name(self.name)
-        textui.print_keyval(result)
-        textui.print_count(result, '%d variables')
+        if len(keys) > 1:
+            ret['summary'] = self.msg_summary % ret
+        else:
+            ret['summary'] = None
+        return ret
 
 api.register(env)
 
@@ -73,18 +92,26 @@ api.register(env)
 class plugins(LocalOrRemote):
     """Show all loaded plugins"""
 
+    msg_summary = ngettext(
+        '%(count)d plugin loaded', '%(count)d plugins loaded'
+    )
+
+    has_output = (
+        Output('result', dict, 'Dictionary mapping plugin names to bases'),
+        Output('count',
+            type=int,
+            doc='Number of plugins loaded',
+        ),
+        summary,
+    )
+
     def execute(self, **options):
         plugins = sorted(self.api.plugins, key=lambda o: o.plugin)
-        return tuple(
-            (p.plugin, p.bases) for p in plugins
+        return dict(
+            result=dict(
+                (p.plugin, p.bases) for p in plugins
+            ),
+            count=len(plugins),
         )
 
-    def output_for_cli(self, textui, result, **options):
-        textui.print_name(self.name)
-        for (plugin, bases) in result:
-            textui.print_indented(
-                '%s: %s' % (plugin, ', '.join(bases))
-            )
-        textui.print_count(result, '%d plugin loaded', '%s plugins loaded')
-
 api.register(plugins)
diff --git a/ipalib/plugins/passwd.py b/ipalib/plugins/passwd.py
index fbc12263c..6c509c2c7 100644
--- a/ipalib/plugins/passwd.py
+++ b/ipalib/plugins/passwd.py
@@ -67,7 +67,7 @@ class passwd(Command):
 
         ldap.modify_password(dn, password)
 
-        return True
+        return dict(result=True)
 
     def output_for_cli(self, textui, result, principal, password):
         assert password is None
@@ -75,4 +75,3 @@ class passwd(Command):
         textui.print_dashed('Changed password for "%s."' % principal)
 
 api.register(passwd)
-
diff --git a/ipalib/plugins/pwpolicy.py b/ipalib/plugins/pwpolicy.py
index 5a07c880a..faf036418 100644
--- a/ipalib/plugins/pwpolicy.py
+++ b/ipalib/plugins/pwpolicy.py
@@ -25,6 +25,7 @@ Password policy
 from ipalib import api, crud, errors
 from ipalib import Command, Object
 from ipalib import Int, Str
+from ipalib import output
 from ldap.functions import explode_dn
 
 _fields = {
@@ -54,6 +55,7 @@ def _convert_time_on_input(entry_attrs):
     if 'krbminpwdlife' in entry_attrs:
         entry_attrs['krbminpwdlife'] = entry_attrs['krbminpwdlife'] * 3600
 
+
 def make_cos_entry(group, cospriority=None):
     """
     Make the CoS dn and entry for this group.
@@ -64,9 +66,10 @@ def make_cos_entry(group, cospriority=None):
     """
 
     try:
-        (groupdn, group_attrs) = api.Command['group_show'](group)
+        entry = api.Command['group_show'](group)['result']
     except errors.NotFound:
         raise errors.NotFound(reason="group '%s' does not exist" % group)
+    groupdn = entry['dn']
 
     cos_entry = {}
     if cospriority:
@@ -76,6 +79,7 @@ def make_cos_entry(group, cospriority=None):
 
     return (cos_dn, cos_entry)
 
+
 def make_policy_entry(group_cn, policy_entry):
     """
     Make the krbpwdpolicy dn and entry for this group.
@@ -98,6 +102,7 @@ def make_policy_entry(group_cn, policy_entry):
 
     return (policy_dn, policy_entry)
 
+
 class pwpolicy(Object):
     """
     Password Policy object.
@@ -138,6 +143,7 @@ class pwpolicy(Object):
 
 api.register(pwpolicy)
 
+
 class pwpolicy_add(crud.Create):
     """
     Create a new password policy associated with a group.
@@ -150,6 +156,7 @@ class pwpolicy_add(crud.Create):
         ),
         Int('cospriority',
             cli_name='priority',
+            label='Priority',
             doc='Priority of the policy. Higher number equals higher priority',
             minvalue=0,
             attribute=True,
@@ -182,22 +189,12 @@ class pwpolicy_add(crud.Create):
 
         _convert_time_for_output(entry_attrs)
 
-        return (dn, entry_attrs)
-
-    def output_for_cli(self, textui, result, *args, **options):
-#        textui.print_name(self.name)
-#        textui.print_dashed("Added policy for '%s'." % options['group'])
-        (dn, entry_attrs) = result
-
-        textui.print_name(self.name)
-        textui.print_plain('Password policy:')
-        for (k, v) in _fields.iteritems():
-            if k in entry_attrs:
-                textui.print_attribute(v, entry_attrs[k])
-        textui.print_dashed('Modified password policy.')
+        entry_attrs['dn'] = dn
+        return dict(result=entry_attrs, value=group_cn)
 
 api.register(pwpolicy_add)
 
+
 class pwpolicy_mod(crud.Update):
     """
     Modify password policy.
@@ -215,6 +212,10 @@ class pwpolicy_mod(crud.Update):
         ),
     )
 
+    has_output = (
+        output.Entry('result'),
+    )
+
     def execute(self, *args, **options):
         assert 'dn' not in options
         ldap = self.api.Backend.ldap2
@@ -235,24 +236,16 @@ class pwpolicy_mod(crud.Update):
 
         _convert_time_for_output(entry_attrs)
 
-        return (dn, entry_attrs)
-
-    def output_for_cli(self, textui, result, *args, **options):
-        (dn, entry_attrs) = result
-
-        textui.print_name(self.name)
-        textui.print_plain('Password policy:')
-        for (k, v) in _fields.iteritems():
-            if k in entry_attrs:
-                textui.print_attribute(v, entry_attrs[k])
-        textui.print_dashed('Modified password policy.')
+        return dict(result=entry_attrs)
 
 api.register(pwpolicy_mod)
 
+
 class pwpolicy_del(crud.Delete):
     """
     Delete a group password policy.
     """
+
     takes_options = (
         Str('group',
             doc='Group to remove policy from',
@@ -278,12 +271,10 @@ class pwpolicy_del(crud.Delete):
 
         ldap.delete_entry(policy_dn, normalize=False)
         ldap.delete_entry(cos_dn, normalize=False)
-
-        return True
-
-    def output_for_cli(self, textui, result, *args, **options):
-        textui.print_name(self.name)
-        textui.print_dashed('Deleted policy "%s".' % options['group'])
+        return dict(
+            result=True,
+            value=group_cn,
+        )
 
 api.register(pwpolicy_del)
 
@@ -292,6 +283,7 @@ class pwpolicy_show(Command):
     """
     Display password policy.
     """
+
     takes_options = (
         Str('group?',
             doc='Group to display policy',
@@ -300,6 +292,7 @@ class pwpolicy_show(Command):
             doc='Display policy applied to a given user',
         ),
     )
+
     def execute(self, *args, **options):
         ldap = self.api.Backend.ldap2
 
@@ -333,16 +326,6 @@ class pwpolicy_show(Command):
                 entry_attrs['group'] = 'global'
         _convert_time_for_output(entry_attrs)
 
-        return (dn, entry_attrs)
-
-    def output_for_cli(self, textui, result, *args, **options):
-        (dn, entry_attrs) = result
-
-        textui.print_name(self.name)
-        textui.print_plain('Password policy:')
-        for (k, v) in _fields.iteritems():
-            if k in entry_attrs:
-                textui.print_attribute(v, entry_attrs[k])
+        return dict(result=entry_attrs)
 
 api.register(pwpolicy_show)
-
diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py
index 5b0119151..f65ab3ebd 100644
--- a/ipalib/plugins/service.py
+++ b/ipalib/plugins/service.py
@@ -149,7 +149,7 @@ class service_add(LDAPCreate):
             raise errors.HostService()
 
         try:
-            (hostdn, hostentry) = api.Command['host_show'](hostname, **{})
+            api.Command['host_show'](hostname)
         except errors.NotFound:
             raise errors.NotFound(reason="The host '%s' does not exist to add a service to." % hostname)
 
@@ -267,4 +267,3 @@ class service_remove_host(LDAPRemoveMember):
     member_attributes = ['managedby']
 
 api.register(service_remove_host)
-
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index 643531305..44b0f7d5e 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -24,6 +24,7 @@ Users (Identity)
 from ipalib import api, errors
 from ipalib import Flag, Int, Password, Str
 from ipalib.plugins.baseldap import *
+from ipalib import _, ngettext
 
 
 class user(LDAPObject):
@@ -68,57 +69,59 @@ class user(LDAPObject):
     }
 
     takes_params = (
+        Str('uid',
+            cli_name='login',
+            label='User login',
+            primary_key=True,
+            default_from=lambda givenname, sn: givenname[0] + sn,
+            normalizer=lambda value: value.lower(),
+        ),
         Str('givenname',
             cli_name='first',
-            doc='First name',
+            label='First name',
         ),
         Str('sn',
             cli_name='last',
-            doc='Last name',
+            label='Last name',
         ),
-        Str('uid',
-            cli_name='user',
-            doc='Login name',
-            primary_key=True,
-            default_from=lambda givenname, sn: givenname[0] + sn,
-            normalizer=lambda value: value.lower(),
+        Str('homedirectory?',
+            cli_name='homedir',
+            label='Home directory',
+            default_from=lambda uid: '/home/%s' % uid,
         ),
         Str('gecos?',
-            doc='GECOS field',
+            label='GECOS field',
             default_from=lambda uid: uid,
             autofill=True,
         ),
-        Str('homedirectory?',
-            cli_name='homedir',
-            doc='Home directory',
-            default_from=lambda uid: '/home/%s' % uid,
-        ),
         Str('loginshell?',
             cli_name='shell',
+            label='Login shell',
             default=u'/bin/sh',
-            doc='login shell',
         ),
         Str('krbprincipalname?',
             cli_name='principal',
-            doc='Kerberos principal name',
+            label='Kerberos principal',
             default_from=lambda uid: '%s@%s' % (uid, api.env.realm),
             autofill=True,
         ),
         Str('mail?',
             cli_name='email',
-            doc='e-mail address',
+            label='Email address',
         ),
         Password('userpassword?',
             cli_name='password',
-            doc='password',
+            label='Password',
+            doc='Set the user password',
         ),
         Int('uidnumber?',
             cli_name='uid',
+            label='UID',
             doc='UID (use this option to set it manually)',
         ),
         Str('street?',
             cli_name='street',
-            doc='street address',
+            label='Street address',
         ),
     )
 
@@ -129,6 +132,9 @@ class user_add(LDAPCreate):
     """
     Create new user.
     """
+
+    msg_summary = _('Added user "%(value)s"')
+
     def pre_callback(self, ldap, dn, entry_attrs, *keys, **options):
         config = ldap.get_ipa_config()[1]
         entry_attrs.setdefault('loginshell', config.get('ipadefaultloginshell'))
@@ -171,6 +177,9 @@ class user_del(LDAPDelete):
     """
     Delete user.
     """
+
+    msg_summary = _('Deleted user "%(value)s"')
+
     def pre_callback(self, ldap, dn, *keys, **options):
         if keys[-1] == 'admin':
             raise errors.ExecutionError('Cannot delete user "admin".')
@@ -188,6 +197,8 @@ class user_mod(LDAPUpdate):
     Modify user.
     """
 
+    msg_summary = _('Modified user "%(value)s"')
+
 api.register(user_mod)
 
 
@@ -196,6 +207,10 @@ class user_find(LDAPSearch):
     Search for users.
     """
 
+    msg_summary = ngettext(
+        '%(count)d user matched', '%(count)d users matched', 0
+    )
+
 api.register(user_find)
 
 
@@ -211,6 +226,10 @@ class user_lock(LDAPQuery):
     """
     Lock user account.
     """
+
+    has_output = output.standard_value
+    msg_summary = _('Locked user "%(value)s"')
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -221,11 +240,10 @@ class user_lock(LDAPQuery):
         except errors.AlreadyInactive:
             pass
 
-        return True
-
-    def output_for_cli(self, textui, result, *keys, **options):
-        textui.print_name(self.name)
-        textui.print_dashed('Locked user "%s".' % keys[-1])
+        return dict(
+            result=True,
+            value=keys[0],
+        )
 
 api.register(user_lock)
 
@@ -234,6 +252,10 @@ class user_unlock(LDAPQuery):
     """
     Unlock user account.
     """
+
+    has_output = output.standard_value
+    msg_summary = _('Unlocked user "%(value)s"')
+
     def execute(self, *keys, **options):
         ldap = self.obj.backend
 
@@ -244,10 +266,9 @@ class user_unlock(LDAPQuery):
         except errors.AlreadyActive:
             pass
 
-        return True
-
-    def output_for_cli(self, textui, result, *keys, **options):
-        textui.print_name(self.name)
-        textui.print_dashed('Unlocked user "%s".' % keys[-1])
+        return dict(
+            result=True,
+            value=keys[0],
+        )
 
 api.register(user_unlock)