Return reason for failure when updating group membership fails.

We used to return a list of dns that failed to be added. We now return
a list of tuples instead. The tuple looks like (dn, reason) where reason
is the exception that was returned.

Also made the label we use for failures to be singular instead of plural
since we now print them out individually instead of as comma-separated.

ticket 270

ipalib/cli.py

@@ -274,7 +274,17 @@ class textui(backend.Backend):
                     self.print_indented(format % (attr, self.encode_binary(v)), indent)
             else:
                 value = map(lambda v: self.encode_binary(v), value)
-                text = ', '.join(value)
+                if len(value) > 0 and type(value[0]) in (list, tuple):
+                    # This is where we print failed add/remove members
+                    for l in value:
+                        text = ': '.join(l)
+                        self.print_indented(format % (attr, self.encode_binary(text)), indent)
+                    return
+                else:
+                    if len(value) > 0:
+                        text = ', '.join(value)
+                    else:
+                        return
                 line_len = self.get_tty_width()
                 if line_len and text:
                     s_indent = '%s%s' % (
@@ -343,6 +353,8 @@ class textui(backend.Backend):
                 label = labels.get(key, key)
                 value = entry[key]
                 if isinstance(value, dict):
+                    if frontend.entry_count(value) == 0:
+                        continue
                     self.print_indented(format % (label, ''), indent)
                     self.print_entry(
                         value, order, labels, print_all, format,