diff --git a/ipa-server/ipa-gui/ipagui/controllers.py b/ipa-server/ipa-gui/ipagui/controllers.py
index ad4d31a95..acbc48185 100644
--- a/ipa-server/ipa-gui/ipagui/controllers.py
+++ b/ipa-server/ipa-gui/ipagui/controllers.py
@@ -145,6 +145,12 @@ class Root(controllers.RootController):
                 new_user.setValue('nsAccountLock', 'true')
             else:
                 new_user.setValue('nsAccountLock', None)
+            if kw.get('userpassword'):
+                new_user.setValue('userpassword', kw.get('userpassword'))
+            if kw.get('uidnumber'):
+                new_user.setValue('uidnumber', kw.get('uidnumber'))
+            if kw.get('gidnumber'):
+                new_user.setValue('gidnumber', kw.get('gidnumber'))
 
             #
             # this is a hack until we decide on the policy for names/cn/sn/givenName
diff --git a/ipa-server/ipa-gui/ipagui/forms/user.py b/ipa-server/ipa-gui/ipagui/forms/user.py
index 3c5d8362c..c5478bf8a 100644
--- a/ipa-server/ipa-gui/ipagui/forms/user.py
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py
@@ -77,7 +77,7 @@ class UserEditForm(widgets.Form):
 
     fields = [UserFields.givenname, UserFields.sn, UserFields.mail,
               UserFields.uid_hidden, UserFields.user_orig,
-              UserFields.uidnumber_hidden, UserFields.gidnumber_hidden,
+              UserFields.uidnumber, UserFields.gidnumber,
               UserFields.krbPasswordExpiration_hidden,
               ]
 
diff --git a/ipa-server/ipa-gui/ipagui/static/css/style.css b/ipa-server/ipa-gui/ipagui/static/css/style.css
index 9654ebf15..92379caaa 100644
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css
@@ -149,6 +149,10 @@ body {
 }
 
 .small {
+  font-size: small;
+}
+
+.xsmall {
   font-size: x-small;
 }
 
diff --git a/ipa-server/ipa-gui/ipagui/templates/master.kid b/ipa-server/ipa-gui/ipagui/templates/master.kid
index 3be1f4c09..8abe24bac 100644
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid
@@ -28,7 +28,7 @@
       <div id="logo">
         <a href="${tg.url('/')}"><img 
         src="${tg.url('/static/images/logo.png')}"
-        border="0"
+        border="0" alt="homepage"
         /></a>
       </div>
       <div id="headerinfo">
diff --git a/ipa-server/ipa-gui/ipagui/templates/useredit.kid b/ipa-server/ipa-gui/ipagui/templates/useredit.kid
index 1f31139d1..9e8d8f46f 100644
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid
@@ -6,7 +6,16 @@
 <title>Edit Person</title>
 </head>
 <body>
+
+  <div>
+    <div style="float:right">
+      <input type="checkbox"
+          onclick="toggleProtectedFields(this);">
+        <span class="small">edit protected fields</span>
+      </input>
+    </div>
     <h2>Edit Person</h2>
+  </div>
 
 <?python
 from ipagui.helpers import userhelper
diff --git a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
index 6227c4440..ce92122bf 100644
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
@@ -2,6 +2,26 @@
   class="simpleroster">
   <form action="${action}" name="${name}" method="${method}" class="tableform">
 
+  <script type="text/javascript">
+    function toggleProtectedFields(checkbox) {
+      passwordField = document.getElementById('form_userpassword');
+      passwordConfirmField = document.getElementById('form_userpassword_confirm');
+      uidnumberField = document.getElementById('form_uidnumber');
+      gidnumberField = document.getElementById('form_gidnumber');
+      if (checkbox.checked) {
+        passwordField.disabled = false;
+        passwordConfirmField.disabled = false;
+        uidnumberField.disabled = false;
+        gidnumberField.disabled = false;
+      } else {
+        passwordField.disabled = true;
+        passwordConfirmField.disabled = true;
+        uidnumberField.disabled = true;
+        gidnumberField.disabled = true;
+      }
+    }
+  </script>
+
 
   <div py:for="field in hidden_fields"
     py:replace="field.display(value_for(field), **params_for(field))" 
@@ -57,6 +77,10 @@
           <span py:if="tg.errors.get('userpassword')" class="fielderror"
               py:content="tg.errors.get('userpassword')" />
 
+          <script type="text/javascript">
+              document.getElementById('form_userpassword').disabled = true;
+          </script>
+
           <!-- 
           <span id="password_text">********</span>
           <input id="genpassword_button" type="button" value="Generate Password"
@@ -71,7 +95,7 @@
                 });" />
           <br />
           <input type="checkbox"
-              onclick="togglePassword(this);"><span class="small">edit</span></input>
+              onclick="togglePassword(this);"><span class="xsmall">edit</span></input>
           <script type="text/javascript">
             document.getElementById('form_userpassword').style.display='none';
 
@@ -104,6 +128,10 @@
                value_for(user.userpassword_confirm))" />
           <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
               py:content="tg.errors.get('userpassword_confirm')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_userpassword_confirm').disabled = true;
+          </script>
         </td>
       </tr>
 
@@ -113,7 +141,14 @@
             py:content="user.uidnumber.label" />:
         </th>
         <td>
-          ${value_for(user.uidnumber)}
+          <span py:replace="user.uidnumber.display(
+               value_for(user.uidnumber))" />
+          <span py:if="tg.errors.get('uidnumber')" class="fielderror"
+              py:content="tg.errors.get('uidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_uidnumber').disabled = true;
+          </script>
         </td>
       </tr>
 
@@ -123,7 +158,14 @@
             py:content="user.gidnumber.label" />:
         </th>
         <td>
-          ${value_for(user.gidnumber)}
+          <span py:replace="user.gidnumber.display(
+               value_for(user.gidnumber))" />
+          <span py:if="tg.errors.get('gidnumber')" class="fielderror"
+              py:content="tg.errors.get('gidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_gidnumber').disabled = true;
+          </script>
         </td>
       </tr>
     </table>