3 files changed, 29 insertions, 0 deletions
diff --git a/ipalib/errors.py b/ipalib/errors.py
index fb82062ab..1c358cd6f 100644
--- a/ipalib/errors.py
+++ b/ipalib/errors.py
@@ -736,6 +736,15 @@ class NoSuchNamespaceError(InvocationError):
     format = _('api has no such namespace: %(name)r')
 
 
+class PasswordMismatch(InvocationError):
+    """
+    **3011** Raise when password and password confirmation don't match.
+    """
+
+    errno = 3011
+    format = _('Passwords do not match')
+
+
 ##############################################################################
 # 4000 - 4999: Execution errors
 
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index bf6588ba3..819a158ff 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -35,6 +35,7 @@ from util import make_repr
 from request import ugettext
 from plugable import ReadOnly, lock, check_name
 from errors import ConversionError, RequirementError, ValidationError
+from errors import PasswordMismatch
 from constants import NULLS, TYPE_ERROR, CALLABLE_ERROR
 import csv
 
@@ -1145,6 +1146,14 @@ class Password(Str):
     A parameter for passwords (stored in the ``unicode`` type).
     """
 
+    def _convert_scalar(self, value, index=None):
+        if isinstance(value, (tuple, list)) and len(value) == 2:
+            (p1, p2) = value
+            if p1 != p2:
+                raise PasswordMismatch(name=self.name, index=index)
+            value = p1
+        return super(Password, self)._convert_scalar(value, index)
+
 
 class Enum(Param):
     """
diff --git a/tests/test_ipalib/test_parameters.py b/tests/test_ipalib/test_parameters.py
index f43fa3227..44286ac07 100644
--- a/tests/test_ipalib/test_parameters.py
+++ b/tests/test_ipalib/test_parameters.py
@@ -1065,6 +1065,17 @@ class test_Password(ClassChecker):
         assert o.pattern is None
         assert o.password is True
 
+    def test_convert_scalar(self):
+        """
+        Test the `ipalib.parameters.Password._convert_scalar` method.
+        """
+        o = self.cls('my_password')
+        e = raises(errors.PasswordMismatch, o._convert_scalar, [u'one', u'two'])
+        assert e.name == 'my_password'
+        assert e.index is None
+        assert o._convert_scalar([u'one', u'one']) == u'one'
+        assert o._convert_scalar(u'one') == u'one'
+
 
 class test_StrEnum(ClassChecker):
     """