diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index 936757a59..119987b8e 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -448,7 +448,8 @@ class Command(HasParam):
         self.debug(
             '%s(%s)', self.name, ', '.join(self._repr_iter(**params))
         )
-        self.validate(**params)
+        if self.api.env.in_server:
+            self.validate(**params)
         (args, options) = self.params_2_args_options(**params)
         ret = self.run(*args, **options)
         if isinstance(ret, dict):
@@ -686,13 +687,18 @@ class Command(HasParam):
             if param.name in dep:
                 if param.name in kw:
                     # Parameter is specified, convert and validate the value.
-                    kw[param.name] = param(kw[param.name], **kw)
+                    value = param(kw[param.name], **kw)
+                    if self.api.env.in_server:
+                        param.validate(value, supplied=True)
+                    kw[param.name] = value
                 else:
                     # Parameter is not specified, use default value. Convert
                     # and validate the value, it might not be returned so
                     # there's no guarantee it will be converted and validated
                     # later.
                     default = param(None, **kw)
+                    if self.api.env.in_server:
+                        param.validate(default)
                     if default is not None:
                         kw[param.name] = default
                     hasdefault = True
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index 1b35b396a..ccfc204d4 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -572,7 +572,6 @@ class Param(ReadOnly):
             value = self.get_default(**kw)
         else:
             value = self.convert(self.normalize(value))
-        self.validate(value, supplied=self.name in kw)
         return value
 
     def get_param_name(self):
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 4f90291cb..6fd1c394b 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -346,7 +346,12 @@ def add_external_pre_callback(membertype, ldap, dn, keys, options):
         if membertype == 'host':
             validator = validate_host
         else:
-            validator = api.Object[membertype].primary_key
+            param = api.Object[membertype].primary_key
+
+            def validator(value):
+                value = param(value)
+                param.validate(value)
+
         for value in options[membertype]:
             try:
                 validator(value)
@@ -1100,7 +1105,8 @@ last, after all sets and adds."""),
                         raise errors.OnlyOneValueAllowed(attr=attr)
                 # validate, convert and encode params
                 try:
-                   value = param(value)
+                    value = param(value)
+                    param.validate(value)
                 except errors.ValidationError as err:
                     raise errors.ValidationError(name=attr, error=err.error)
                 except errors.ConversionError as err: