ticket 1600 - convert unittests to use DN objects

We have a larger goal of replacing all DN creation via string
formatting/concatenation with DN object operations because string
operations are not a safe way to form a DN nor to compare a DN. This
work needs to be broken into smaller chunks for easier review and
testing.

Addressing the unit tests first makes sense because we don't want to
be modifying both the core code and the tests used to verify the core
code simultaneously. If we modify the unittests first with existing
core code and no regressions are found then we can move on to
modifying parts of the core code with the belief the unittests can
validate the changes in the core code. Also by doing the unittests
first we also help to validate the DN objects are working correctly
(although they do have an extensive unittest).

The fundamental changes are:

* replace string substitution & concatenation with DN object
  constructor

* when comparing dn's the comparision is done after promotion
  to a DN object, then two DN objects are compared

* when a list of string dn's are to be compared a new list is
  formed where each string dn is replaced by a DN object

* because the unittest framework accepts a complex data structure of
  expected values where dn's are represeted as strings the unittest
  needs to express the expected value of a dn as a callable object
  (e.g. a lambda expression) which promotes the dn string to a DN
  object in order to do the comparision.

21 files changed, 577 insertions, 326 deletions

diff --git a/tests/test_cmdline/test_ipagetkeytab.py b/tests/test_cmdline/test_ipagetkeytab.py
index ee22f00ca..0437c80bb 100644
--- a/tests/test_cmdline/test_ipagetkeytab.py
+++ b/tests/test_cmdline/test_ipagetkeytab.py
@@ -31,6 +31,7 @@ import nose
 import tempfile
 import krbV
 from ipaserver.plugins.ldap2 import ldap2
+from ipalib.dn import *
 
 def use_keytab(principal, keytab):
     try:
@@ -61,7 +62,6 @@ class test_ipagetkeytab(cmdline_test):
     command = "ipa-client/ipa-getkeytab"
     host_fqdn = u'ipatest.%s' % api.env.domain
     service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
-    subject = 'CN=%s,O=IPA' % host_fqdn
     [keytabfd, keytabname] = tempfile.mkstemp()
     os.close(keytabfd)
 
diff --git a/tests/test_ipalib/test_x509.py b/tests/test_ipalib/test_x509.py
index 11c5495f0..a2e9b2265 100644
--- a/tests/test_ipalib/test_x509.py
+++ b/tests/test_ipalib/test_x509.py
@@ -32,7 +32,7 @@ from ipalib.constants import NAME_REGEX, NAME_ERROR
 import base64
 from ipalib import x509
 from nss.error import NSPRError
-
+from ipalib.dn import *
 
 # certutil -
 
@@ -92,18 +92,18 @@ class test_x509(object):
         Test retrieving the subject
         """
         subject = x509.get_subject(goodcert)
-        assert str(subject) == 'CN=ipa.example.com,O=IPA'
+        assert DN(str(subject)) == DN(('CN','ipa.example.com'),('O','IPA'))
 
         der = base64.b64decode(goodcert)
         subject = x509.get_subject(der, x509.DER)
-        assert str(subject) == 'CN=ipa.example.com,O=IPA'
+        assert DN(str(subject)) == DN(('CN','ipa.example.com'),('O','IPA'))
 
         # We should be able to pass in a tuple/list of certs too
         subject = x509.get_subject((goodcert))
-        assert str(subject) == 'CN=ipa.example.com,O=IPA'
+        assert DN(str(subject)) == DN(('CN','ipa.example.com'),('O','IPA'))
 
         subject = x509.get_subject([goodcert])
-        assert str(subject) == 'CN=ipa.example.com,O=IPA'
+        assert DN(str(subject)) == DN(('CN','ipa.example.com'),('O','IPA'))
 
     def test_2_get_serial_number(self):
         """
@@ -132,8 +132,8 @@ class test_x509(object):
 
         cert = x509.load_certificate(goodcert)
 
-        assert str(cert.subject) == 'CN=ipa.example.com,O=IPA'
-        assert str(cert.issuer) == 'CN=IPA Test Certificate Authority'
+        assert DN(str(cert.subject)) == DN(('CN','ipa.example.com'),('O','IPA'))
+        assert DN(str(cert.issuer)) == DN(('CN','IPA Test Certificate Authority'))
         assert cert.serial_number == 1093
         assert cert.valid_not_before_str == 'Fri Jun 25 13:00:42 2010 UTC'
         assert cert.valid_not_after_str == 'Thu Jun 25 13:00:42 2015 UTC'
diff --git a/tests/test_ipaserver/test_ldap.py b/tests/test_ipaserver/test_ldap.py
index 299d439f5..568a37acd 100644
--- a/tests/test_ipaserver/test_ldap.py
+++ b/tests/test_ipaserver/test_ldap.py
@@ -33,6 +33,7 @@ from ipalib.plugins.host import host
 import nss.nss as nss
 from ipalib import api, x509, create_api
 from ipapython import ipautil
+from ipalib.dn import *
 
 class test_ldap(object):
     """
@@ -44,7 +45,8 @@ class test_ldap(object):
         self.ldapuri = 'ldap://%s' % api.env.host
         self.ccache = '/tmp/krb5cc_%d' % os.getuid()
         nss.nss_init_nodb()
-        self.dn = 'krbprincipalname=ldap/%s@%s,cn=services,cn=accounts,%s' % (api.env.host, api.env.realm, api.env.basedn)
+        self.dn = str(DN(('krbprincipalname','ldap/%s@%s' % (api.env.host, api.env.realm)),
+                         ('cn','services'),('cn','accounts'),api.env.basedn))
 
     def tearDown(self):
         if self.conn:
diff --git a/tests/test_xmlrpc/test_attr.py b/tests/test_xmlrpc/test_attr.py
index 1ea6a880f..3f78a678d 100644
--- a/tests/test_xmlrpc/test_attr.py
+++ b/tests/test_xmlrpc/test_attr.py
@@ -24,12 +24,10 @@ Test --setattr and --addattr and other attribute-specific issues
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
-
-user_memberof = (u'cn=ipausers,cn=groups,cn=accounts,%s' % api.env.basedn,)
 user1=u'tuser1'
 
-
 class test_attr(Declarative):
 
     cleanup_commands = [
@@ -61,10 +59,16 @@ class test_attr(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_cert.py b/tests/test_xmlrpc/test_cert.py
index c6d364a11..20aba1652 100644
--- a/tests/test_xmlrpc/test_cert.py
+++ b/tests/test_xmlrpc/test_cert.py
@@ -30,6 +30,7 @@ import tempfile
 from ipapython import ipautil
 import nose
 import base64
+from ipalib.dn import *
 
 # So we can save the cert from issuance and compare it later
 cert = None
@@ -92,7 +93,7 @@ class test_cert(XMLRPC_test):
     """
     host_fqdn = u'ipatestcert.%s' % api.env.domain
     service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
-    subject = 'CN=%s,O=%s' % (host_fqdn, api.env.realm)
+    subject = DN(('CN',host_fqdn),('O',api.env.realm))
 
     def test_1_cert_add(self):
         """
@@ -103,7 +104,7 @@ class test_cert(XMLRPC_test):
         # First create the host that will use this policy
         res = api.Command['host_add'](self.host_fqdn, force= True)['result']
 
-        csr = unicode(self.generateCSR(self.subject))
+        csr = unicode(self.generateCSR(str(self.subject)))
         try:
             res = api.Command['cert_request'](csr, principal=self.service_princ)
             assert False
@@ -117,9 +118,9 @@ class test_cert(XMLRPC_test):
         # Our host should exist from previous test
         global cert
 
-        csr = unicode(self.generateCSR(self.subject))
+        csr = unicode(self.generateCSR(str(self.subject)))
         res = api.Command['cert_request'](csr, principal=self.service_princ, add=True)['result']
-        assert res['subject'] == self.subject
+        assert DN(res['subject']) == self.subject
         # save the cert for the service_show/find tests
         cert = res['certificate']
 
@@ -148,9 +149,9 @@ class test_cert(XMLRPC_test):
         """
         global newcert
 
-        csr = unicode(self.generateCSR(self.subject))
+        csr = unicode(self.generateCSR(str(self.subject)))
         res = api.Command['cert_request'](csr, principal=self.service_princ)['result']
-        assert res['subject'] == self.subject
+        assert DN(res['subject']) == self.subject
         # save the cert for the service_show/find tests
         newcert = res['certificate']
 
diff --git a/tests/test_xmlrpc/test_dns_plugin.py b/tests/test_xmlrpc/test_dns_plugin.py
index efff3866f..f9bce61d9 100644
--- a/tests/test_xmlrpc/test_dns_plugin.py
+++ b/tests/test_xmlrpc/test_dns_plugin.py
@@ -22,6 +22,7 @@ Test the `ipalib/plugins/dns.py` module.
 
 import nose
 from ipalib import api, errors
+from ipalib.dn import *
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
 
@@ -89,7 +90,8 @@ class test_dns(Declarative):
                 'value': dnszone1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'idnssoamname': [u'ns1.%s.' % dnszone1],
@@ -143,7 +145,8 @@ class test_dns(Declarative):
                 'value': dnszone2,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone2, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone2),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone2],
                     'idnszoneactive': [u'TRUE'],
                     'idnssoamname': [u'ns1.%s.' % dnszone2],
@@ -177,7 +180,8 @@ class test_dns(Declarative):
                 'value': dnszone1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -229,7 +233,8 @@ class test_dns(Declarative):
                 'value': revdnszone1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (revdnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',revdnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [revdnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'idnssoamname': [u'ns1.%s.' % dnszone1],
@@ -255,7 +260,8 @@ class test_dns(Declarative):
                 'count': 2,
                 'truncated': False,
                 'result': [{
-                    'dn': u'idnsname=%s,cn=dns,%s' % (revdnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',revdnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [revdnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -268,7 +274,8 @@ class test_dns(Declarative):
                     'idnssoaminimum': [fuzzy_digits],
                 },
                 {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -292,7 +299,8 @@ class test_dns(Declarative):
                 'count': 1,
                 'truncated': False,
                 'result': [{
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -337,7 +345,8 @@ class test_dns(Declarative):
                 'value': dnszone1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'FALSE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -371,7 +380,8 @@ class test_dns(Declarative):
                 'value': dnszone1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnszone1),('cn','dns'),api.env.basedn),
                     'idnsname': [dnszone1],
                     'idnszoneactive': [u'TRUE'],
                     'nsrecord': [u'ns1.%s.' % dnszone1],
@@ -408,7 +418,9 @@ class test_dns(Declarative):
                 'value': dnsres1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,idnsname=%s,cn=dns,%s' % (dnsres1, dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnsres1),('idnsname',dnszone1),
+                           ('cn','dns'),api.env.basedn),
                     'idnsname': [dnsres1],
                     'objectclass': [u'top', u'idnsrecord'],
                     'arecord': [u'127.0.0.1'],
@@ -426,17 +438,23 @@ class test_dns(Declarative):
                 'truncated': False,
                 'result': [
                     {
-                        'dn': u'idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('idnsname',dnszone1),('cn','dns'),
+                               api.env.basedn),
                         'nsrecord': (u'ns1.dnszone.test.',),
                         'idnsname': [u'@'],
                     },
                     {
-                        'dn': u'idnsname=ns1,idnsname=%s,cn=dns,%s' % (dnszone1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('idnsname','ns1'),('idnsname',dnszone1),
+                               ('cn','dns'),api.env.basedn),
                         'idnsname': [u'ns1'],
                         'arecord': [u'1.2.3.4'],
                     },
                     {
-                        'dn': u'idnsname=%s,idnsname=%s,cn=dns,%s' % (dnsres1, dnszone1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('idnsname',dnsres1),('idnsname',dnszone1),
+                               ('cn','dns'),api.env.basedn),
                         'idnsname': [dnsres1],
                         'arecord': [u'127.0.0.1'],
                     },
@@ -452,7 +470,9 @@ class test_dns(Declarative):
                 'value': dnsres1,
                 'summary': None,
                 'result': {
-                    'dn': u'idnsname=%s,idnsname=%s,cn=dns,%s' % (dnsres1, dnszone1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('idnsname',dnsres1),('idnsname',dnszone1),
+                           ('cn','dns'),api.env.basedn),
                     'idnsname': [dnsres1],
                     'arecord': [u'127.0.0.1', u'10.10.0.1'],
                     'objectclass': [u'top', u'idnsrecord'],
diff --git a/tests/test_xmlrpc/test_group_plugin.py b/tests/test_xmlrpc/test_group_plugin.py
index d4f6cd480..096bab2de 100644
--- a/tests/test_xmlrpc/test_group_plugin.py
+++ b/tests/test_xmlrpc/test_group_plugin.py
@@ -24,6 +24,7 @@ Test the `ipalib/plugins/group.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 group1 = u'testgroup1'
 group2 = u'testgroup2'
@@ -85,7 +86,9 @@ class test_group(Declarative):
                     description=[u'Test desc 1'],
                     objectclass=objectclasses.group,
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -109,7 +112,9 @@ class test_group(Declarative):
                 result=dict(
                     cn=[group1],
                     description=[u'Test desc 1'],
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -139,7 +144,9 @@ class test_group(Declarative):
                 result=dict(
                     cn=[group1],
                     description=[u'New desc 1'],
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
                 summary=None,
             ),
@@ -172,7 +179,9 @@ class test_group(Declarative):
                 result=dict(
                     cn=[group1],
                     description=(u'New desc 1',),
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                     gidnumber=[fuzzy_digits],
                 ),
                 summary=None,
@@ -188,7 +197,9 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         cn=[group1],
                         description=[u'New desc 1'],
                         gidnumber=[fuzzy_digits],
@@ -237,7 +248,9 @@ class test_group(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testgroup2,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup2'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -262,7 +275,9 @@ class test_group(Declarative):
                     cn=[group2],
                     description=[u'Test desc 2'],
                     gidnumber=[fuzzy_digits],
-                    dn=u'cn=testgroup2,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup2'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -294,7 +309,9 @@ class test_group(Declarative):
                     cn=[group2],
                     description=[u'New desc 2'],
                     gidnumber=[fuzzy_digits],
-                    dn=u'cn=testgroup2,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup2'),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
                 summary=None,
             ),
@@ -309,7 +326,9 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',group2),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         cn=[group2],
                         description=[u'New desc 2'],
                         gidnumber=[fuzzy_digits],
@@ -329,32 +348,42 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     {
-                        'dn': u'cn=admins,cn=groups,cn=accounts,%s' % api.env.basedn,
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn','admins'),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [u'admin'],
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'admins'],
                         'description': [u'Account administrators group'],
                     },
                     {
-                        'dn': u'cn=editors,cn=groups,cn=accounts,%s' % api.env.basedn,
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn','editors'),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'editors'],
                         'description': [u'Limited admins who can edit other users'],
                     },
                     {
-                        'dn': u'cn=ipausers,cn=groups,cn=accounts,%s' % api.env.basedn,
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn','ipausers'),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'gidnumber': [fuzzy_digits],
                         'cn': [u'ipausers'],
                         'description': [u'Default group for all users'],
                     },
                     dict(
-                        dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         cn=[group1],
                         description=[u'New desc 1'],
                         gidnumber=[fuzzy_digits],
                     ),
                     dict(
-                        dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',group2),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         cn=[group2],
                         description=[u'New desc 2'],
                         gidnumber=[fuzzy_digits],
@@ -381,7 +410,9 @@ class test_group(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_group': (group2,),
                         'gidnumber': [fuzzy_digits],
                         'cn': [group1],
@@ -405,7 +436,9 @@ class test_group(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_group': (group2,),
                         'gidnumber': [fuzzy_digits],
                         'cn': [group1],
@@ -428,7 +461,9 @@ class test_group(Declarative):
                     ),
                 ),
                 result={
-                    'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                     'cn': [group1],
                     'gidnumber': [fuzzy_digits],
                     'description': [u'New desc 1'],
@@ -451,7 +486,9 @@ class test_group(Declarative):
                     ),
                 ),
                 result={
-                    'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                     'cn': [group1],
                     'gidnumber': [fuzzy_digits],
                     'description': [u'New desc 1'],
@@ -590,10 +627,16 @@ class test_group(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user1, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user1),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -609,7 +652,9 @@ class test_group(Declarative):
                     cn=[user1],
                     description=[u'User private group for %s' % user1],
                     gidnumber=[fuzzy_digits],
-                    dn=u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -623,7 +668,9 @@ class test_group(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         cn=[user1],
                         description=[u'User private group for %s' % user1],
                         gidnumber=[fuzzy_digits],
@@ -703,7 +750,9 @@ class test_group(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_hbacsvcgroup_plugin.py b/tests/test_xmlrpc/test_hbacsvcgroup_plugin.py
index d2fa7cc8b..ba30854a7 100644
--- a/tests/test_xmlrpc/test_hbacsvcgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hbacsvcgroup_plugin.py
@@ -24,12 +24,15 @@ Test the `ipalib.plugins.hbacsvcgroup` module.
 from ipalib import api, errors
 from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
 from tests.test_xmlrpc import objectclasses
+from ipalib.dn import *
 
 hbacsvcgroup1 = u'testhbacsvcgroup1'
-dn1 = u'cn=%s,cn=hbacservicegroups,cn=hbac,%s' % (hbacsvcgroup1, api.env.basedn)
+dn1 = DN(('cn',hbacsvcgroup1),('cn','hbacservicegroups'),('cn','hbac'),
+         api.env.basedn)
 
 hbacsvc1 = u'sshd'
-hbacsvc_dn1 = u'cn=%s,cn=hbacservices,cn=hbac,%s' % (hbacsvc1, api.env.basedn)
+hbacsvc_dn1 = DN(('cn',hbacsvc1),('cn','hbacservices'),('cn','hbac'),
+                 api.env.basedn)
 
 
 class test_hbacsvcgroup(Declarative):
@@ -73,7 +76,7 @@ class test_hbacsvcgroup(Declarative):
                 value=hbacsvcgroup1,
                 summary=u'Added HBAC service group "testhbacsvcgroup1"',
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     cn=[hbacsvcgroup1],
                     objectclass=objectclasses.hbacsvcgroup,
                     description=[u'Test hbacsvcgroup 1'],
@@ -103,7 +106,7 @@ class test_hbacsvcgroup(Declarative):
                 value=hbacsvc1,
                 summary=u'Added HBAC service "%s"' % hbacsvc1,
                 result=dict(
-                    dn=hbacsvc_dn1,
+                    dn=lambda x: DN(x) == hbacsvc_dn1,
                     cn=[hbacsvc1],
                     description=[u'Test service 1'],
                     objectclass=objectclasses.hbacsvc,
@@ -126,7 +129,7 @@ class test_hbacsvcgroup(Declarative):
                     ),
                 ),
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'cn': [hbacsvcgroup1],
                     'description': [u'Test hbacsvcgroup 1'],
                     'member_hbacsvc': [hbacsvc1],
@@ -142,7 +145,7 @@ class test_hbacsvcgroup(Declarative):
                 value=hbacsvcgroup1,
                 summary=None,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'member_hbacsvc': [hbacsvc1],
                     'cn': [hbacsvcgroup1],
                     'description': [u'Test hbacsvcgroup 1'],
@@ -160,7 +163,7 @@ class test_hbacsvcgroup(Declarative):
                 summary=u'1 HBAC service group matched',
                 result=[
                     {
-                        'dn': dn1,
+                        'dn': lambda x: DN(x) == dn1,
                         'member_hbacsvc': [hbacsvc1],
                         'cn': [hbacsvcgroup1],
                         'description': [u'Test hbacsvcgroup 1'],
@@ -194,7 +197,7 @@ class test_hbacsvcgroup(Declarative):
                 value=hbacsvcgroup1,
                 summary=None,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'member_hbacsvc': [hbacsvc1],
                     'cn': [hbacsvcgroup1],
                     'description': [u'Updated hbacsvcgroup 1'],
@@ -216,7 +219,7 @@ class test_hbacsvcgroup(Declarative):
                 ),
                 completed=1,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'cn': [hbacsvcgroup1],
                     'description': [u'Updated hbacsvcgroup 1'],
                 },
diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py
index 426b0d7ca..87eb93768 100644
--- a/tests/test_xmlrpc/test_host_plugin.py
+++ b/tests/test_xmlrpc/test_host_plugin.py
@@ -23,6 +23,7 @@ Test the `ipalib.plugins.host` module.
 """
 
 from ipalib import api, errors, x509
+from ipalib.dn import *
 from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid, fuzzy_digits
 from tests.test_xmlrpc.xmlrpc_test import fuzzy_hash, fuzzy_date, fuzzy_issuer
 from tests.test_xmlrpc import objectclasses
@@ -31,16 +32,21 @@ import base64
 
 fqdn1 = u'testhost1.%s' % api.env.domain
 short1 = u'testhost1'
-dn1 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn1, api.env.basedn)
+dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
 service1 = u'dns/%s@%s' % (fqdn1, api.env.realm)
-service1dn = u'krbprincipalname=%s,cn=services,cn=accounts,%s' % (service1.lower(), api.env.basedn)
+service1dn = DN(('krbprincipalname',service1.lower()),('cn','services'),
+                ('cn','accounts'),api.env.basedn)
 fqdn2 = u'shouldnotexist.%s' % api.env.domain
-dn2 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn2, api.env.basedn)
+dn2 = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
 fqdn3 = u'testhost2.%s' % api.env.domain
 short3 = u'testhost2'
-dn3 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn3, api.env.basedn)
+dn3 = DN(('fqdn',fqdn3),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
 fqdn4 = u'testhost2.lab.%s' % api.env.domain
-dn4 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn4, api.env.basedn)
+dn4 = DN(('fqdn',fqdn4),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
 
 # We can use the same cert we generated for the service tests
 fd = open('tests/test_xmlrpc/service.crt', 'r')
@@ -95,7 +101,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -128,7 +134,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=None,
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -147,7 +153,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=None,
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     cn=[fqdn1],
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
@@ -177,7 +183,7 @@ class test_host(Declarative):
                 summary=u'1 host matched',
                 result=[
                     dict(
-                        dn=dn1,
+                        dn=lambda x: DN(x) == dn1,
                         fqdn=[fqdn1],
                         description=[u'Test host 1'],
                         l=[u'Undisclosed location 1'],
@@ -198,7 +204,7 @@ class test_host(Declarative):
                 summary=u'1 host matched',
                 result=[
                     dict(
-                        dn=dn1,
+                        dn=lambda x: DN(x) == dn1,
                         cn=[fqdn1],
                         fqdn=[fqdn1],
                         description=[u'Test host 1'],
@@ -235,7 +241,8 @@ class test_host(Declarative):
                     usercertificate=[base64.b64decode(servercert)],
                     valid_not_before=fuzzy_date,
                     valid_not_after=fuzzy_date,
-                    subject=u'CN=%s,O=%s' % (api.env.host, api.env.realm),
+                    subject=lambda x: DN(x) == \
+                        DN(('CN',api.env.host),('O',api.env.realm)),
                     serial_number=fuzzy_digits,
                     md5_fingerprint=fuzzy_hash,
                     sha1_fingerprint=fuzzy_hash,
@@ -252,7 +259,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=None,
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     fqdn=[fqdn1],
                     description=[u'Updated host 1'],
                     l=[u'Undisclosed location 1'],
@@ -262,7 +269,8 @@ class test_host(Declarative):
                     usercertificate=[base64.b64decode(servercert)],
                     valid_not_before=fuzzy_date,
                     valid_not_after=fuzzy_date,
-                    subject=u'CN=%s,O=%s' % (api.env.host, api.env.realm),
+                    subject=lambda x: DN(x) == \
+                        DN(('CN',api.env.host),('O',api.env.realm)),
                     serial_number=fuzzy_digits,
                     md5_fingerprint=fuzzy_hash,
                     sha1_fingerprint=fuzzy_hash,
@@ -284,7 +292,7 @@ class test_host(Declarative):
                 value=fqdn3,
                 summary=u'Added host "%s"' % fqdn3,
                 result=dict(
-                    dn=dn3,
+                    dn=lambda x: DN(x) == dn3,
                     fqdn=[fqdn3],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
@@ -310,7 +318,7 @@ class test_host(Declarative):
                 value=fqdn4,
                 summary=u'Added host "%s"' % fqdn4,
                 result=dict(
-                    dn=dn4,
+                    dn=lambda x: DN(x) == dn4,
                     fqdn=[fqdn4],
                     description=[u'Test host 4'],
                     l=[u'Undisclosed location 4'],
@@ -338,7 +346,7 @@ class test_host(Declarative):
                     ),
                 ),
                 result=dict(
-                    dn=dn3,
+                    dn=lambda x: DN(x) == dn3,
                     fqdn=[fqdn3],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
@@ -355,7 +363,7 @@ class test_host(Declarative):
                 value=fqdn3,
                 summary=None,
                 result=dict(
-                    dn=dn3,
+                    dn=lambda x: DN(x) == dn3,
                     fqdn=[fqdn3],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
@@ -381,7 +389,7 @@ class test_host(Declarative):
                     ),
                 ),
                 result=dict(
-                    dn=dn3,
+                    dn=lambda x: DN(x) == dn3,
                     fqdn=[fqdn3],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
@@ -452,7 +460,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -523,7 +531,7 @@ class test_host(Declarative):
                 value=fqdn2,
                 summary=u'Added host "%s"' % fqdn2,
                 result=dict(
-                    dn=dn2,
+                    dn=lambda x: DN(x) == dn2,
                     fqdn=[fqdn2],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index 803b8a793..1bfbae43e 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -23,15 +23,18 @@ Test the `ipalib.plugins.hostgroup` module.
 """
 
 from ipalib import api, errors
-from ipalib.dn import DN
+from ipalib.dn import *
 from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
 from tests.test_xmlrpc import objectclasses
+from ipalib.dn import *
 
 hostgroup1 = u'testhostgroup1'
-dn1 = u'cn=%s,cn=hostgroups,cn=accounts,%s' % (hostgroup1, api.env.basedn)
+dn1 = DN(('cn',hostgroup1),('cn','hostgroups'),('cn','accounts'),
+         api.env.basedn)
 
 fqdn1 = u'testhost1.%s' % api.env.domain
-host_dn1 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn1, api.env.basedn)
+host_dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+              api.env.basedn)
 
 
 class test_hostgroup(Declarative):
@@ -75,12 +78,14 @@ class test_hostgroup(Declarative):
                 value=hostgroup1,
                 summary=u'Added hostgroup "testhostgroup1"',
                 result=dict(
-                    dn=dn1,
+                    dn=lambda x: DN(x) == dn1,
                     cn=[hostgroup1],
                     objectclass=objectclasses.hostgroup,
                     description=[u'Test hostgroup 1'],
                     ipauniqueid=[fuzzy_uuid],
-                    mepmanagedentry=['cn=%s,cn=ng,cn=alt,%s' % (hostgroup1, api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+                            api.env.basedn)],
                 ),
             ),
         ),
@@ -108,7 +113,7 @@ class test_hostgroup(Declarative):
                 value=fqdn1,
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
-                    dn=host_dn1,
+                    dn=lambda x: DN(x) == host_dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -135,7 +140,7 @@ class test_hostgroup(Declarative):
                     ),
                 ),
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'cn': [hostgroup1],
                     'description': [u'Test hostgroup 1'],
                     'member_host': [fqdn1],
@@ -151,7 +156,7 @@ class test_hostgroup(Declarative):
                 value=hostgroup1,
                 summary=None,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'member_host': [u'testhost1.%s' % api.env.domain],
                     'cn': [hostgroup1],
                     'description': [u'Test hostgroup 1'],
@@ -169,7 +174,7 @@ class test_hostgroup(Declarative):
                 summary=u'1 hostgroup matched',
                 result=[
                     {
-                        'dn': dn1,
+                        'dn': lambda x: DN(x) == dn1,
                         'member_host': [u'testhost1.%s' % api.env.domain],
                         'cn': [hostgroup1],
                         'description': [u'Test hostgroup 1'],
@@ -203,7 +208,7 @@ class test_hostgroup(Declarative):
                 value=hostgroup1,
                 summary=None,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'member_host': [u'testhost1.%s' % api.env.domain],
                     'cn': [hostgroup1],
                     'description': [u'Updated hostgroup 1'],
@@ -226,7 +231,7 @@ class test_hostgroup(Declarative):
                 ),
                 completed=1,
                 result={
-                    'dn': dn1,
+                    'dn': lambda x: DN(x) == dn1,
                     'cn': [hostgroup1],
                     'description': [u'Updated hostgroup 1'],
                 },
diff --git a/tests/test_xmlrpc/test_krbtpolicy.py b/tests/test_xmlrpc/test_krbtpolicy.py
index 4d2443e79..3db743d51 100644
--- a/tests/test_xmlrpc/test_krbtpolicy.py
+++ b/tests/test_xmlrpc/test_krbtpolicy.py
@@ -23,6 +23,7 @@ Test kerberos ticket policy
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 user1 = u'tuser1'
 
@@ -59,7 +60,9 @@ class test_krbtpolicy(Declarative):
                 value=u'',
                 summary=None,
                 result=dict(
-                    dn=u'cn=%s,cn=kerberos,%s' % (api.env.domain, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('cn',api.env.domain),('cn','kerberos'),
+                           api.env.basedn),
                     krbmaxticketlife=[u'86400'],
                     krbmaxrenewableage=[u'604800'],
                 ),
@@ -106,10 +109,16 @@ class test_krbtpolicy(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user1, api.env.basedn)
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user1),('cn','users'),('cn','accounts'),
+                           api.env.basedn)
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_nesting.py b/tests/test_xmlrpc/test_nesting.py
index 0d1c78596..f28d47935 100644
--- a/tests/test_xmlrpc/test_nesting.py
+++ b/tests/test_xmlrpc/test_nesting.py
@@ -23,6 +23,7 @@ Test group nexting an indirect members
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 group1 = u'testgroup1'
 group2 = u'testgroup2'
@@ -34,12 +35,15 @@ user3 = u'tuser3'
 user4 = u'tuser4'
 
 hostgroup1 = u'testhostgroup1'
-hgdn1 = u'cn=%s,cn=hostgroups,cn=accounts,%s' % (hostgroup1, api.env.basedn)
+hgdn1 = DN(('cn',hostgroup1),('cn','hostgroups'),('cn','accounts'),
+           api.env.basedn)
 hostgroup2 = u'testhostgroup2'
-hgdn2 = u'cn=%s,cn=hostgroups,cn=accounts,%s' % (hostgroup2, api.env.basedn)
+hgdn2 = DN(('cn',hostgroup2),('cn','hostgroups'),('cn','accounts'),
+           api.env.basedn)
 
 fqdn1 = u'testhost1.%s' % api.env.domain
-host_dn1 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn1, api.env.basedn)
+host_dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+              api.env.basedn)
 
 
 class test_nesting(Declarative):
@@ -76,7 +80,9 @@ class test_nesting(Declarative):
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -98,7 +104,9 @@ class test_nesting(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testgroup2,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup2'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -118,7 +126,9 @@ class test_nesting(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testgroup3,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup3'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -138,7 +148,9 @@ class test_nesting(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testgroup4,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup4'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -167,10 +179,16 @@ class test_nesting(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user1, api.env.basedn)
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user1),('cn','users'),('cn','accounts'),
+                           api.env.basedn)
                 ),
             ),
         ),
@@ -199,10 +217,16 @@ class test_nesting(Declarative):
                     cn=[u'Test User2'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user2, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user2),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user2, api.env.basedn)
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user2),('cn','users'),('cn','accounts'),
+                           api.env.basedn)
                 ),
             ),
         ),
@@ -231,10 +255,16 @@ class test_nesting(Declarative):
                     cn=[u'Test User3'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user3, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user3),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user3, api.env.basedn)
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user3),('cn','users'),('cn','accounts'),
+                           api.env.basedn)
                 ),
             ),
         ),
@@ -263,10 +293,16 @@ class test_nesting(Declarative):
                     cn=[u'Test User4'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user4, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user4),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user4, api.env.basedn)
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user4),('cn','users'),('cn','accounts'),
+                           api.env.basedn)
                 ),
             ),
         ),
@@ -331,7 +367,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_group': (group2,),
                         'gidnumber': [fuzzy_digits],
                         'cn': [group1],
@@ -355,7 +393,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_group': [group2, group3,],
                         'gidnumber': [fuzzy_digits],
                         'cn': [group1],
@@ -379,7 +419,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group2),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': (u'tuser1',),
                         'memberof_group': (u'testgroup1',),
                         'gidnumber': [fuzzy_digits],
@@ -404,7 +446,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group2, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group2),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [user1, user2],
                         'memberof_group': [group1],
                         'gidnumber': [fuzzy_digits],
@@ -429,7 +473,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group3, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group3),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [user3],
                         'memberof_group': [group1],
                         'gidnumber': [fuzzy_digits],
@@ -454,7 +500,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group3, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group3),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [user3],
                         'memberof_group': [group1],
                         'member_group': [group4],
@@ -480,7 +528,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group4, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group4),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [user1],
                         'memberof_group': [group3],
                         'memberofindirect_group': [group1],
@@ -506,7 +556,9 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group4, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group4),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': [user1, user4],
                         'memberof_group': [group3],
                         'memberofindirect_group': [group1],
@@ -531,7 +583,9 @@ class test_nesting(Declarative):
                     memberindirect_group = [group4],
                     member_group = [group2, group3],
                     memberindirect_user = [user1, user2, user3, user4],
-                    dn=u'cn=testgroup1,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup1'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -549,7 +603,9 @@ class test_nesting(Declarative):
                     gidnumber= [fuzzy_digits],
                     memberof_group = [group1],
                     member_user = [user1, user2],
-                    dn=u'cn=testgroup2,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup2'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -569,7 +625,9 @@ class test_nesting(Declarative):
                     member_user = [user3],
                     member_group = [group4],
                     memberindirect_user = [user1, user4],
-                    dn=u'cn=testgroup3,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup3'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -588,7 +646,9 @@ class test_nesting(Declarative):
                     memberof_group = [group3],
                     member_user = [user1, user4],
                     memberofindirect_group = [group1],
-                    dn=u'cn=testgroup4,cn=groups,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testgroup4'),('cn','groups'),
+                           ('cn','accounts'),api.env.basedn),
                 ),
             ),
         ),
@@ -608,7 +668,7 @@ class test_nesting(Declarative):
                 value=fqdn1,
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
-                    dn=host_dn1,
+                    dn=lambda x: DN(x) == host_dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -630,12 +690,14 @@ class test_nesting(Declarative):
                 value=hostgroup1,
                 summary=u'Added hostgroup "testhostgroup1"',
                 result=dict(
-                    dn=hgdn1,
+                    dn=lambda x: DN(x) == hgdn1,
                     cn=[hostgroup1],
                     objectclass=objectclasses.hostgroup,
                     description=[u'Test hostgroup 1'],
                     ipauniqueid=[fuzzy_uuid],
-                    mepmanagedentry=[u'cn=%s,cn=ng,cn=alt,%s' % (hostgroup1, api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+                            api.env.basedn)],
                 ),
             ),
         ),
@@ -650,12 +712,14 @@ class test_nesting(Declarative):
                 value=hostgroup2,
                 summary=u'Added hostgroup "testhostgroup2"',
                 result=dict(
-                    dn=hgdn2,
+                    dn=lambda x: DN(x) == hgdn2,
                     cn=[hostgroup2],
                     objectclass=objectclasses.hostgroup,
                     description=[u'Test hostgroup 2'],
                     ipauniqueid=[fuzzy_uuid],
-                    mepmanagedentry=[u'cn=%s,cn=ng,cn=alt,%s' % (hostgroup2, api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',hostgroup2),('cn','ng'),('cn','alt'),
+                            api.env.basedn)],
                 ),
             ),
         ),
@@ -675,7 +739,7 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                    'dn': hgdn2,
+                    'dn': lambda x: DN(x) == hgdn2,
                     'cn': [hostgroup2],
                     'description': [u'Test hostgroup 2'],
                     'member_host': [fqdn1],
@@ -698,7 +762,7 @@ class test_nesting(Declarative):
                     ),
                 ),
                 result={
-                    'dn': hgdn1,
+                    'dn': lambda x: DN(x) == hgdn1,
                     'cn': [hostgroup1],
                     'description': [u'Test hostgroup 1'],
                     'member_hostgroup': [hostgroup2],
@@ -714,7 +778,7 @@ class test_nesting(Declarative):
                 value=hostgroup1,
                 summary=None,
                 result={
-                    'dn': hgdn1,
+                    'dn': lambda x: DN(x) == hgdn1,
                     'memberindirect_host': [u'testhost1.%s' % api.env.domain],
                     'member_hostgroup': [hostgroup2],
                     'cn': [hostgroup1],
@@ -731,7 +795,7 @@ class test_nesting(Declarative):
                 value=fqdn1,
                 summary=None,
                 result=dict(
-                    dn=host_dn1,
+                    dn=lambda x: DN(x) == host_dn1,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
diff --git a/tests/test_xmlrpc/test_netgroup_plugin.py b/tests/test_xmlrpc/test_netgroup_plugin.py
index fcb3b06ac..fc3bb5456 100644
--- a/tests/test_xmlrpc/test_netgroup_plugin.py
+++ b/tests/test_xmlrpc/test_netgroup_plugin.py
@@ -28,6 +28,7 @@ from ipalib import errors
 from ipaserver.plugins.ldap2 import ldap2
 from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid, fuzzy_netgroupdn
 from tests.test_xmlrpc import objectclasses
+from ipalib.dn import *
 
 # Global so we can save the value between tests
 netgroup_dn = None
@@ -39,12 +40,14 @@ netgroup1 = u'netgroup1'
 netgroup2 = u'netgroup2'
 
 host1 = u'ipatesthost.%s' % api.env.domain
-host_dn1 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (host1, api.env.basedn)
+host_dn1 = DN(('fqdn',host1),('cn','computers'),('cn','accounts'),
+              api.env.basedn)
 
 unknown_host = u'unknown'
 
 hostgroup1 = u'hg1'
-hostgroup_dn1 = u'cn=%s,cn=hostgroups,cn=accounts,%s' % (hostgroup1, api.env.basedn)
+hostgroup_dn1 = DN(('cn',hostgroup1),('cn','hostgroups'),('cn','accounts'),
+                   api.env.basedn)
 
 user1 = u'jexample'
 
@@ -157,7 +160,7 @@ class test_netgroup(Declarative):
                 value=host1,
                 summary=u'Added host "%s"' % host1,
                 result=dict(
-                    dn=host_dn1,
+                    dn=lambda x: DN(x) == host_dn1,
                     fqdn=[host1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -179,12 +182,13 @@ class test_netgroup(Declarative):
                 value=hostgroup1,
                 summary=u'Added hostgroup "%s"' % hostgroup1,
                 result=dict(
-                    dn=hostgroup_dn1,
+                    dn=lambda x: DN(x) == hostgroup_dn1,
                     cn=[hostgroup1],
                     objectclass=objectclasses.hostgroup,
                     description=[u'Test hostgroup 1'],
-                    mepmanagedentry=['cn=%s,cn=ng,cn=alt,%s' % (hostgroup1, api
-.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+                            api.env.basedn)],
                     ipauniqueid=[fuzzy_uuid],
                 ),
             ),
@@ -214,10 +218,16 @@ class test_netgroup(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user1, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user1),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -245,10 +255,16 @@ class test_netgroup(Declarative):
                     cn=[u'Test User2'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user2, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user2),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=%s,cn=users,cn=accounts,%s' % (user2, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('uid',user2),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -268,7 +284,9 @@ class test_netgroup(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -288,7 +306,9 @@ class test_netgroup(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                               api.env.basedn),
                         'member_user': (user2,),
                         'gidnumber': [fuzzy_digits],
                         'cn': [group1],
diff --git a/tests/test_xmlrpc/test_permission_plugin.py b/tests/test_xmlrpc/test_permission_plugin.py
index 4ee466b65..a116a66ea 100644
--- a/tests/test_xmlrpc/test_permission_plugin.py
+++ b/tests/test_xmlrpc/test_permission_plugin.py
@@ -25,28 +25,25 @@ Test the `ipalib/plugins/permission.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 permission1 = u'testperm'
-permission1_dn = u'cn=%s,%s,%s' % (permission1,
-    api.env.container_permission,api.env.basedn,
-)
+permission1_dn = DN(('cn',permission1),
+                    api.env.container_permission,api.env.basedn)
 
 
 permission1_renamed = u'testperm1_rn'
-permission1_renamed_dn = u'cn=%s,%s,%s' % (permission1_renamed,
-    api.env.container_permission,api.env.basedn,
-)
+permission1_renamed_dn = DN(('cn',permission1_renamed),
+                            api.env.container_permission,api.env.basedn)
 
 
 permission2 = u'testperm2'
-permission2_dn = u'cn=%s,%s,%s' % (permission2,
-    api.env.container_permission,api.env.basedn,
-)
+permission2_dn = DN(('cn',permission2),
+                    api.env.container_permission,api.env.basedn)
 
 privilege1 = u'testpriv1'
-privilege1_dn = u'cn=%s,%s,%s' % (
-    privilege1, api.env.container_privilege, api.env.basedn
-)
+privilege1_dn = DN(('cn',privilege1),
+                   api.env.container_privilege,api.env.basedn)
 
 
 class test_permission(Declarative):
@@ -104,7 +101,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
                 result=dict(
-                    dn=permission1_dn,
+                    dn=lambda x: DN(x) == permission1_dn,
                     cn=[permission1],
                     objectclass=objectclasses.permission,
                     type=u'user',
@@ -135,7 +132,7 @@ class test_permission(Declarative):
                 value=privilege1,
                 summary=u'Added privilege "%s"' % privilege1,
                 result=dict(
-                    dn=privilege1_dn,
+                    dn=lambda x: DN(x) == privilege1_dn,
                     cn=[privilege1],
                     description=[u'privilege desc. 1'],
                     objectclass=objectclasses.privilege,
@@ -157,7 +154,7 @@ class test_permission(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'privilege desc. 1'],
                     'memberof_permission': [permission1],
@@ -173,7 +170,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=None,
                 result={
-                    'dn': permission1_dn,
+                    'dn': lambda x: DN(x) == permission1_dn,
                     'cn': [permission1],
                     'member_privilege': [privilege1],
                     'type': u'user',
@@ -192,7 +189,7 @@ class test_permission(Declarative):
                 summary=u'1 permission matched',
                 result=[
                     {
-                        'dn': permission1_dn,
+                        'dn': lambda x: DN(x) == permission1_dn,
                         'cn': [permission1],
                         'member_privilege': [privilege1],
                         'type': u'user',
@@ -212,7 +209,7 @@ class test_permission(Declarative):
                 summary=u'1 permission matched',
                 result=[
                     {
-                        'dn': permission1_dn,
+                        'dn': lambda x: DN(x) == permission1_dn,
                         'cn': [permission1],
                         'member_privilege': [privilege1],
                         'type': u'user',
@@ -235,7 +232,7 @@ class test_permission(Declarative):
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
                 result=dict(
-                    dn=permission2_dn,
+                    dn=lambda x: DN(x) == permission2_dn,
                     cn=[permission2],
                     objectclass=objectclasses.permission,
                     type=u'user',
@@ -254,14 +251,14 @@ class test_permission(Declarative):
                 summary=u'2 permissions matched',
                 result=[
                     {
-                        'dn': permission1_dn,
+                        'dn': lambda x: DN(x) == permission1_dn,
                         'cn': [permission1],
                         'member_privilege': [privilege1],
                         'type': u'user',
                         'permissions': [u'write'],
                     },
                     {
-                        'dn': permission2_dn,
+                        'dn': lambda x: DN(x) == permission2_dn,
                         'cn': [permission2],
                         'type': u'user',
                         'permissions': [u'write'],
@@ -280,7 +277,7 @@ class test_permission(Declarative):
                 summary=u'1 privilege matched',
                 result=[
                     {
-                        'dn': privilege1_dn,
+                        'dn': lambda x: DN(x) == privilege1_dn,
                         'cn': [privilege1],
                         'description': [u'privilege desc. 1'],
                         'memberof_permission': [permission1],
@@ -299,7 +296,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
                 result=dict(
-                    dn=permission1_dn,
+                    dn=lambda x: DN(x) == permission1_dn,
                     cn=[permission1],
                     member_privilege=[privilege1],
                     type=u'user',
@@ -316,7 +313,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=None,
                 result={
-                    'dn': permission1_dn,
+                    'dn': lambda x: DN(x) == permission1_dn,
                     'cn': [permission1],
                     'member_privilege': [privilege1],
                     'type': u'user',
@@ -345,7 +342,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=None,
                 result={
-                    'dn': permission1_dn,
+                    'dn': lambda x: DN(x) == permission1_dn,
                     'cn': [permission1],
                     'member_privilege': [privilege1],
                     'type': u'user',
@@ -366,7 +363,7 @@ class test_permission(Declarative):
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
                 result={
-                    'dn': permission1_renamed_dn,
+                    'dn': lambda x: DN(x) == permission1_renamed_dn,
                     'cn': [permission1_renamed],
                     'member_privilege': [privilege1],
                     'type': u'user',
diff --git a/tests/test_xmlrpc/test_privilege_plugin.py b/tests/test_xmlrpc/test_privilege_plugin.py
index 4c7556b8f..58dbff85b 100644
--- a/tests/test_xmlrpc/test_privilege_plugin.py
+++ b/tests/test_xmlrpc/test_privilege_plugin.py
@@ -24,22 +24,19 @@ Test the `ipalib/plugins/privilege.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 permission1 = u'testperm'
-permission1_dn = u'cn=%s,%s,%s' % (permission1,
-    api.env.container_permission,api.env.basedn,
-)
-
+permission1_dn = DN(('cn',permission1),
+                    api.env.container_permission,api.env.basedn)
 
 permission2 = u'testperm2'
-permission2_dn = u'cn=%s,%s,%s' % (permission2,
-    api.env.container_permission,api.env.basedn,
-)
+permission2_dn = DN(('cn',permission2),
+                    api.env.container_permission,api.env.basedn)
 
 privilege1 = u'testpriv1'
-privilege1_dn = u'cn=%s,%s,%s' % (
-    privilege1, api.env.container_privilege, api.env.basedn
-)
+privilege1_dn = DN(('cn',privilege1),
+                   api.env.container_privilege,api.env.basedn)
 
 
 class test_privilege(Declarative):
@@ -97,7 +94,7 @@ class test_privilege(Declarative):
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
                 result=dict(
-                    dn=permission1_dn,
+                    dn=lambda x: DN(x) == permission1_dn,
                     cn=[permission1],
                     objectclass=objectclasses.permission,
                     type=u'user',
@@ -116,7 +113,7 @@ class test_privilege(Declarative):
                 value=privilege1,
                 summary=u'Added privilege "%s"' % privilege1,
                 result=dict(
-                    dn=privilege1_dn,
+                    dn=lambda x: DN(x) == privilege1_dn,
                     cn=[privilege1],
                     description=[u'privilege desc. 1'],
                     objectclass=objectclasses.privilege,
@@ -138,7 +135,7 @@ class test_privilege(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'privilege desc. 1'],
                     'memberof_permission': [permission1],
@@ -154,7 +151,7 @@ class test_privilege(Declarative):
                 value=privilege1,
                 summary=None,
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'privilege desc. 1'],
                     'memberof_permission': [permission1],
@@ -172,7 +169,7 @@ class test_privilege(Declarative):
                 summary=u'1 privilege matched',
                 result=[
                     {
-                        'dn': privilege1_dn,
+                        'dn': lambda x: DN(x) == privilege1_dn,
                         'cn': [privilege1],
                         'description': [u'privilege desc. 1'],
                         'memberof_permission': [permission1],
@@ -191,7 +188,7 @@ class test_privilege(Declarative):
                 summary=u'1 privilege matched',
                 result=[
                     {
-                        'dn': privilege1_dn,
+                        'dn': lambda x: DN(x) == privilege1_dn,
                         'cn': [privilege1],
                         'description': [u'privilege desc. 1'],
                         'memberof_permission': [permission1],
@@ -213,7 +210,7 @@ class test_privilege(Declarative):
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
                 result=dict(
-                    dn=permission2_dn,
+                    dn=lambda x: DN(x) == permission2_dn,
                     cn=[permission2],
                     objectclass=objectclasses.permission,
                     type=u'user',
@@ -236,7 +233,7 @@ class test_privilege(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'privilege desc. 1'],
                     'memberof_permission': [permission1, permission2],
@@ -258,7 +255,7 @@ class test_privilege(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'privilege desc. 1'],
                     'memberof_permission': [permission1, permission2],
@@ -276,7 +273,7 @@ class test_privilege(Declarative):
                 summary=u'1 privilege matched',
                 result=[
                     {
-                        'dn': privilege1_dn,
+                        'dn': lambda x: DN(x) == privilege1_dn,
                         'cn': [privilege1],
                         'description': [u'privilege desc. 1'],
                         'memberof_permission': [permission1, permission2],
@@ -316,7 +313,7 @@ class test_privilege(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'New desc 1'],
                     'memberof_permission': [permission2],
@@ -338,7 +335,7 @@ class test_privilege(Declarative):
                     ),
                 ),
                 result={
-                    'dn': privilege1_dn,
+                    'dn': lambda x: DN(x) == privilege1_dn,
                     'cn': [privilege1],
                     'description': [u'New desc 1'],
                     'memberof_permission': [permission2],
diff --git a/tests/test_xmlrpc/test_replace.py b/tests/test_xmlrpc/test_replace.py
index 4209e7064..a1fd5d280 100644
--- a/tests/test_xmlrpc/test_replace.py
+++ b/tests/test_xmlrpc/test_replace.py
@@ -28,9 +28,8 @@ gen_modlist code.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
-
-user_memberof = (u'cn=ipausers,cn=groups,cn=accounts,%s' % api.env.basedn,)
 user1=u'tuser1'
 
 
@@ -67,10 +66,16 @@ class test_replace(Declarative):
                     initials=[u'TU'],
                     mail=[u'test1@example.com', u'test2@example.com'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),('cn','kerberos'),
+                            api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_role_plugin.py b/tests/test_xmlrpc/test_role_plugin.py
index e1485cf42..9c405cff7 100644
--- a/tests/test_xmlrpc/test_role_plugin.py
+++ b/tests/test_xmlrpc/test_role_plugin.py
@@ -30,21 +30,21 @@ from ipalib.dn import *
 search = u'test-role'
 
 role1 = u'test-role-1'
-role1_dn = u'cn=%s,%s,%s' % (
-    role1, api.env.container_rolegroup, api.env.basedn
-)
+role1_dn = DN(('cn',role1),api.env.container_rolegroup,
+              api.env.basedn)
 renamedrole1 = u'test-role'
 
 role2 = u'test-role-2'
-role2_dn = u'cn=%s,%s,%s' % (
-    role2, api.env.container_rolegroup, api.env.basedn
-)
+role2_dn = DN(('cn',role2),api.env.container_rolegroup,
+              api.env.basedn)
 
 group1 = u'testgroup1'
-group1_dn = u'cn=%s,%s,%s' % (group1, api.env.container_group, api.env.basedn)
+group1_dn = DN(('cn',group1),api.env.container_group,
+               api.env.basedn)
 
 privilege1 = u'r,w privilege 1'
-privilege1_dn = DN(('cn', privilege1), DN(api.env.container_privilege), DN(api.env.basedn))
+privilege1_dn = DN(('cn', privilege1), DN(api.env.container_privilege),
+                   api.env.basedn)
 
 def escape_comma(value):
     return value.replace(',', '\\,')
@@ -109,7 +109,7 @@ class test_role(Declarative):
                 value=role1,
                 summary=u'Added role "%s"' % role1,
                 result=dict(
-                    dn=role1_dn,
+                    dn=lambda x: DN(x) == role1_dn,
                     cn=[role1],
                     description=[u'role desc 1'],
                     objectclass=objectclasses.role,
@@ -125,7 +125,7 @@ class test_role(Declarative):
                 value=role1,
                 summary=None,
                 result=dict(
-                    dn=role1_dn,
+                    dn=lambda x: DN(x) == role1_dn,
                     cn=[role1],
                     description=[u'role desc 1'],
                 ),
@@ -143,7 +143,7 @@ class test_role(Declarative):
                 value=group1,
                 summary=u'Added group "testgroup1"',
                 result=dict(
-                    dn=group1_dn,
+                    dn=lambda x: DN(x) == group1_dn,
                     cn=[group1],
                     description=[u'group desc 1'],
                     objectclass=objectclasses.group,
@@ -162,7 +162,7 @@ class test_role(Declarative):
                 value=privilege1,
                 summary=u'Added privilege "%s"' % privilege1,
                 result=dict(
-                    dn=lambda got: DN(got) == privilege1_dn,
+                    dn=lambda x: DN(x) == privilege1_dn,
                     cn=[privilege1],
                     description=[u'privilege desc. 1'],
                     objectclass=objectclasses.privilege,
@@ -184,7 +184,7 @@ class test_role(Declarative):
                     ),
                 ),
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'role desc 1'],
                     'memberof_privilege': [privilege1],
@@ -207,7 +207,7 @@ class test_role(Declarative):
                     ),
                 ),
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'role desc 1'],
                     'member_group': [group1],
@@ -224,7 +224,7 @@ class test_role(Declarative):
                 value=role1,
                 summary=None,
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'role desc 1'],
                     'member_group': [group1],
@@ -243,7 +243,7 @@ class test_role(Declarative):
                 summary=u'1 role matched',
                 result=[
                     {
-                        'dn': role1_dn,
+                        'dn': lambda x: DN(x) == role1_dn,
                         'cn': [role1],
                         'description': [u'role desc 1'],
                         'member_group': [group1],
@@ -263,7 +263,7 @@ class test_role(Declarative):
                 summary=u'1 role matched',
                 result=[
                     {
-                        'dn': role1_dn,
+                        'dn': lambda x: DN(x) == role1_dn,
                         'cn': [role1],
                         'description': [u'role desc 1'],
                         'member_group': [group1],
@@ -283,7 +283,7 @@ class test_role(Declarative):
                 value=role2,
                 summary=u'Added role "%s"' % role2,
                 result=dict(
-                    dn=role2_dn,
+                    dn=lambda x: DN(x) == role2_dn,
                     cn=[role2],
                     description=[u'role desc 2'],
                     objectclass=objectclasses.role,
@@ -301,7 +301,7 @@ class test_role(Declarative):
                 summary=u'1 role matched',
                 result=[
                     {
-                        'dn': role1_dn,
+                        'dn': lambda x: DN(x) == role1_dn,
                         'cn': [role1],
                         'description': [u'role desc 1'],
                         'member_group': [group1],
@@ -321,14 +321,14 @@ class test_role(Declarative):
                 summary=u'2 roles matched',
                 result=[
                     {
-                        'dn': role1_dn,
+                        'dn': lambda x: DN(x) == role1_dn,
                         'cn': [role1],
                         'description': [u'role desc 1'],
                         'member_group': [group1],
                         'memberof_privilege': [privilege1],
                     },
                     {
-                        'dn': role2_dn,
+                        'dn': lambda x: DN(x) == role2_dn,
                         'cn': [role2],
                         'description': [u'role desc 2'],
                     },
@@ -362,7 +362,7 @@ class test_role(Declarative):
                 value=role1,
                 summary=None,
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'New desc 1'],
                     'member_group': [group1],
@@ -386,7 +386,7 @@ class test_role(Declarative):
                     ),
                 ),
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'New desc 1'],
                     'memberof_privilege': [privilege1],
@@ -402,7 +402,7 @@ class test_role(Declarative):
                 value=role1,
                 summary=None,
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'New desc 1'],
                     'memberof_privilege': [privilege1],
@@ -465,7 +465,7 @@ class test_role(Declarative):
                     ),
                 ),
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'New desc 1'],
                 }
@@ -486,7 +486,7 @@ class test_role(Declarative):
                     ),
                 ),
                 result={
-                    'dn': role1_dn,
+                    'dn': lambda x: DN(x) == role1_dn,
                     'cn': [role1],
                     'description': [u'New desc 1'],
                 }
@@ -536,7 +536,7 @@ class test_role(Declarative):
                 summary=u'1 role matched',
                 result=[
                     {
-                        'dn': role2_dn,
+                        'dn': lambda x: DN(x) == role2_dn,
                         'cn': [role2],
                         'description': [u'role desc 2'],
                     },
diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py
index 4f08f235e..d424eeedd 100644
--- a/tests/test_xmlrpc/test_service_plugin.py
+++ b/tests/test_xmlrpc/test_service_plugin.py
@@ -26,17 +26,17 @@ from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid, fuzzy_hash
 from tests.test_xmlrpc.xmlrpc_test import fuzzy_digits, fuzzy_date, fuzzy_issuer
 from tests.test_xmlrpc import objectclasses
 import base64
-
+from ipalib.dn import *
 
 fqdn1 = u'testhost1.%s' % api.env.domain
 fqdn2 = u'testhost2.%s' % api.env.domain
 fqdn3 = u'TestHost3.%s' % api.env.domain
 service1 = u'HTTP/%s@%s' % (fqdn1, api.env.realm)
 hostprincipal1 = u'host/%s@%s'  % (fqdn1, api.env.realm)
-service1dn = u'krbprincipalname=%s,cn=services,cn=accounts,%s' % (service1.lower(), api.env.basedn)
-host1dn = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn1, api.env.basedn)
-host2dn = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn2, api.env.basedn)
-host3dn = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn3.lower(), api.env.basedn)
+service1dn = DN(('krbprincipalname',service1),('cn','services'),('cn','accounts'),api.env.basedn)
+host1dn = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),api.env.basedn)
+host2dn = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),api.env.basedn)
+host3dn = DN(('fqdn',fqdn3),('cn','computers'),('cn','accounts'),api.env.basedn)
 
 fd = open('tests/test_xmlrpc/service.crt', 'r')
 servercert = fd.readlines()
@@ -91,7 +91,7 @@ class test_host(Declarative):
                 value=fqdn1,
                 summary=u'Added host "%s"' % fqdn1,
                 result=dict(
-                    dn=host1dn,
+                    dn=lambda x: DN(x) == host1dn,
                     fqdn=[fqdn1],
                     description=[u'Test host 1'],
                     l=[u'Undisclosed location 1'],
@@ -117,7 +117,7 @@ class test_host(Declarative):
                 value=fqdn2,
                 summary=u'Added host "%s"' % fqdn2,
                 result=dict(
-                    dn=host2dn,
+                    dn=lambda x: DN(x) == host2dn,
                     fqdn=[fqdn2],
                     description=[u'Test host 2'],
                     l=[u'Undisclosed location 2'],
@@ -143,7 +143,7 @@ class test_host(Declarative):
                 value=fqdn3.lower(),
                 summary=u'Added host "%s"' % fqdn3.lower(),
                 result=dict(
-                    dn=host3dn,
+                    dn=lambda x: DN(x) == host3dn,
                     fqdn=[fqdn3.lower()],
                     description=[u'Test host 3'],
                     l=[u'Undisclosed location 3'],
@@ -167,7 +167,7 @@ class test_host(Declarative):
                 value=service1,
                 summary=u'Added service "%s"' % service1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     objectclass=objectclasses.service,
                     ipauniqueid=[fuzzy_uuid],
@@ -195,7 +195,7 @@ class test_host(Declarative):
                 value=service1,
                 summary=None,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     has_keytab=False,
                     managedby_host=[fqdn1],
@@ -211,7 +211,7 @@ class test_host(Declarative):
                 value=service1,
                 summary=None,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     objectclass=objectclasses.service,
                     ipauniqueid=[fuzzy_uuid],
@@ -231,7 +231,7 @@ class test_host(Declarative):
                 summary=u'1 service matched',
                 result=[
                     dict(
-                        dn=service1dn,
+                        dn=lambda x: DN(x) == service1dn,
                         krbprincipalname=[service1],
                         managedby_host=[fqdn1],
                         has_keytab=False,
@@ -250,7 +250,7 @@ class test_host(Declarative):
                 summary=u'1 service matched',
                 result=[
                     dict(
-                        dn=service1dn,
+                        dn=lambda x: DN(x) == service1dn,
                         krbprincipalname=[service1],
                         objectclass=objectclasses.service,
                         ipauniqueid=[fuzzy_uuid],
@@ -269,7 +269,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[(u'notfound', u'no such entry')])),
                 completed=0,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1],
                 ),
@@ -284,7 +284,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[(u'notfound', u'This entry is not a member')])),
                 completed=0,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1],
                 ),
@@ -299,7 +299,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[])),
                 completed=1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1, fqdn2],
                 ),
@@ -314,7 +314,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[])),
                 completed=1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1],
                 ),
@@ -329,7 +329,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[])),
                 completed=1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1, fqdn3.lower()],
                 ),
@@ -344,7 +344,7 @@ class test_host(Declarative):
                 failed=dict(managedby=dict(host=[])),
                 completed=1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     managedby_host=[fqdn1],
                 ),
@@ -371,7 +371,8 @@ class test_host(Declarative):
                     managedby_host=[fqdn1],
                     valid_not_before=fuzzy_date,
                     valid_not_after=fuzzy_date,
-                    subject=u'CN=%s,O=%s' % (api.env.host, api.env.realm),
+                    subject=lambda x: DN(x) == \
+                        DN(('CN',api.env.host),('O',api.env.realm)),
                     serial_number=fuzzy_digits,
                     md5_fingerprint=fuzzy_hash,
                     sha1_fingerprint=fuzzy_hash,
@@ -388,7 +389,7 @@ class test_host(Declarative):
                 value=service1,
                 summary=None,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     usercertificate=[base64.b64decode(servercert)],
                     krbprincipalname=[service1],
                     has_keytab=False,
@@ -397,7 +398,8 @@ class test_host(Declarative):
                     # test case.
                     valid_not_before=fuzzy_date,
                     valid_not_after=fuzzy_date,
-                    subject=u'CN=%s,O=%s' % (api.env.host, api.env.realm),
+                    subject=lambda x: DN(x) == \
+                        DN(('CN',api.env.host),('O',api.env.realm)),
                     serial_number=fuzzy_digits,
                     md5_fingerprint=fuzzy_hash,
                     sha1_fingerprint=fuzzy_hash,
diff --git a/tests/test_xmlrpc/test_sudocmd_plugin.py b/tests/test_xmlrpc/test_sudocmd_plugin.py
index 2a5dcb0af..a19fefc73 100644
--- a/tests/test_xmlrpc/test_sudocmd_plugin.py
+++ b/tests/test_xmlrpc/test_sudocmd_plugin.py
@@ -24,7 +24,7 @@ Test the `ipalib/plugins/sudocmd.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
 from tests.test_xmlrpc import objectclasses
-
+from ipalib.dn import *
 
 sudocmd1 = u'/usr/bin/sudotestcmd1'
 
@@ -69,8 +69,9 @@ class test_sudocmd(Declarative):
                 value=sudocmd1,
                 summary=u'Added sudo command "%s"' % sudocmd1,
                 result=dict(
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                     sudocmd=[sudocmd1],
                     description=[u'Test sudo command 1'],
                     objectclass=objectclasses.sudocmd,
@@ -98,8 +99,9 @@ class test_sudocmd(Declarative):
                 value=sudocmd1,
                 summary=None,
                 result=dict(
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                     sudocmd=[sudocmd1],
                     description=[u'Test sudo command 1'],
                 ),
@@ -116,8 +118,9 @@ class test_sudocmd(Declarative):
                 summary=u'1 sudo command matched',
                 result=[
                     dict(
-                        dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                            api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('sudocmd',sudocmd1),('cn','sudocmds'),
+                               ('cn','sudo'),api.env.basedn),
                         sudocmd=[sudocmd1],
                         description=[u'Test sudo command 1'],
                     ),
@@ -148,8 +151,9 @@ class test_sudocmd(Declarative):
                 value=sudocmd1,
                 summary=None,
                 result=dict(
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                     sudocmd=[sudocmd1],
                     description=[u'Updated sudo command 1'],
                 ),
diff --git a/tests/test_xmlrpc/test_sudocmdgroup_plugin.py b/tests/test_xmlrpc/test_sudocmdgroup_plugin.py
index 28c589fc1..dd89c5d17 100644
--- a/tests/test_xmlrpc/test_sudocmdgroup_plugin.py
+++ b/tests/test_xmlrpc/test_sudocmdgroup_plugin.py
@@ -23,6 +23,7 @@ Test the `ipalib/plugins/sudocmdgroup.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
 sudocmdgroup1 = u'testsudocmdgroup1'
 sudocmdgroup2 = u'testsudocmdgroup2'
@@ -52,8 +53,9 @@ class test_sudocmdgroup(Declarative):
                     sudocmd=[u'/usr/bin/sudotestcmd1'],
                     ipauniqueid=[fuzzy_uuid],
                     description=[u'Test sudo command 1'],
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -68,8 +70,9 @@ class test_sudocmdgroup(Declarative):
                 result=dict(
                     sudocmd=[sudocmd1],
                     description=[u'Test sudo command 1'],
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -113,8 +116,9 @@ class test_sudocmdgroup(Declarative):
                     description=[u'Test desc 1'],
                     objectclass=objectclasses.sudocmdgroup,
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup1'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
             ),
         ),
@@ -139,8 +143,9 @@ class test_sudocmdgroup(Declarative):
                 result=dict(
                     cn=[sudocmdgroup1],
                     description=[u'Test desc 1'],
-                    dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup1'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
             ),
         ),
@@ -171,8 +176,9 @@ class test_sudocmdgroup(Declarative):
                 result=dict(
                     cn=[sudocmdgroup1],
                     description=[u'New desc 1'],
-                    dn=u'cn=testsudocmdgroup1,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup1'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
                 summary=None,
             ),
@@ -187,8 +193,9 @@ class test_sudocmdgroup(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup1, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         cn=[sudocmdgroup1],
                         description=[u'New desc 1'],
                     ),
@@ -237,8 +244,9 @@ class test_sudocmdgroup(Declarative):
                     description=[u'Test desc 2'],
                     objectclass=objectclasses.sudocmdgroup,
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup2'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
             ),
         ),
@@ -263,8 +271,9 @@ class test_sudocmdgroup(Declarative):
                 result=dict(
                     cn=[sudocmdgroup2],
                     description=[u'Test desc 2'],
-                    dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup2'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
             ),
         ),
@@ -295,8 +304,9 @@ class test_sudocmdgroup(Declarative):
                 result=dict(
                     cn=[sudocmdgroup2],
                     description=[u'New desc 2'],
-                    dn=u'cn=testsudocmdgroup2,cn=sudocmdgroups,cn=sudo,' + \
-                        api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('cn','testsudocmdgroup2'),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                 ),
                 summary=None,
             ),
@@ -311,8 +321,9 @@ class test_sudocmdgroup(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup2, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup2),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         cn=[sudocmdgroup2],
                         description=[u'New desc 2'],
                     ),
@@ -331,14 +342,16 @@ class test_sudocmdgroup(Declarative):
                 truncated=False,
                 result=[
                     dict(
-                        dn=u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup1, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         cn=[sudocmdgroup1],
                         description=[u'New desc 1'],
                     ),
                     dict(
-                        dn=u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup2, api.env.basedn),
+                        dn=lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup2),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         cn=[sudocmdgroup2],
                         description=[u'New desc 2'],
                     ),
@@ -364,8 +377,9 @@ class test_sudocmdgroup(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         'member_sudocmd': (sudocmd1,),
                         'cn': [sudocmdgroup1],
                         'description': [u'New desc 1'],
@@ -380,8 +394,9 @@ class test_sudocmdgroup(Declarative):
                 value=sudocmd1,
                 summary=None,
                 result=dict(
-                    dn=u'sudocmd=%s,cn=sudocmds,cn=sudo,%s' % (sudocmd1,
-                        api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('sudocmd',sudocmd1),('cn','sudocmds'),('cn','sudo'),
+                           api.env.basedn),
                     sudocmd=[sudocmd1],
                     description=[u'Test sudo command 1'],
                     memberof_sudocmdgroup = [u'testsudocmdgroup1'],
@@ -403,8 +418,9 @@ class test_sudocmdgroup(Declarative):
                     ),
                 ),
                 result={
-                        'dn': u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                            (sudocmdgroup1, api.env.basedn),
+                        'dn': lambda x: DN(x) == \
+                            DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                               ('cn','sudo'),api.env.basedn),
                         'member_sudocmd': (u'/usr/bin/sudotestcmd1',),
                         'cn': [sudocmdgroup1],
                         'description': [u'New desc 1'],
@@ -425,8 +441,9 @@ class test_sudocmdgroup(Declarative):
                     ),
                 ),
                 result={
-                    'dn': u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                        (sudocmdgroup1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                     'cn': [sudocmdgroup1],
                     'description': [u'New desc 1'],
                 },
@@ -447,8 +464,9 @@ class test_sudocmdgroup(Declarative):
                     ),
                 ),
                 result={
-                    'dn': u'cn=%s,cn=sudocmdgroups,cn=sudo,%s' % \
-                        (sudocmdgroup1, api.env.basedn),
+                    'dn': lambda x: DN(x) == \
+                        DN(('cn',sudocmdgroup1),('cn','sudocmdgroups'),
+                           ('cn','sudo'),api.env.basedn),
                     'cn': [sudocmdgroup1],
                     'description': [u'New desc 1'],
                 },
diff --git a/tests/test_xmlrpc/test_user_plugin.py b/tests/test_xmlrpc/test_user_plugin.py
index e0f2d7fce..12aec153c 100644
--- a/tests/test_xmlrpc/test_user_plugin.py
+++ b/tests/test_xmlrpc/test_user_plugin.py
@@ -26,9 +26,8 @@ Test the `ipalib/plugins/user.py` module.
 from ipalib import api, errors
 from tests.test_xmlrpc import objectclasses
 from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
+from ipalib.dn import *
 
-
-user_memberof = (u'cn=ipausers,cn=groups,cn=accounts,%s' % api.env.basedn,)
 user1=u'tuser1'
 user2=u'tuser2'
 renameduser1=u'tuser'
@@ -98,10 +97,16 @@ class test_user(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -123,7 +128,9 @@ class test_user(Declarative):
             ),
             expected=dict(
                 result=dict(
-                    dn=u'uid=tuser1,cn=users,cn=accounts,%s' % api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                     givenname=[u'Test'],
                     homedirectory=[u'/home/tuser1'],
                     loginshell=[u'/bin/sh'],
@@ -148,7 +155,9 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     {
-                        'dn': u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                        'dn': lambda x: DN(x) == \
+                            DN(('uid','tuser1'),('cn','users'),
+                               ('cn','accounts'),api.env.basedn),
                         'cn': [u'Test User1'],
                         'gecos': [u'Test User1'],
                         'givenname': [u'Test'],
@@ -162,8 +171,12 @@ class test_user(Declarative):
                         'uidnumber': [fuzzy_digits],
                         'gidnumber': [fuzzy_digits],
                         'ipauniqueid': [fuzzy_uuid],
-                        'mepmanagedentry': [u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
-                        'krbpwdpolicyreference': [u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
+                        'mepmanagedentry': lambda x: [DN(i) for i in x] == \
+                            [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                                api.env.basedn)],
+                        'krbpwdpolicyreference': lambda x: [DN(i) for i in x] == \
+                            [DN(('cn','global_policy'),('cn',api.env.realm),
+                                ('cn','kerberos'),api.env.basedn)],
                         'nsaccountlock': False,
                         'displayname': [u'Test User1'],
                         'cn': [u'Test User1'],
@@ -184,7 +197,9 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     dict(
-                        dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                        dn=lambda x: DN(x) == \
+                            DN(('uid','tuser1'),('cn','users'),
+                               ('cn','accounts'),api.env.basedn),
                         givenname=[u'Test'],
                         homedirectory=[u'/home/tuser1'],
                         loginshell=[u'/bin/sh'],
@@ -210,7 +225,9 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     dict(
-                        dn=u'uid=admin,cn=users,cn=accounts,' + api.env.basedn,
+                        dn=lambda x: DN(x) == \
+                            DN(('uid','admin'),('cn','users'),('cn','accounts'),
+                               api.env.basedn),
                         homedirectory=[u'/home/admin'],
                         loginshell=[u'/bin/bash'],
                         sn=[u'Administrator'],
@@ -220,7 +237,9 @@ class test_user(Declarative):
                         gidnumber=[fuzzy_digits],
                     ),
                     dict(
-                        dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                        dn=lambda x: DN(x) == \
+                            DN(('uid','tuser1'),('cn','users'),
+                               ('cn','accounts'),api.env.basedn),
                         givenname=[u'Test'],
                         homedirectory=[u'/home/tuser1'],
                         loginshell=[u'/bin/sh'],
@@ -246,7 +265,9 @@ class test_user(Declarative):
             expected=dict(
                 result=[
                     dict(
-                        dn=u'uid=admin,cn=users,cn=accounts,' + api.env.basedn,
+                        dn=lambda x: DN(x) == \
+                            DN(('uid','admin'),('cn','users'),('cn','accounts'),
+                               api.env.basedn),
                         homedirectory=[u'/home/admin'],
                         loginshell=[u'/bin/bash'],
                         sn=[u'Administrator'],
@@ -326,7 +347,9 @@ class test_user(Declarative):
             command=('user_show', [user1], {}),
             expected=dict(
                 result=dict(
-                    dn=u'uid=tuser1,cn=users,cn=accounts,%s' % api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                     givenname=[u'Finkle'],
                     homedirectory=[u'/home/tuser1'],
                     loginshell=[u'/bin/sh'],
@@ -445,10 +468,16 @@ class test_user(Declarative):
                     cn=[u'Test User1'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -477,10 +506,16 @@ class test_user(Declarative):
                     cn=[u'Test User2'],
                     initials=[u'TU'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user2, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user2),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser2,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser2'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -566,7 +601,9 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     objectclass=objectclasses.group + [u'posixgroup'],
                     ipauniqueid=[fuzzy_uuid],
-                    dn=u'cn=%s,cn=groups,cn=accounts,%s' % (group1, api.env.basedn),
+                    dn=lambda x: DN(x) == \
+                        DN(('cn',group1),('cn','groups'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),
@@ -611,10 +648,16 @@ class test_user(Declarative):
                     postalcode=[u'01234-5678'],
                     telephonenumber=[u'410-555-1212'],
                     ipauniqueid=[fuzzy_uuid],
-                    krbpwdpolicyreference=[u'cn=global_policy,cn=%s,cn=kerberos,%s' % (api.env.realm, api.env.basedn)],
-                    mepmanagedentry=[u'cn=%s,cn=groups,cn=accounts,%s' % (user1, api.env.basedn)],
+                    krbpwdpolicyreference=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn','global_policy'),('cn',api.env.realm),
+                            ('cn','kerberos'),api.env.basedn)],
+                    mepmanagedentry=lambda x: [DN(i) for i in x] == \
+                        [DN(('cn',user1),('cn','groups'),('cn','accounts'),
+                            api.env.basedn)],
                     memberof_group=[u'ipausers'],
-                    dn=u'uid=tuser1,cn=users,cn=accounts,' + api.env.basedn,
+                    dn=lambda x: DN(x) == \
+                        DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
+                           api.env.basedn),
                 ),
             ),
         ),