Alias "unicode" to "str" under Python 3

The six way of doing this is to replace all occurences of "unicode"
with "six.text_type". However, "unicode" is non-ambiguous and
(arguably) easier to read. Also, using it makes the patches smaller,
which should help with backporting.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>

90 files changed, 394 insertions, 0 deletions

diff --git a/doc/examples/examples.py b/doc/examples/examples.py
index 4ac415f1a..baf3963d6 100644
--- a/doc/examples/examples.py
+++ b/doc/examples/examples.py
@@ -42,6 +42,12 @@ from ipalib import Str
 from ipalib import output
 
 
+# To make the example ready for Python 3, we alias "unicode" to strings.
+import six
+if six.PY3:
+    unicode = str
+
+
 # We're going to create an example command plugin, that takes a name as its
 # only argument. Commands in IPA support input validation by defining
 # functions we're going to call 'validators'. This is an example of such
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
index 9f65b0515..44993b038 100755
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
@@ -35,6 +35,8 @@ import base64
 import contextlib
 import json
 
+import six
+
 from ipapython import ipautil
 from ipapython.dn import DN
 from ipalib import api, errors, pkcs10, x509
@@ -56,6 +58,10 @@ UNCONFIGURED = 4
 WAIT_WITH_DELAY = 5
 OPERATION_NOT_SUPPORTED_BY_HELPER = 6
 
+if six.PY3:
+    unicode = str
+
+
 @contextlib.contextmanager
 def ldap_connect():
     conn = None
diff --git a/install/oddjob/com.redhat.idm.trust-fetch-domains b/install/oddjob/com.redhat.idm.trust-fetch-domains
index 138779c0c..019545b93 100755
--- a/install/oddjob/com.redhat.idm.trust-fetch-domains
+++ b/install/oddjob/com.redhat.idm.trust-fetch-domains
@@ -10,8 +10,13 @@ from ipalib.constants import DEFAULT_CONFIG
 from ipapython.ipautil import kinit_keytab
 import sys
 import os, pwd
+
+import six
 import gssapi
 
+if six.PY3:
+    unicode = str
+
 def retrieve_keytab(api, ccache_name, oneway_keytab_name, oneway_principal):
     getkeytab_args = ["/usr/sbin/ipa-getkeytab",
                       "-s", api.env.host,
diff --git a/install/tools/ipa-adtrust-install b/install/tools/ipa-adtrust-install
index 9ff1ac9be..5bece0d8b 100755
--- a/install/tools/ipa-adtrust-install
+++ b/install/tools/ipa-adtrust-install
@@ -23,6 +23,7 @@
 
 from __future__ import print_function
 
+import six
 import gssapi
 
 from ipaserver.install import adtrustinstance
@@ -36,6 +37,9 @@ from ipaplatform.paths import paths
 from ipapython.ipa_log_manager import *
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 log_file_name = paths.IPASERVER_INSTALL_LOG
 
 def parse_options():
diff --git a/ipa-client/ipaclient/ipachangeconf.py b/ipa-client/ipaclient/ipachangeconf.py
index a1ebb4f63..ef4c98776 100644
--- a/ipa-client/ipaclient/ipachangeconf.py
+++ b/ipa-client/ipaclient/ipachangeconf.py
@@ -24,6 +24,10 @@ import string
 import time
 import shutil
 
+import six
+
+if six.PY3:
+    unicode = str
 
 def openLocked(filename, perms):
     fd = -1
diff --git a/ipalib/cli.py b/ipalib/cli.py
index 206664a88..347d4c788 100644
--- a/ipalib/cli.py
+++ b/ipalib/cli.py
@@ -36,6 +36,9 @@ import traceback
 import six
 from six.moves import input
 
+if six.PY3:
+    unicode = str
+
 try:
     #pylint: disable=F0401
     import default_encoding_utf8
diff --git a/ipalib/config.py b/ipalib/config.py
index 144127467..14368e2b4 100644
--- a/ipalib/config.py
+++ b/ipalib/config.py
@@ -43,6 +43,8 @@ from ipalib.base import check_name
 from ipalib.constants import CONFIG_SECTION
 from ipalib.constants import OVERRIDE_ERROR, SET_ERROR, DEL_ERROR
 
+if six.PY3:
+    unicode = str
 
 class Env(object):
     """
diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index fbada31a8..4c7563a6b 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -25,6 +25,8 @@ import re
 from distutils import version
 from textwrap import wrap
 
+import six
+
 from ipapython.version import API_VERSION
 from ipapython.ipa_log_manager import root_logger
 from ipalib.capabilities import VERSION_WITHOUT_CAPABILITIES
@@ -39,6 +41,8 @@ from ipalib.errors import (ZeroArgumentError, MaxArgumentError, OverlapError,
 from ipalib import messages
 from ipalib.util import json_serialize
 
+if six.PY3:
+    unicode = str
 
 RULE_FLAG = 'validation_rule'
 
diff --git a/ipalib/krb_utils.py b/ipalib/krb_utils.py
index db1cffc1e..a1a96a8c2 100644
--- a/ipalib/krb_utils.py
+++ b/ipalib/krb_utils.py
@@ -18,10 +18,15 @@
 
 import time
 import re
+
+import six
 import gssapi
 
 from ipalib import errors
 
+if six.PY3:
+    unicode = str
+
 #-------------------------------------------------------------------------------
 
 # Kerberos error codes
diff --git a/ipalib/messages.py b/ipalib/messages.py
index da8f740be..375da2443 100644
--- a/ipalib/messages.py
+++ b/ipalib/messages.py
@@ -40,6 +40,8 @@ from ipalib.text import _ as ugettext
 from ipalib.text import Gettext, NGettext
 from ipalib.capabilities import client_has_capability
 
+if six.PY3:
+    unicode = str
 
 def add_message(version, result, message):
     if client_has_capability(version, 'messages'):
diff --git a/ipalib/output.py b/ipalib/output.py
index 68b2bf933..1398a6cb8 100644
--- a/ipalib/output.py
+++ b/ipalib/output.py
@@ -24,10 +24,14 @@ Simple description of return values.
 from inspect import getdoc
 from types import NoneType
 
+import six
+
 from ipalib.plugable import ReadOnly, lock
 from ipalib.capabilities import client_has_capability
 from ipalib.text import _
 
+if six.PY3:
+    unicode = str
 
 class Output(ReadOnly):
     """
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index 5b21cfb23..a03a75d83 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -123,6 +123,9 @@ from ipapython.dnsutil import DNSName
 def _is_null(value):
     return not value and value != 0 # NOTE: False == 0
 
+if six.PY3:
+    unicode = str
+
 class DefaultFrom(ReadOnly):
     """
     Derive a default value from other supplied values.
diff --git a/ipalib/pkcs10.py b/ipalib/pkcs10.py
index 1a544b156..7b0d8f733 100644
--- a/ipalib/pkcs10.py
+++ b/ipalib/pkcs10.py
@@ -25,9 +25,14 @@ import base64
 import nss.nss as nss
 from pyasn1.type import univ, char, namedtype, tag
 from pyasn1.codec.der import decoder
+import six
+
 from ipapython import ipautil
 from ipalib import api
 
+if six.PY3:
+    unicode = str
+
 PEM = 0
 DER = 1
 
diff --git a/ipalib/plugable.py b/ipalib/plugable.py
index 3f65f6736..2a608d8cb 100644
--- a/ipalib/plugable.py
+++ b/ipalib/plugable.py
@@ -36,6 +36,8 @@ import textwrap
 import collections
 import importlib
 
+import six
+
 from ipalib import errors
 from ipalib.config import Env
 from ipalib import text
@@ -45,6 +47,9 @@ from ipalib.constants import DEFAULT_CONFIG
 from ipapython.ipa_log_manager import *
 from ipapython.version import VERSION, API_VERSION
 
+if six.PY3:
+    unicode = str
+
 # FIXME: Updated constants.TYPE_ERROR to use this clearer format from wehjit:
 TYPE_ERROR = '%s: need a %r; got a %r: %r'
 
diff --git a/ipalib/plugins/aci.py b/ipalib/plugins/aci.py
index 5aa486db8..8fe382f38 100644
--- a/ipalib/plugins/aci.py
+++ b/ipalib/plugins/aci.py
@@ -119,6 +119,8 @@ targetattr REPLACES the current attributes, it does not add to them.
 """
 from copy import deepcopy
 
+import six
+
 from ipalib import api, crud, errors
 from ipalib import Object
 from ipalib import Flag, Str, StrEnum, DNParam
@@ -130,6 +132,9 @@ from ipalib.plugins.baseldap import gen_pkey_only_option, pkey_to_value
 from ipapython.ipa_log_manager import *
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 register = Registry()
 
 ACI_NAME_PREFIX_SEP = ":"
diff --git a/ipalib/plugins/automember.py b/ipalib/plugins/automember.py
index 0c2a246e1..a45fab07b 100644
--- a/ipalib/plugins/automember.py
+++ b/ipalib/plugins/automember.py
@@ -20,6 +20,7 @@ import uuid
 import time
 
 import ldap as _ldap
+import six
 
 from ipalib import api, errors, Str, StrEnum, DNParam, _, ngettext
 from ipalib.plugable import Registry
@@ -27,6 +28,9 @@ from ipalib.plugins.baseldap import *
 from ipalib.request import context
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Auto Membership Rule.
 """) + _("""
diff --git a/ipalib/plugins/automount.py b/ipalib/plugins/automount.py
index 304bed71f..a909f6c39 100644
--- a/ipalib/plugins/automount.py
+++ b/ipalib/plugins/automount.py
@@ -20,6 +20,8 @@
 
 import os
 
+import six
+
 from ipalib import api, errors
 from ipalib import Object, Command
 from ipalib import Flag, Str, IA5Str
@@ -27,6 +29,9 @@ from ipalib.plugable import Registry
 from ipalib.plugins.baseldap import *
 from ipalib import _, ngettext
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Automount
 
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 8a375afba..81fae1516 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -38,6 +38,9 @@ from ipalib.capabilities import client_has_capability
 from ipapython.dn import DN, RDN
 from ipapython.version import API_VERSION
 
+if six.PY3:
+    unicode = str
+
 DNA_MAGIC = -1
 
 global_output_params = (
diff --git a/ipalib/plugins/baseuser.py b/ipalib/plugins/baseuser.py
index ed7c1a9d3..b974e3fb1 100644
--- a/ipalib/plugins/baseuser.py
+++ b/ipalib/plugins/baseuser.py
@@ -41,6 +41,9 @@ from ipalib.capabilities import client_has_capability
 from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
     convert_sshpubkey_post)
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Baseuser
 
diff --git a/ipalib/plugins/batch.py b/ipalib/plugins/batch.py
index ddf24839d..7a4cda2a0 100644
--- a/ipalib/plugins/batch.py
+++ b/ipalib/plugins/batch.py
@@ -45,6 +45,8 @@ And then a nested response for each IPA command method sent in the request
 
 """
 
+import six
+
 from ipalib import api, errors
 from ipalib import Command
 from ipalib.parameters import Str, Any
@@ -55,6 +57,9 @@ from ipalib.request import context
 from ipalib.plugable import Registry
 from ipapython.version import API_VERSION
 
+if six.PY3:
+    unicode = str
+
 register = Registry()
 
 @register()
diff --git a/ipalib/plugins/cert.py b/ipalib/plugins/cert.py
index 1fd5fb67f..e4593200e 100644
--- a/ipalib/plugins/cert.py
+++ b/ipalib/plugins/cert.py
@@ -40,10 +40,15 @@ from ipalib.text import _
 from ipalib.request import context
 from ipalib import output
 from ipalib.plugins.service import validate_principal
+
+import six
 import nss.nss as nss
 from nss.error import NSPRError
 from pyasn1.error import PyAsn1Error
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 IPA certificate operations
 
diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py
index be0639b6a..84086f4c7 100644
--- a/ipalib/plugins/dns.py
+++ b/ipalib/plugins/dns.py
@@ -56,6 +56,9 @@ from ipalib.util import (normalize_zonemgr,
 from ipapython.ipautil import CheckedIPAddress, is_host_resolvable
 from ipapython.dnsutil import DNSName
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Domain Name System (DNS)
 """) + _("""
diff --git a/ipalib/plugins/group.py b/ipalib/plugins/group.py
index 8ee20a9a8..64a135e01 100644
--- a/ipalib/plugins/group.py
+++ b/ipalib/plugins/group.py
@@ -28,6 +28,9 @@ from ipalib.plugins.idviews import remove_ipaobject_overrides
 from ipalib.plugins import baseldap
 from ipalib import _, ngettext
 
+if six.PY3:
+    unicode = str
+
 if api.env.in_server and api.env.context in ['lite', 'server']:
     try:
         import ipaserver.dcerpc
diff --git a/ipalib/plugins/hbactest.py b/ipalib/plugins/hbactest.py
index c8dedd367..b528707f7 100644
--- a/ipalib/plugins/hbactest.py
+++ b/ipalib/plugins/hbactest.py
@@ -32,6 +32,10 @@ if api.env.in_server and api.env.context in ['lite', 'server']:
         _dcerpc_bindings_installed = False
 
 import pyhbac
+import six
+
+if six.PY3:
+    unicode = str
 
 __doc__ = _("""
 Simulate use of Host-based access controls
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index 532ff6660..bceab314b 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -21,6 +21,8 @@
 from nss.error import NSPRError
 import string
 
+import six
+
 from ipalib import api, errors, util
 from ipalib import Str, Flag, Bytes
 from ipalib.plugable import Registry
@@ -49,6 +51,9 @@ from ipapython.ssh import SSHPublicKey
 from ipapython.dn import DN
 from functools import reduce
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Hosts/Machines
 
diff --git a/ipalib/plugins/hostgroup.py b/ipalib/plugins/hostgroup.py
index 30d474d80..596290fcd 100644
--- a/ipalib/plugins/hostgroup.py
+++ b/ipalib/plugins/hostgroup.py
@@ -18,6 +18,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
+
 from ipalib.plugable import Registry
 from ipalib.plugins.baseldap import (LDAPObject, LDAPCreate, LDAPRetrieve,
                                      LDAPDelete, LDAPUpdate, LDAPSearch,
@@ -27,6 +29,9 @@ from ipalib import Str, api, _, ngettext, errors
 from ipalib.plugins.netgroup import NETGROUP_PATTERN, NETGROUP_PATTERN_ERRMSG
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Groups of hosts.
 
diff --git a/ipalib/plugins/idrange.py b/ipalib/plugins/idrange.py
index 2cec05bd8..bec07da2e 100644
--- a/ipalib/plugins/idrange.py
+++ b/ipalib/plugins/idrange.py
@@ -17,6 +17,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
+
 from ipalib.plugable import Registry
 from ipalib.plugins.baseldap import (LDAPObject, LDAPCreate, LDAPDelete,
                                      LDAPRetrieve, LDAPSearch, LDAPUpdate)
@@ -24,6 +26,9 @@ from ipalib import api, Int, Str, DeprecatedParam, StrEnum, _, ngettext
 from ipalib import errors
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 if api.env.in_server and api.env.context in ['lite', 'server']:
     try:
         import ipaserver.dcerpc
diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py
index cf5c9b5e8..a910486cd 100644
--- a/ipalib/plugins/idviews.py
+++ b/ipalib/plugins/idviews.py
@@ -19,6 +19,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import re
 
+import six
+
 from ipalib.plugins.baseldap import (LDAPQuery, LDAPObject, LDAPCreate,
                                      LDAPDelete, LDAPUpdate, LDAPSearch,
                                      LDAPRetrieve, global_output_params)
@@ -31,6 +33,9 @@ from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
 
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 _dcerpc_bindings_installed = False
 
 if api.env.in_server and api.env.context in ['lite', 'server']:
diff --git a/ipalib/plugins/migration.py b/ipalib/plugins/migration.py
index 3d8d565e0..3e3c0fe19 100644
--- a/ipalib/plugins/migration.py
+++ b/ipalib/plugins/migration.py
@@ -21,6 +21,8 @@ import re
 from ldap import MOD_ADD
 from ldap import SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE
 
+import six
+
 from ipalib import api, errors, output
 from ipalib import Command, Password, Str, Flag, StrEnum, DNParam, File, Bool
 from ipalib.cli import to_cli
@@ -37,6 +39,9 @@ from ipapython.ipautil import write_tmp_file
 import datetime
 from ipaplatform.paths import paths
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Migration to IPA
 
diff --git a/ipalib/plugins/netgroup.py b/ipalib/plugins/netgroup.py
index e69aaf94a..fe85889de 100644
--- a/ipalib/plugins/netgroup.py
+++ b/ipalib/plugins/netgroup.py
@@ -18,6 +18,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
 
 from ipalib import api, errors
 from ipalib import Str, StrEnum
@@ -26,6 +27,9 @@ from ipalib.plugins.baseldap import *
 from ipalib import _, ngettext
 from ipalib.plugins.hbacrule import is_all
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Netgroups
 
diff --git a/ipalib/plugins/otptoken.py b/ipalib/plugins/otptoken.py
index bb027eea0..651a3ab94 100644
--- a/ipalib/plugins/otptoken.py
+++ b/ipalib/plugins/otptoken.py
@@ -38,6 +38,11 @@ import urlparse
 import qrcode
 import os
 
+import six
+
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 OTP Tokens
 """) + _("""
diff --git a/ipalib/plugins/otptoken_yubikey.py b/ipalib/plugins/otptoken_yubikey.py
index 58fc18308..0cbda1b2e 100644
--- a/ipalib/plugins/otptoken_yubikey.py
+++ b/ipalib/plugins/otptoken_yubikey.py
@@ -27,6 +27,10 @@ import os
 
 import usb.core
 import yubico
+import six
+
+if six.PY3:
+    unicode = str
 
 __doc__ = _("""
 YubiKey Tokens
diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py
index 7a2e14c72..b17b61e69 100644
--- a/ipalib/plugins/permission.py
+++ b/ipalib/plugins/permission.py
@@ -33,6 +33,9 @@ from ipalib.aci import ACI
 from ipapython.dn import DN
 from ipalib.request import context
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Permissions
 """) + _("""
diff --git a/ipalib/plugins/pwpolicy.py b/ipalib/plugins/pwpolicy.py
index 866d57475..5e98d5469 100644
--- a/ipalib/plugins/pwpolicy.py
+++ b/ipalib/plugins/pwpolicy.py
@@ -28,6 +28,11 @@ from ipapython.ipautil import run
 from ipapython.dn import DN
 from distutils import version
 
+import six
+
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Password policy
 
diff --git a/ipalib/plugins/realmdomains.py b/ipalib/plugins/realmdomains.py
index 871ea79c4..f8f838d0e 100644
--- a/ipalib/plugins/realmdomains.py
+++ b/ipalib/plugins/realmdomains.py
@@ -17,6 +17,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
+
 from ipalib import api, errors
 from ipalib import Str, Flag
 from ipalib import _
@@ -26,6 +28,8 @@ from ipalib.util import has_soa_or_ns_record, validate_domain_name
 from ipapython.dn import DN
 from ipapython.ipautil import get_domain_name
 
+if six.PY3:
+    unicode = str
 
 __doc__ = _("""
 Realm domains
diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py
index 39285dd5d..d63e00bea 100644
--- a/ipalib/plugins/service.py
+++ b/ipalib/plugins/service.py
@@ -22,6 +22,7 @@
 import base64
 import os
 
+import six
 
 from ipalib import api, errors, util
 from ipalib import Str, Flag, Bytes, StrEnum, Bool
@@ -34,6 +35,9 @@ import nss.nss as nss
 from nss.error import NSPRError
 from ipapython.ipautil import file_exists
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Services
 
diff --git a/ipalib/plugins/servicedelegation.py b/ipalib/plugins/servicedelegation.py
index 37de91638..2ce11191b 100644
--- a/ipalib/plugins/servicedelegation.py
+++ b/ipalib/plugins/servicedelegation.py
@@ -2,6 +2,8 @@
 # Copyright (C) 2015  FreeIPA Contributors see COPYING for license
 #
 
+import six
+
 from ipalib import api
 from ipalib import Str
 from ipalib.plugable import Registry
@@ -9,6 +11,9 @@ from ipalib.plugins.baseldap import *
 from ipalib.plugins.service import normalize_principal
 from ipalib import _, ngettext
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Service Constrained Delegation
 
diff --git a/ipalib/plugins/stageuser.py b/ipalib/plugins/stageuser.py
index 2a232d1e3..00fba1f83 100644
--- a/ipalib/plugins/stageuser.py
+++ b/ipalib/plugins/stageuser.py
@@ -22,6 +22,9 @@ import string
 import posixpath
 import os
 from copy import deepcopy
+
+import six
+
 from ipalib import api, errors
 from ipalib import (Flag, Int, Password, Str, Bool, StrEnum, DateTime,
                     DeprecatedParam)
@@ -44,6 +47,9 @@ from ipalib.capabilities import client_has_capability
 from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
     convert_sshpubkey_post)
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Stageusers
 
diff --git a/ipalib/plugins/sudorule.py b/ipalib/plugins/sudorule.py
index 6844343e1..c799a3166 100644
--- a/ipalib/plugins/sudorule.py
+++ b/ipalib/plugins/sudorule.py
@@ -18,6 +18,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import netaddr
+import six
 
 from ipalib import api, errors
 from ipalib import Str, StrEnum, Bool, Int
@@ -35,6 +36,9 @@ from ipalib import _, ngettext
 from ipalib.util import validate_hostmask
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Sudo Rules
 """) + _("""
diff --git a/ipalib/plugins/topology.py b/ipalib/plugins/topology.py
index 2723ce121..c6b86b590 100644
--- a/ipalib/plugins/topology.py
+++ b/ipalib/plugins/topology.py
@@ -2,6 +2,8 @@
 # Copyright (C) 2015  FreeIPA Contributors see COPYING for license
 #
 
+import six
+
 from ipalib import api, errors
 from ipalib import Int, Str, Bool, StrEnum, Flag
 from ipalib.plugable import Registry
@@ -13,6 +15,8 @@ from ipalib import output
 from ipalib.util import create_topology_graph, get_topology_connection_errors
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
 
 __doc__ = _("""
 Topology
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index febe16f1d..472f3534e 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -18,6 +18,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
+
 from ipalib.plugable import Registry
 from ipalib.plugins.baseldap import *
 from ipalib.plugins.dns import dns_container_exists
@@ -29,6 +31,9 @@ from ipalib import errors
 from ldap import SCOPE_SUBTREE
 from time import sleep
 
+if six.PY3:
+    unicode = str
+
 try:
     import pysss_murmur #pylint: disable=F0401
     _murmur_installed = True
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index a1e7c8ce7..e7f128a33 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -23,6 +23,8 @@ import string
 import posixpath
 import os
 
+import six
+
 from ipalib import api, errors, util
 from ipalib import Flag, Int, Password, Str, Bool, StrEnum, DateTime
 from ipalib.plugins.baseuser import baseuser, baseuser_add, baseuser_del, \
@@ -48,6 +50,9 @@ from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
 if api.env.in_server:
     from ipaserver.plugins.ldap2 import ldap2
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Users
 
diff --git a/ipalib/rpc.py b/ipalib/rpc.py
index dcbfafe05..4d39503a7 100644
--- a/ipalib/rpc.py
+++ b/ipalib/rpc.py
@@ -72,6 +72,9 @@ from ipapython.dn import DN
 from ipalib.capabilities import VERSION_WITHOUT_CAPABILITIES
 from ipalib import api
 
+if six.PY3:
+    unicode = str
+
 COOKIE_NAME = 'ipa_session'
 KEYRING_COOKIE_NAME = '%s_cookie:%%s' % COOKIE_NAME
 
diff --git a/ipalib/text.py b/ipalib/text.py
index 160213eb8..9afe4d300 100644
--- a/ipalib/text.py
+++ b/ipalib/text.py
@@ -120,6 +120,9 @@ import six
 
 from ipalib.request import context
 
+if six.PY3:
+    unicode = str
+
 
 def create_translation(key):
     assert key not in context.__dict__
diff --git a/ipalib/util.py b/ipalib/util.py
index 5a761fb0f..7c7da6af7 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -46,6 +46,9 @@ from ipapython.dn import DN, RDN
 from ipapython.dnsutil import DNSName
 from ipapython.graph import Graph
 
+if six.PY3:
+    unicode = str
+
 
 def json_serialize(obj):
     if isinstance(obj, (list, tuple)):
diff --git a/ipapython/dn.py b/ipapython/dn.py
index a3b20121a..5a42ab37e 100644
--- a/ipapython/dn.py
+++ b/ipapython/dn.py
@@ -425,6 +425,9 @@ from ldap.dn import str2dn, dn2str
 from ldap import DECODING_ERROR
 import six
 
+if six.PY3:
+    unicode = str
+
 __all__ = 'AVA', 'RDN', 'DN'
 
 def _adjust_indices(start, end, length):
diff --git a/ipapython/dnsutil.py b/ipapython/dnsutil.py
index d190f23c7..7844d7bec 100644
--- a/ipapython/dnsutil.py
+++ b/ipapython/dnsutil.py
@@ -23,6 +23,9 @@ import copy
 
 import six
 
+if six.PY3:
+    unicode = str
+
 
 @six.python_2_unicode_compatible
 class DNSName(dns.name.Name):
diff --git a/ipapython/dogtag.py b/ipapython/dogtag.py
index fe951cf5b..305e10a71 100644
--- a/ipapython/dogtag.py
+++ b/ipapython/dogtag.py
@@ -25,6 +25,7 @@ import ConfigParser
 from urllib import urlencode
 
 import nss.nss as nss
+import six
 
 from ipalib import api, errors
 from ipalib.errors import NetworkError
@@ -33,6 +34,9 @@ from ipapython import nsslib, ipautil
 from ipaplatform.paths import paths
 from ipapython.ipa_log_manager import *
 
+if six.PY3:
+    unicode = str
+
 # IPA can use either Dogtag version 9 or 10.
 #
 # Install tools should use the constants from install_constants, so that they
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index 837d57c3b..9c78dbf69 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -47,6 +47,9 @@ from ipapython.ipa_log_manager import log_mgr
 from ipapython.dn import DN, RDN
 from ipapython.dnsutil import DNSName
 
+if six.PY3:
+    unicode = str
+
 # Global variable to define SASL auth
 SASL_GSSAPI = ldap.sasl.sasl({}, 'GSSAPI')
 
diff --git a/ipapython/ssh.py b/ipapython/ssh.py
index c95488928..c8d8306f2 100644
--- a/ipapython/ssh.py
+++ b/ipapython/ssh.py
@@ -28,6 +28,11 @@ import struct
 from hashlib import md5, sha1
 from hashlib import sha256  #pylint: disable=E0611
 
+import six
+
+if six.PY3:
+    unicode = str
+
 __all__ = ['SSHPublicKey']
 
 OPENSSH_BASE_REGEX = re.compile(r'^[\t ]*(?P<keytype>[^\x00\n\r]+?) [\t ]*(?P<key>[^\x00\n\r]+?)(?:[\t ]+(?P<comment>[^\x00\n\r]*?)[\t ]*)?$')
diff --git a/ipapython/sysrestore.py b/ipapython/sysrestore.py
index 24ddc9a47..8ce8e4b7a 100644
--- a/ipapython/sysrestore.py
+++ b/ipapython/sysrestore.py
@@ -31,10 +31,15 @@ import ConfigParser
 import random
 import string
 
+import six
+
 from ipapython import ipautil
 from ipaplatform.tasks import tasks
 from ipaplatform.paths import paths
 
+if six.PY3:
+    unicode = str
+
 SYSRESTORE_PATH = paths.TMP
 SYSRESTORE_INDEXFILE = "sysrestore.index"
 SYSRESTORE_STATEFILE = "sysrestore.state"
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
index 639f89ff5..77610c6d4 100644
--- a/ipaserver/dcerpc.py
+++ b/ipaserver/dcerpc.py
@@ -55,11 +55,15 @@ from dns import resolver, rdatatype
 from dns.exception import DNSException
 import pysss_nss_idmap
 import pysss
+import six
 from ipaplatform.paths import paths
 
 from ldap.filter import escape_filter_chars
 from time import sleep
 
+if six.PY3:
+    unicode = str
+
 __doc__ = _("""
 Classes to manage trust joins using DCE-RPC calls
 
diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py
index 08b652a10..acc54ab83 100644
--- a/ipaserver/install/adtrustinstance.py
+++ b/ipaserver/install/adtrustinstance.py
@@ -28,6 +28,8 @@ import string
 import struct
 import re
 
+import six
+
 from ipaserver.install import service
 from ipaserver.install import installutils
 from ipaserver.install.bindinstance import get_rr, add_rr, del_rr, \
@@ -45,6 +47,8 @@ from ipaplatform import services
 from ipaplatform.paths import paths
 from ipaplatform.tasks import tasks
 
+if six.PY3:
+    unicode = str
 
 ALLOWED_NETBIOS_CHARS = string.ascii_uppercase + string.digits
 
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index c52b1c0d6..771f13b00 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -48,6 +48,9 @@ from ipalib.util import (validate_zonemgr_str, normalize_zonemgr,
         EDNS0UnsupportedError, UnresolvableRecordError)
 from ipalib.constants import CACERT
 
+if six.PY3:
+    unicode = str
+
 NAMED_CONF = paths.NAMED_CONF
 RESOLV_CONF = paths.RESOLV_CONF
 
diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
index 49a28a7a2..ad79f8896 100644
--- a/ipaserver/install/installutils.py
+++ b/ipaserver/install/installutils.py
@@ -37,6 +37,7 @@ from dns import resolver, rdatatype
 from dns.exception import DNSException
 import ldap
 from nss.error import NSPRError
+import six
 
 import ipaplatform
 
@@ -52,6 +53,9 @@ from ipaplatform import services
 from ipaplatform.paths import paths
 from ipaplatform.tasks import tasks
 
+if six.PY3:
+    unicode = str
+
 # Used to determine install status
 IPA_MODULES = [
     'httpd', 'kadmin', 'dirsrv', 'pki-cad', 'pki-tomcatd', 'install',
diff --git a/ipaserver/install/ipa_ldap_updater.py b/ipaserver/install/ipa_ldap_updater.py
index 062bd5a43..90c09c48f 100644
--- a/ipaserver/install/ipa_ldap_updater.py
+++ b/ipaserver/install/ipa_ldap_updater.py
@@ -28,6 +28,8 @@ from __future__ import print_function
 import os
 import sys
 
+import six
+
 from ipalib import api
 from ipapython import ipautil, admintool
 from ipaplatform.paths import paths
@@ -35,6 +37,9 @@ from ipaserver.install import installutils, dsinstance, schemaupdate
 from ipaserver.install.ldapupdate import LDAPUpdate, UPDATES_DIR, BadSyntax
 from ipaserver.install.upgradeinstance import IPAUpgrade
 
+if six.PY3:
+    unicode = str
+
 
 class LDAPUpdater(admintool.AdminTool):
     command_name = 'ipa-ldap-updater'
diff --git a/ipaserver/install/ipa_otptoken_import.py b/ipaserver/install/ipa_otptoken_import.py
index 130e2ce51..6377c0696 100644
--- a/ipaserver/install/ipa_otptoken_import.py
+++ b/ipaserver/install/ipa_otptoken_import.py
@@ -38,6 +38,9 @@ from ipapython import admintool
 from ipalib import api, errors
 from ipaserver.plugins.ldap2 import ldap2
 
+if six.PY3:
+    unicode = str
+
 
 class ValidationError(Exception):
     pass
diff --git a/ipaserver/install/ipa_winsync_migrate.py b/ipaserver/install/ipa_winsync_migrate.py
index 75d1dbe31..cafec9d18 100644
--- a/ipaserver/install/ipa_winsync_migrate.py
+++ b/ipaserver/install/ipa_winsync_migrate.py
@@ -20,6 +20,8 @@
 import gssapi
 import sys
 
+import six
+
 from ipalib import api
 from ipalib import errors
 from ipapython import admintool
@@ -29,6 +31,9 @@ from ipapython.ipa_log_manager import log_mgr
 from ipaserver.plugins.ldap2 import ldap2
 from ipaserver.install import replication
 
+if six.PY3:
+    unicode = str
+
 DEFAULT_TRUST_VIEW_NAME = u'Default Trust View'
 
 
diff --git a/ipaserver/install/plugins/rename_managed.py b/ipaserver/install/plugins/rename_managed.py
index 4b42d48dc..873c3ddb0 100644
--- a/ipaserver/install/plugins/rename_managed.py
+++ b/ipaserver/install/plugins/rename_managed.py
@@ -17,11 +17,17 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import six
+
 from ipalib import api, errors
 from ipalib import Updater
 from ipapython import ipautil
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
+
 def entry_to_update(entry):
     """
     Convert an entry into a name/value pair list that looks like an update.
diff --git a/ipaserver/install/plugins/update_managed_permissions.py b/ipaserver/install/plugins/update_managed_permissions.py
index 79af64c38..d68e24302 100644
--- a/ipaserver/install/plugins/update_managed_permissions.py
+++ b/ipaserver/install/plugins/update_managed_permissions.py
@@ -83,6 +83,8 @@ No other keys are allowed in the template
 The plugin also deletes permissions specified in OBSOLETE_PERMISSIONS.
 """
 
+import six
+
 from ipalib import api, errors
 from ipapython.dn import DN
 from ipalib.plugable import Registry
@@ -92,6 +94,9 @@ from ipalib.aci import ACI
 from ipalib import Updater
 from ipapython import ipautil
 
+if six.PY3:
+    unicode = str
+
 register = Registry()
 
 OBSOLETE_PERMISSIONS = {
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index 943076c29..dcdfa59d0 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -13,6 +13,8 @@ import sys
 import tempfile
 import textwrap
 
+import six
+
 from ipapython import certmonger, dogtag, ipaldap, ipautil, sysrestore
 from ipapython.dn import DN
 from ipapython.install import common, core
@@ -38,6 +40,9 @@ from ipaserver.install.installutils import (
     update_hosts_file)
 from ipaserver.plugins.ldap2 import ldap2
 
+if six.PY3:
+    unicode = str
+
 try:
     from ipaserver.install import adtrustinstance
     _server_trust_ad_installed = True
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index ed1241bef..571e71b9e 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -12,6 +12,8 @@ import fileinput
 import ConfigParser
 import sys
 
+import six
+
 from ipalib import api
 import SSSDConfig
 import ipalib.util
@@ -39,6 +41,9 @@ from ipaserver.install import dnskeysyncinstance
 from ipaserver.install.upgradeinstance import IPAUpgrade
 from ipaserver.install.ldapupdate import BadSyntax
 
+if six.PY3:
+    unicode = str
+
 
 class KpasswdInstance(service.SimpleServiceInstance):
     def __init__(self):
diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py
index 1b39c148c..1a4bf2eab 100644
--- a/ipaserver/plugins/dogtag.py
+++ b/ipaserver/plugins/dogtag.py
@@ -250,6 +250,7 @@ import pki
 from pki.client import PKIConnection
 import pki.crypto as cryptoutil
 from pki.kra import KRAClient
+import six
 
 from ipalib import Backend
 from ipapython.dn import DN
@@ -258,6 +259,9 @@ import ipapython.dogtag
 from ipapython import ipautil
 from ipaserver.install.certs import CertDB
 
+if six.PY3:
+    unicode = str
+
 # These are general status return values used when
 # CMSServlet.outputError() is invoked.
 CMS_SUCCESS      = 0
diff --git a/ipaserver/plugins/join.py b/ipaserver/plugins/join.py
index 7342117e7..cfa135432 100644
--- a/ipaserver/plugins/join.py
+++ b/ipaserver/plugins/join.py
@@ -21,12 +21,17 @@
 Joining an IPA domain
 """
 
+import six
+
 from ipalib import api
 from ipalib import Command, Str
 from ipalib import errors
 from ipalib import _
 from ipaserver.install import installutils
 
+if six.PY3:
+    unicode = str
+
 
 def validate_host(ugettext, cn):
     """
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
index 3b0fee534..298f8bab1 100644
--- a/ipaserver/rpcserver.py
+++ b/ipaserver/rpcserver.py
@@ -36,6 +36,7 @@ import time
 import ldap.controls
 from pyasn1.type import univ, namedtype
 from pyasn1.codec.ber import encoder
+import six
 
 from ipalib import plugable, errors
 from ipalib.capabilities import VERSION_WITHOUT_CAPABILITIES
@@ -62,6 +63,9 @@ from ipaplatform.paths import paths
 from ipapython.version import VERSION
 from ipalib.text import _
 
+if six.PY3:
+    unicode = str
+
 HTTP_STATUS_SUCCESS = '200 Success'
 HTTP_STATUS_SERVER_ERROR = '500 Internal Server Error'
 
diff --git a/ipatests/test_cmdline/test_cli.py b/ipatests/test_cmdline/test_cli.py
index 1a97608a4..3ad07f7da 100644
--- a/ipatests/test_cmdline/test_cli.py
+++ b/ipatests/test_cmdline/test_cli.py
@@ -4,11 +4,15 @@ import contextlib
 import StringIO
 
 import nose
+import six
 
 from ipatests import util
 from ipalib import api, errors
 from ipapython.version import API_VERSION
 
+if six.PY3:
+    unicode = str
+
 
 class TestCLIParsing(object):
     """Tests that commandlines are correctly parsed to Command keyword args
diff --git a/ipatests/test_cmdline/test_help.py b/ipatests/test_cmdline/test_help.py
index 68684a925..2c0db3288 100644
--- a/ipatests/test_cmdline/test_help.py
+++ b/ipatests/test_cmdline/test_help.py
@@ -22,10 +22,14 @@ import contextlib
 import StringIO
 
 from nose.tools import assert_raises  # pylint: disable=E0611
+import six
 
 from ipalib import api, errors
 from ipalib.plugins.user import user_add
 
+if six.PY3:
+    unicode = str
+
 
 class CLITestContext(object):
     """Context manager that replaces stdout & stderr, and catches SystemExit
diff --git a/ipatests/test_ipalib/test_base.py b/ipatests/test_ipalib/test_base.py
index 265e11858..67a82aa92 100644
--- a/ipatests/test_ipalib/test_base.py
+++ b/ipatests/test_ipalib/test_base.py
@@ -21,11 +21,16 @@
 Test the `ipalib.base` module.
 """
 
+import six
+
 from ipatests.util import ClassChecker, raises
 from ipalib.constants import NAME_REGEX, NAME_ERROR
 from ipalib.constants import TYPE_ERROR, SET_ERROR, DEL_ERROR, OVERRIDE_ERROR
 from ipalib import base
 
+if six.PY3:
+    unicode = str
+
 
 class test_ReadOnly(ClassChecker):
     """
diff --git a/ipatests/test_ipalib/test_errors.py b/ipatests/test_ipalib/test_errors.py
index 831800606..8cc9cd276 100644
--- a/ipatests/test_ipalib/test_errors.py
+++ b/ipatests/test_ipalib/test_errors.py
@@ -27,11 +27,16 @@ Test the `ipalib.errors` module.
 import re
 import inspect
 
+import six
+
 from ipatests.util import assert_equal, raises
 from ipalib import errors, text
 from ipaplatform.paths import paths
 from ipalib.constants import TYPE_ERROR
 
+if six.PY3:
+    unicode = str
+
 
 class PrivateExceptionTester(object):
     _klass = None
diff --git a/ipatests/test_ipalib/test_frontend.py b/ipatests/test_ipalib/test_frontend.py
index c74646dc1..d22718c8b 100644
--- a/ipatests/test_ipalib/test_frontend.py
+++ b/ipatests/test_ipalib/test_frontend.py
@@ -24,6 +24,8 @@ Test the `ipalib.frontend` module.
 # FIXME: Pylint errors
 # pylint: disable=no-member
 
+import six
+
 from ipatests.util import raises, read_only
 from ipatests.util import ClassChecker, create_test_api
 from ipatests.util import assert_equal
@@ -34,6 +36,10 @@ from ipalib import output, messages
 from ipalib.parameters import Str
 from ipapython.version import API_VERSION
 
+if six.PY3:
+    unicode = str
+
+
 def test_RULE_FLAG():
     assert frontend.RULE_FLAG == 'validation_rule'
 
diff --git a/ipatests/test_ipalib/test_parameters.py b/ipatests/test_ipalib/test_parameters.py
index e837bf8ec..6b8fc1d94 100644
--- a/ipatests/test_ipalib/test_parameters.py
+++ b/ipatests/test_ipalib/test_parameters.py
@@ -43,6 +43,9 @@ from ipalib.constants import TYPE_ERROR, CALLABLE_ERROR
 from ipalib.errors import ValidationError, ConversionError
 from ipalib import _
 
+if six.PY3:
+    unicode = str
+
 NULLS = (None, '', u'', tuple(), [])
 
 class test_DefaultFrom(ClassChecker):
diff --git a/ipatests/test_ipalib/test_rpc.py b/ipatests/test_ipalib/test_rpc.py
index 5c130bdc6..710d09832 100644
--- a/ipatests/test_ipalib/test_rpc.py
+++ b/ipatests/test_ipalib/test_rpc.py
@@ -25,6 +25,8 @@ from __future__ import print_function
 from xmlrpclib import Binary, Fault, dumps, loads
 
 import nose
+import six
+
 from ipatests.util import raises, assert_equal, PluginTester, DummyClass
 from ipatests.data import binary_bytes, utf8_bytes, unicode_str
 from ipalib.frontend import Command
@@ -32,6 +34,9 @@ from ipalib.request import context, Connection
 from ipalib import rpc, errors, api, request
 from ipapython.version import API_VERSION
 
+if six.PY3:
+    unicode = str
+
 
 std_compound = (binary_bytes, utf8_bytes, unicode_str)
 
diff --git a/ipatests/test_ipalib/test_text.py b/ipatests/test_ipalib/test_text.py
index c6ab38887..195610d27 100644
--- a/ipatests/test_ipalib/test_text.py
+++ b/ipatests/test_ipalib/test_text.py
@@ -26,8 +26,11 @@ import os
 import shutil
 import tempfile
 import re
+
 import nose
 import locale
+import six
+
 from ipatests.util import raises, assert_equal
 from ipatests.i18n import create_po, po_file_iterate
 from ipalib.request import context
@@ -35,6 +38,9 @@ from ipalib import request
 from ipalib import text
 from ipapython.ipautil import file_exists
 
+if six.PY3:
+    unicode = str
+
 singular = '%(count)d goose makes a %(dish)s'
 plural = '%(count)d geese make a %(dish)s'
 
diff --git a/ipatests/test_ipapython/test_dn.py b/ipatests/test_ipapython/test_dn.py
index 69ccbde8e..14aaeafb5 100644
--- a/ipatests/test_ipapython/test_dn.py
+++ b/ipatests/test_ipapython/test_dn.py
@@ -2,8 +2,13 @@
 
 import unittest
 
+import six
+
 from ipapython.dn import *
 
+if six.PY3:
+    unicode = str
+
 def expected_class(klass, component):
     if klass is AVA:
         if component == 'self':
diff --git a/ipatests/test_ipapython/test_ssh.py b/ipatests/test_ipapython/test_ssh.py
index 913ff8e6b..9826a34c3 100644
--- a/ipatests/test_ipapython/test_ssh.py
+++ b/ipatests/test_ipapython/test_ssh.py
@@ -21,10 +21,16 @@ Test the `ipapython/ssh.py` module.
 """
 
 import base64
+
+import six
 import nose
 
 from ipapython import ssh
 
+if six.PY3:
+    unicode = str
+
+
 def make_public_key_checker(pk, out):
     def check_public_key():
         try:
diff --git a/ipatests/test_ipaserver/test_install/test_adtrustinstance.py b/ipatests/test_ipaserver/test_install/test_adtrustinstance.py
index 9a62f87ce..75e53f35e 100755
--- a/ipatests/test_ipaserver/test_install/test_adtrustinstance.py
+++ b/ipatests/test_ipaserver/test_install/test_adtrustinstance.py
@@ -21,10 +21,15 @@ Test `adtrustinstance`
 """
 
 import os
+
+import six
 import nose
 
 from ipaserver.install import adtrustinstance
 
+if six.PY3:
+    unicode = str
+
 class test_adtrustinstance:
     """
     Test `adtrustinstance`.
diff --git a/ipatests/test_ipaserver/test_ldap.py b/ipatests/test_ipaserver/test_ldap.py
index f50c19a92..c3a9717c5 100644
--- a/ipatests/test_ipaserver/test_ldap.py
+++ b/ipatests/test_ipaserver/test_ldap.py
@@ -32,6 +32,7 @@ import pytest
 import nose
 from nose.tools import assert_raises  # pylint: disable=E0611
 import nss.nss as nss
+import six
 
 from ipaserver.plugins.ldap2 import ldap2
 from ipalib.plugins.service import service, service_show
@@ -41,6 +42,9 @@ from ipapython import ipautil
 from ipaplatform.paths import paths
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 class test_ldap(object):
     """
     Test various LDAP client bind methods.
diff --git a/ipatests/test_ipaserver/test_rpcserver.py b/ipatests/test_ipaserver/test_rpcserver.py
index c77c2d97c..95980eb05 100644
--- a/ipatests/test_ipaserver/test_rpcserver.py
+++ b/ipatests/test_ipaserver/test_rpcserver.py
@@ -23,11 +23,16 @@ Test the `ipaserver.rpc` module.
 
 import json
 
+import six
+
 from ipatests.util import create_test_api, assert_equal, raises, PluginTester
 from ipatests.data import unicode_str
 from ipalib import errors, Command
 from ipaserver import rpcserver
 
+if six.PY3:
+    unicode = str
+
 
 class StartResponse(object):
     def __init__(self):
diff --git a/ipatests/test_util.py b/ipatests/test_util.py
index ba72a25db..a0ee7384e 100644
--- a/ipatests/test_util.py
+++ b/ipatests/test_util.py
@@ -23,9 +23,14 @@ Test the `tests.util` module.
 
 import re
 
+import six
+
 from ipatests import util
 from ipatests.util import raises, TYPE, VALUE, LEN, KEYS
 
+if six.PY3:
+    unicode = str
+
 
 class Prop(object):
     def __init__(self, *ops):
diff --git a/ipatests/test_xmlrpc/test_automount_plugin.py b/ipatests/test_xmlrpc/test_automount_plugin.py
index 952b29eec..dcc79c83c 100644
--- a/ipatests/test_xmlrpc/test_automount_plugin.py
+++ b/ipatests/test_xmlrpc/test_automount_plugin.py
@@ -29,12 +29,16 @@ import shutil
 from ipalib import api
 from ipalib import errors
 from ipapython.dn import DN
+import six
 
 from nose.tools import raises, assert_raises  # pylint: disable=E0611
 from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test, assert_attr_equal
 from ipaplatform.paths import paths
 from ipatests.util import assert_deepequal
 
+if six.PY3:
+    unicode = str
+
 
 class MockTextui(list):
     """Collects output lines"""
diff --git a/ipatests/test_xmlrpc/test_cert_plugin.py b/ipatests/test_xmlrpc/test_cert_plugin.py
index 6c364763a..a593db7f9 100644
--- a/ipatests/test_xmlrpc/test_cert_plugin.py
+++ b/ipatests/test_xmlrpc/test_cert_plugin.py
@@ -31,11 +31,15 @@ from ipalib import errors
 from ipalib import x509
 import tempfile
 from ipapython import ipautil
+import six
 import nose
 import base64
 from ipaplatform.paths import paths
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 # So we can save the cert from issuance and compare it later
 cert = None
 newcert = None
diff --git a/ipatests/test_xmlrpc/test_dns_realmdomains_integration.py b/ipatests/test_xmlrpc/test_dns_realmdomains_integration.py
index a8c224eec..76d4a600b 100644
--- a/ipatests/test_xmlrpc/test_dns_realmdomains_integration.py
+++ b/ipatests/test_xmlrpc/test_dns_realmdomains_integration.py
@@ -22,6 +22,8 @@ Test integration of DNS and realmdomains.
 2. realmdomains_mod should add a _kerberos TXT record in the DNS zone.
 """
 
+import six
+
 from ipalib import api, errors
 from ipalib.util import normalize_zone
 from ipapython.dn import DN
@@ -29,6 +31,9 @@ from ipapython.dnsutil import DNSName
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_digits
 
+if six.PY3:
+    unicode = str
+
 
 cn = u'Realm Domains'
 dn = DN(('cn', cn), ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
diff --git a/ipatests/test_xmlrpc/test_idviews_plugin.py b/ipatests/test_xmlrpc/test_idviews_plugin.py
index 2823082b2..f1a46978b 100644
--- a/ipatests/test_xmlrpc/test_idviews_plugin.py
+++ b/ipatests/test_xmlrpc/test_idviews_plugin.py
@@ -23,6 +23,8 @@ Test the `ipalib.plugins.idviews` module.
 
 import re
 
+import six
+
 from ipalib import api, errors
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, uuid_re, add_oc,
@@ -32,6 +34,9 @@ from ipatests.test_xmlrpc.test_group_plugin import get_group_dn
 from ipatests.util import Fuzzy
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 
 idview1 = u'idview1'
 idview2 = u'idview2'
diff --git a/ipatests/test_xmlrpc/test_radiusproxy_plugin.py b/ipatests/test_xmlrpc/test_radiusproxy_plugin.py
index beb0b8c38..076712777 100644
--- a/ipatests/test_xmlrpc/test_radiusproxy_plugin.py
+++ b/ipatests/test_xmlrpc/test_radiusproxy_plugin.py
@@ -18,12 +18,17 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
+import six
+
 from ipalib import errors, api, _
 from ipapython.dn import DN
 from ipatests.test_xmlrpc.xmlrpc_test import Declarative
 from ipatests.test_xmlrpc.test_user_plugin import get_user_result
 from ipatests.test_xmlrpc import objectclasses
 
+if six.PY3:
+    unicode = str
+
 radius1 = u'testradius'
 radius1_fqdn = u'testradius.test'
 radius1_dn = DN(('cn=testradius'), ('cn=radiusproxy'), api.env.basedn)
diff --git a/ipatests/test_xmlrpc/test_range_plugin.py b/ipatests/test_xmlrpc/test_range_plugin.py
index 143da96fd..29af35306 100644
--- a/ipatests/test_xmlrpc/test_range_plugin.py
+++ b/ipatests/test_xmlrpc/test_range_plugin.py
@@ -21,6 +21,8 @@
 Test the `ipalib/plugins/idrange.py` module, and XML-RPC in general.
 """
 
+import six
+
 from ipalib import api, errors
 from ipatests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid
 from ipatests.test_xmlrpc import objectclasses
@@ -28,6 +30,9 @@ from ipatests.util import MockLDAP
 from ipapython.dn import DN
 from ipatests.test_xmlrpc.test_user_plugin import get_user_result
 
+if six.PY3:
+    unicode = str
+
 # Determine the test shift used
 
 id_shift = 0
diff --git a/ipatests/test_xmlrpc/test_stageuser_plugin.py b/ipatests/test_xmlrpc/test_stageuser_plugin.py
index 515191a45..b09ef6e84 100644
--- a/ipatests/test_xmlrpc/test_stageuser_plugin.py
+++ b/ipatests/test_xmlrpc/test_stageuser_plugin.py
@@ -13,6 +13,8 @@ import re
 import functools
 import pytest
 
+import six
+
 from ipalib import api, errors
 
 from ipatests.test_xmlrpc.ldaptracker import Tracker
@@ -27,6 +29,9 @@ from ipapython.dn import DN
 from ipatests.test_xmlrpc.test_user_plugin import UserTracker, get_user_dn
 from ipatests.test_xmlrpc.test_group_plugin import GroupTracker
 
+if six.PY3:
+    unicode = str
+
 validuser1 = u'tuser1'
 validuser2 = u'tuser2'
 
diff --git a/ipatests/test_xmlrpc/test_sudorule_plugin.py b/ipatests/test_xmlrpc/test_sudorule_plugin.py
index cef0f4518..7d8735c49 100644
--- a/ipatests/test_xmlrpc/test_sudorule_plugin.py
+++ b/ipatests/test_xmlrpc/test_sudorule_plugin.py
@@ -22,11 +22,16 @@ Test the `ipalib/plugins/sudorule.py` module.
 """
 
 from nose.tools import raises, assert_raises  # pylint: disable=E0611
+import six
 
 from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test, assert_attr_equal
 from ipalib import api
 from ipalib import errors
 
+if six.PY3:
+    unicode = str
+
+
 class test_sudorule(XMLRPC_test):
     """
     Test the `sudorule` plugin.
diff --git a/ipatests/test_xmlrpc/test_trust_plugin.py b/ipatests/test_xmlrpc/test_trust_plugin.py
index 5f2de5906..b5f53a78d 100644
--- a/ipatests/test_xmlrpc/test_trust_plugin.py
+++ b/ipatests/test_xmlrpc/test_trust_plugin.py
@@ -21,6 +21,8 @@ Test the `ipalib/plugins/trust.py` module.
 """
 
 import nose
+import six
+
 from ipalib import api, errors
 from ipapython.dn import DN
 from ipatests.test_xmlrpc import objectclasses
@@ -28,6 +30,9 @@ from ipatests.test_xmlrpc.xmlrpc_test import (
     Declarative, fuzzy_guid, fuzzy_domain_sid, fuzzy_string, fuzzy_uuid,
     fuzzy_digits)
 
+if six.PY3:
+    unicode = str
+
 
 trustconfig_ad_config = DN(('cn', api.env.domain),
         api.env.container_cifsdomains, api.env.basedn)
diff --git a/ipatests/test_xmlrpc/testcert.py b/ipatests/test_xmlrpc/testcert.py
index b9a01118d..620879205 100644
--- a/ipatests/test_xmlrpc/testcert.py
+++ b/ipatests/test_xmlrpc/testcert.py
@@ -28,12 +28,17 @@ once per test run.
 import os
 import tempfile
 import shutil
+import six
+
 from ipalib import api, x509
 from ipaserver.plugins import rabase
 from ipapython import ipautil
 from ipaplatform.paths import paths
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 
 def get_testcert(subject, principal):
     """Get the certificate, creating it if it doesn't exist"""
diff --git a/ipatests/util.py b/ipatests/util.py
index 2039095b0..d180c91b7 100644
--- a/ipatests/util.py
+++ b/ipatests/util.py
@@ -38,6 +38,9 @@ from ipalib.plugable import Plugin
 from ipalib.request import context
 from ipapython.dn import DN
 
+if six.PY3:
+    unicode = str
+
 
 class TempDir(object):
     def __init__(self):