Allow primary keys to use different type than unicode.

Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>

1 files changed, 169 insertions, 168 deletions

diff --git a/API.txt b/API.txt
index a0285d494..c2654b144 100644
--- a/API.txt
+++ b/API.txt
@@ -18,7 +18,7 @@ option: StrEnum('type', attribute=False, cli_name='type', multivalue=False, requ
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: aci_del
 args: 1,2,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -26,7 +26,7 @@ option: StrEnum('aciprefix', cli_name='prefix', values=(u'permission', u'delegat
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: aci_find
 args: 1,16,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -69,7 +69,7 @@ option: StrEnum('type', attribute=False, autofill=False, cli_name='type', multiv
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: aci_rename
 args: 1,15,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -90,7 +90,7 @@ option: StrEnum('type', attribute=False, autofill=False, cli_name='type', multiv
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: aci_show
 args: 1,5,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -101,7 +101,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: adtrust_is_enabled
 args: 0,1,1
 option: Str('version?', exclude='webui')
@@ -118,7 +118,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_add_condition
 args: 1,8,5
 arg: Str('cn', cli_name='automember_rule')
@@ -134,7 +134,7 @@ output: Output('completed', <type 'int'>, None)
 output: Output('failed', <type 'dict'>, None)
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_default_group_remove
 args: 0,5,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -144,7 +144,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_default_group_set
 args: 0,6,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -155,7 +155,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_default_group_show
 args: 0,4,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -164,7 +164,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_del
 args: 1,2,3
 arg: Str('cn', cli_name='automember_rule')
@@ -172,7 +172,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: automember_find
 args: 1,5,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -199,7 +199,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_rebuild
 args: 0,7,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -211,7 +211,7 @@ option: Str('users*')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_remove_condition
 args: 1,8,5
 arg: Str('cn', cli_name='automember_rule')
@@ -227,7 +227,7 @@ output: Output('completed', <type 'int'>, None)
 output: Output('failed', <type 'dict'>, None)
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automember_show
 args: 1,4,3
 arg: Str('cn', cli_name='automember_rule')
@@ -237,7 +237,7 @@ option: StrEnum('type', values=(u'group', u'hostgroup'))
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountkey_add
 args: 2,7,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -251,7 +251,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountkey_del
 args: 2,4,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -262,7 +262,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False, excl
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: automountkey_find
 args: 3,7,4
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -296,7 +296,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountkey_show
 args: 2,6,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -309,7 +309,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountlocation_add
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='location', multivalue=False, primary_key=True, required=True)
@@ -320,7 +320,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountlocation_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='location', multivalue=True, primary_key=True, query=True, required=True)
@@ -328,7 +328,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: automountlocation_find
 args: 1,7,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -359,7 +359,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountlocation_tofiles
 args: 1,1,1
 arg: Str('cn', attribute=True, cli_name='location', multivalue=False, primary_key=True, query=True, required=True)
@@ -377,7 +377,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountmap_add_indirect
 args: 2,8,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -392,7 +392,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountmap_del
 args: 2,2,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -401,7 +401,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: automountmap_find
 args: 2,8,4
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -432,7 +432,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: automountmap_show
 args: 2,4,3
 arg: Str('automountlocationcn', cli_name='automountlocation', query=True, required=True)
@@ -443,7 +443,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: batch
 args: 1,1,2
 arg: Any('methods*')
@@ -536,7 +536,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: config_show
 args: 0,4,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -545,7 +545,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: cosentry_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='cn', multivalue=False, primary_key=True, required=True)
@@ -558,7 +558,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: cosentry_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='cn', multivalue=True, primary_key=True, query=True, required=True)
@@ -566,7 +566,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: cosentry_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -597,7 +597,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: cosentry_show
 args: 1,4,3
 arg: Str('cn', attribute=True, cli_name='cn', multivalue=False, primary_key=True, query=True, required=True)
@@ -607,7 +607,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: delegation_add
 args: 1,7,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -620,14 +620,14 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: delegation_del
 args: 1,1,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: delegation_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -656,7 +656,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: delegation_show
 args: 1,3,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -665,20 +665,20 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dns_is_enabled
 args: 0,1,3
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dns_resolve
 args: 1,1,3
 arg: Str('hostname')
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnsconfig_mod
 args: 0,11,3
 option: Str('addattr*', cli_name='addattr', exclude='webui')
@@ -694,7 +694,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnsconfig_show
 args: 0,4,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -703,7 +703,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnsrecord_add
 args: 2,116,3
 arg: Str('dnszoneidnsname', cli_name='dnszone', query=True, required=True)
@@ -826,7 +826,7 @@ option: TXTRecord('txtrecord', attribute=True, cli_name='txt_rec', csv=True, mul
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnsrecord_del
 args: 2,39,3
 arg: Str('dnszoneidnsname', cli_name='dnszone', query=True, required=True)
@@ -872,7 +872,7 @@ option: TXTRecord('txtrecord', attribute=True, autofill=False, cli_name='txt_rec
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: dnsrecord_delentry
 args: 2,2,3
 arg: Str('dnszoneidnsname', cli_name='dnszone', query=True, required=True)
@@ -881,7 +881,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: dnsrecord_find
 args: 2,44,4
 arg: Str('dnszoneidnsname', cli_name='dnszone', query=True, required=True)
@@ -1056,7 +1056,7 @@ option: TXTRecord('txtrecord', attribute=True, autofill=False, cli_name='txt_rec
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnsrecord_show
 args: 2,5,3
 arg: Str('dnszoneidnsname', cli_name='dnszone', query=True, required=True)
@@ -1068,7 +1068,7 @@ option: Flag('structured', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_add
 args: 1,24,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -1098,14 +1098,14 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_add_permission
 args: 1,1,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_del
 args: 1,2,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=True, primary_key=True, query=True, required=True)
@@ -1113,21 +1113,21 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: dnszone_disable
 args: 1,1,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_enable
 args: 1,1,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_find
 args: 1,26,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1191,14 +1191,14 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_remove_permission
 args: 1,1,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: dnszone_show
 args: 1,4,3
 arg: Str('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -1208,7 +1208,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: env
 args: 1,3,4
 arg: Str('variables*')
@@ -1234,7 +1234,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: group_add_member
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='group_name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
@@ -1255,14 +1255,14 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: group_detach
 args: 1,1,3
 arg: Str('cn', attribute=True, cli_name='group_name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: group_find
 args: 1,28,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1316,7 +1316,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: group_remove_member
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='group_name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
@@ -1340,7 +1340,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacrule_add
 args: 1,16,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -1362,7 +1362,7 @@ option: StrEnum('usercategory', attribute=True, cli_name='usercat', multivalue=F
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacrule_add_host
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -1418,21 +1418,21 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: hbacrule_disable
 args: 1,1,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacrule_enable
 args: 1,1,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacrule_find
 args: 1,18,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1481,7 +1481,7 @@ option: StrEnum('usercategory', attribute=True, autofill=False, cli_name='userca
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacrule_remove_host
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -1540,7 +1540,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvc_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='service', multivalue=False, primary_key=True, required=True)
@@ -1553,7 +1553,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvc_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='service', multivalue=True, primary_key=True, query=True, required=True)
@@ -1561,7 +1561,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: hbacsvc_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1592,7 +1592,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvc_show
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='service', multivalue=False, primary_key=True, query=True, required=True)
@@ -1603,7 +1603,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvcgroup_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -1616,7 +1616,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvcgroup_add_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -1635,7 +1635,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: hbacsvcgroup_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1666,7 +1666,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbacsvcgroup_remove_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -1688,7 +1688,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hbactest
 args: 0,10,6
 option: Flag('disabled?', autofill=True, cli_name='disabled', default=False)
@@ -1734,7 +1734,7 @@ option: Str('userpassword', attribute=True, cli_name='password', multivalue=Fals
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: host_add_managedby
 args: 1,5,3
 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)
@@ -1753,14 +1753,14 @@ option: Flag('updatedns?', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: host_disable
 args: 1,1,3
 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: host_find
 args: 1,33,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1829,7 +1829,7 @@ option: Str('userpassword', attribute=True, autofill=False, cli_name='password',
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: host_remove_managedby
 args: 1,5,3
 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)
@@ -1852,7 +1852,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hostgroup_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='hostgroup_name', multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$', primary_key=True, required=True)
@@ -1865,7 +1865,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hostgroup_add_member
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='hostgroup_name', multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$', primary_key=True, query=True, required=True)
@@ -1885,7 +1885,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: hostgroup_find
 args: 1,21,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -1928,7 +1928,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: hostgroup_remove_member
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='hostgroup_name', multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$', primary_key=True, query=True, required=True)
@@ -1951,7 +1951,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: i18n_messages
 args: 0,1,1
 option: Str('version?', exclude='webui')
@@ -1973,7 +1973,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: idrange_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=True, primary_key=True, query=True, required=True)
@@ -1981,7 +1981,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: idrange_find
 args: 1,13,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2020,7 +2020,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: idrange_show
 args: 1,4,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2030,7 +2030,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: json_metadata
 args: 2,4,3
 arg: Str('objname?')
@@ -2056,7 +2056,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: krbtpolicy_reset
 args: 1,3,3
 arg: Str('uid', attribute=True, cli_name='user', multivalue=False, primary_key=True, query=True, required=False)
@@ -2065,7 +2065,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: krbtpolicy_show
 args: 1,4,3
 arg: Str('uid', attribute=True, cli_name='user', multivalue=False, primary_key=True, query=True, required=False)
@@ -2075,7 +2075,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: migrate_ds
 args: 2,18,4
 arg: Str('ldapuri', cli_name='ldap_uri')
@@ -2118,7 +2118,7 @@ option: StrEnum('usercategory', attribute=True, cli_name='usercat', multivalue=F
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: netgroup_add_member
 args: 1,9,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$', primary_key=True, query=True, required=True)
@@ -2141,7 +2141,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: netgroup_find
 args: 1,28,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2195,7 +2195,7 @@ option: StrEnum('usercategory', attribute=True, autofill=False, cli_name='userca
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: netgroup_remove_member
 args: 1,9,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$', primary_key=True, query=True, required=True)
@@ -2221,7 +2221,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: otptoken_add
 args: 1,21,3
 arg: Str('ipatokenuniqueid', attribute=True, autofill=True, cli_name='id', multivalue=False, primary_key=True, required=False)
@@ -2248,7 +2248,7 @@ option: StrEnum('type', attribute=False, autofill=True, cli_name='type', default
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: otptoken_del
 args: 1,2,3
 arg: Str('ipatokenuniqueid', attribute=True, autofill=True, cli_name='id', multivalue=True, primary_key=True, query=True, required=True)
@@ -2256,7 +2256,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: otptoken_find
 args: 1,21,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2306,7 +2306,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: otptoken_show
 args: 1,4,3
 arg: Str('ipatokenuniqueid', attribute=True, autofill=True, cli_name='id', multivalue=False, primary_key=True, query=True, required=True)
@@ -2316,7 +2316,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: passwd
 args: 3,1,3
 arg: Str('principal', autofill=True, cli_name='user', primary_key=True)
@@ -2325,7 +2325,7 @@ arg: Password('current_password', autofill=True, confirm=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: permission_add
 args: 1,19,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9.]+$', primary_key=True, required=True)
@@ -2350,7 +2350,7 @@ option: Str('type', alwaysask=True, attribute=False, autofill=False, cli_name='t
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: permission_add_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9.:]+$', primary_key=True, query=True, required=True)
@@ -2372,7 +2372,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version', cli_name='version', exclude='webui', multivalue=False, required=False)
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: permission_del
 args: 1,3,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=True, pattern='^[-_ a-zA-Z0-9.:]+$', primary_key=True, query=True, required=True)
@@ -2381,7 +2381,7 @@ option: Flag('force', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: permission_find
 args: 1,24,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2442,7 +2442,7 @@ option: Str('type', attribute=False, autofill=False, cli_name='type', multivalue
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: permission_remove_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9.:]+$', primary_key=True, query=True, required=True)
@@ -2464,7 +2464,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: ping
 args: 0,1,1
 option: Str('version?', exclude='webui')
@@ -2494,7 +2494,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: privilege_add_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2524,7 +2524,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: privilege_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2556,7 +2556,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: privilege_remove_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2589,7 +2589,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: pwpolicy_add
 args: 1,14,3
 arg: Str('cn', attribute=True, cli_name='group', multivalue=False, primary_key=True, required=True)
@@ -2609,7 +2609,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: pwpolicy_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='group', multivalue=True, primary_key=True, required=True)
@@ -2617,7 +2617,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: pwpolicy_find
 args: 1,16,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2662,7 +2662,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: pwpolicy_show
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='group', multivalue=False, primary_key=True, query=True, required=False)
@@ -2673,7 +2673,7 @@ option: Str('user?')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: radiusproxy_add
 args: 1,11,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -2690,7 +2690,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: radiusproxy_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=True, primary_key=True, query=True, required=True)
@@ -2698,7 +2698,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: radiusproxy_find
 args: 1,13,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2738,7 +2738,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: radiusproxy_show
 args: 1,4,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2748,7 +2748,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: realmdomains_mod
 args: 0,11,3
 option: Str('add_domain', attribute=True, autofill=False, cli_name='add_domain', multivalue=False, required=False)
@@ -2764,7 +2764,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: realmdomains_show
 args: 0,4,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -2773,7 +2773,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: role_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -2786,7 +2786,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: role_add_member
 args: 1,8,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2819,7 +2819,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: role_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2851,7 +2851,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: role_remove_member
 args: 1,8,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2887,7 +2887,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selfservice_add
 args: 1,5,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9]+$', primary_key=True, required=True)
@@ -2898,14 +2898,14 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selfservice_del
 args: 1,1,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9]+$', primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selfservice_find
 args: 1,7,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -2930,7 +2930,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selfservice_show
 args: 1,3,3
 arg: Str('aciname', attribute=True, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9]+$', primary_key=True, query=True, required=True)
@@ -2939,7 +2939,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selinuxusermap_add
 args: 1,12,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
@@ -2957,7 +2957,7 @@ option: StrEnum('usercategory', attribute=True, cli_name='usercat', multivalue=F
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selinuxusermap_add_host
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -2989,21 +2989,21 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: selinuxusermap_disable
 args: 1,1,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selinuxusermap_enable
 args: 1,1,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selinuxusermap_find
 args: 1,14,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -3044,7 +3044,7 @@ option: StrEnum('usercategory', attribute=True, autofill=False, cli_name='userca
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: selinuxusermap_remove_host
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3079,7 +3079,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: service_add
 args: 1,11,3
 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, required=True)
@@ -3096,7 +3096,7 @@ option: Bytes('usercertificate', attribute=True, cli_name='certificate', multiva
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: service_add_host
 args: 1,5,3
 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)
@@ -3115,14 +3115,14 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: service_disable
 args: 1,1,3
 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: service_find
 args: 1,11,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -3158,7 +3158,7 @@ option: Bytes('usercertificate', attribute=True, autofill=False, cli_name='certi
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: service_remove_host
 args: 1,5,3
 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)
@@ -3181,7 +3181,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sidgen_was_run
 args: 0,1,1
 option: Str('version?', exclude='webui')
@@ -3198,7 +3198,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudocmd_del
 args: 1,2,3
 arg: Str('sudocmd', attribute=True, cli_name='command', multivalue=True, primary_key=True, query=True, required=True)
@@ -3206,7 +3206,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: sudocmd_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -3237,7 +3237,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudocmd_show
 args: 1,5,3
 arg: Str('sudocmd', attribute=True, cli_name='command', multivalue=False, primary_key=True, query=True, required=True)
@@ -3248,7 +3248,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudocmdgroup_add
 args: 1,7,3
 arg: Str('cn', attribute=True, cli_name='sudocmdgroup_name', multivalue=False, primary_key=True, required=True)
@@ -3261,7 +3261,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudocmdgroup_add_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='sudocmdgroup_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3280,7 +3280,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: sudocmdgroup_find
 args: 1,9,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -3311,7 +3311,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudocmdgroup_remove_member
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='sudocmdgroup_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3333,7 +3333,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudorule_add
 args: 1,18,3
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, required=True)
@@ -3357,7 +3357,7 @@ option: StrEnum('usercategory', attribute=True, cli_name='usercat', multivalue=F
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudorule_add_allow_command
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3404,7 +3404,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudorule_add_runasgroup
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3447,7 +3447,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: sudorule_disable
 args: 1,1,1
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3510,7 +3510,7 @@ option: StrEnum('usercategory', attribute=True, autofill=False, cli_name='userca
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudorule_remove_allow_command
 args: 1,6,3
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3557,7 +3557,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: sudorule_remove_runasgroup
 args: 1,5,3
 arg: Str('cn', attribute=True, cli_name='sudorule_name', multivalue=False, primary_key=True, query=True, required=True)
@@ -3603,7 +3603,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trust_add
 args: 1,13,3
 arg: Str('cn', attribute=True, cli_name='realm', multivalue=False, primary_key=True, required=True)
@@ -3622,7 +3622,7 @@ option: StrEnum('trust_type', autofill=True, cli_name='type', default=u'ad', val
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trust_del
 args: 1,2,3
 arg: Str('cn', attribute=True, cli_name='realm', multivalue=True, primary_key=True, query=True, required=True)
@@ -3630,7 +3630,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: trust_fetch_domains
 args: 1,4,4
 arg: Str('cn', attribute=True, cli_name='realm', multivalue=False, primary_key=True, query=True, required=True)
@@ -3674,7 +3674,7 @@ option: Str('setattr*', cli_name='setattr', exclude='webui')
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trust_resolve
 args: 0,4,1
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -3691,7 +3691,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustconfig_mod
 args: 0,9,3
 option: Str('addattr*', cli_name='addattr', exclude='webui')
@@ -3705,7 +3705,7 @@ option: StrEnum('trust_type', autofill=True, cli_name='type', default=u'ad', val
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustconfig_show
 args: 0,5,3
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
@@ -3715,7 +3715,7 @@ option: StrEnum('trust_type', autofill=True, cli_name='type', default=u'ad', val
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustdomain_add
 args: 2,9,3
 arg: Str('trustcn', cli_name='trust', query=True, required=True)
@@ -3731,7 +3731,7 @@ option: StrEnum('trust_type', autofill=True, cli_name='type', default=u'ad', val
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustdomain_del
 args: 2,2,3
 arg: Str('trustcn', cli_name='trust', query=True, required=True)
@@ -3740,7 +3740,7 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: trustdomain_disable
 args: 2,1,3
 arg: Str('trustcn', cli_name='trust', query=True, required=True)
@@ -3748,7 +3748,7 @@ arg: Str('cn', attribute=True, cli_name='domain', multivalue=False, primary_key=
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustdomain_enable
 args: 2,1,3
 arg: Str('trustcn', cli_name='trust', query=True, required=True)
@@ -3756,7 +3756,7 @@ arg: Str('cn', attribute=True, cli_name='domain', multivalue=False, primary_key=
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: trustdomain_find
 args: 2,10,4
 arg: Str('trustcn', cli_name='trust', query=True, required=True)
@@ -3792,7 +3792,7 @@ option: StrEnum('trust_type', autofill=True, cli_name='type', default=u'ad', val
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_add
 args: 1,43,3
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, required=True)
@@ -3841,7 +3841,7 @@ option: Password('userpassword', attribute=True, cli_name='password', exclude='w
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_del
 args: 1,2,3
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=True, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
@@ -3849,21 +3849,21 @@ option: Flag('continue', autofill=True, cli_name='continue', default=False)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'dict'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: ListOfPrimaryKeys('value', None, None)
 command: user_disable
 args: 1,1,3
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_enable
 args: 1,1,3
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_find
 args: 1,53,4
 arg: Str('criteria?', noextrawhitespace=False)
@@ -3973,7 +3973,7 @@ option: Password('userpassword', attribute=True, autofill=False, cli_name='passw
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_show
 args: 1,5,3
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
@@ -3984,7 +3984,7 @@ option: Flag('rights', autofill=True, default=False)
 option: Str('version?', exclude='webui')
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 command: user_status
 args: 1,4,4
 arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', primary_key=True, query=True, required=True)
@@ -4002,7 +4002,8 @@ arg: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=Fals
 option: Str('version?', exclude='webui')
 output: Output('result', <type 'bool'>, None)
 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
-output: Output('value', <type 'unicode'>, None)
+output: PrimaryKey('value', None, None)
 capability: messages 2.52
 capability: optional_uid_params 2.54
 capability: permissions2 2.69
+capability: primary_key_types 2.83