diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index 3ee40bf71..57f7dc1cb 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -887,7 +887,8 @@ class LDAPClient(object):
         elif isinstance(val, tuple):
             return tuple(self.encode(m) for m in val)
         elif isinstance(val, dict):
-            dct = dict((self.encode(k), self.encode(v)) for k, v in val.items())
+            # key in dict must be str not bytes
+            dct = dict((k, self.encode(v)) for k, v in val.items())
             return dct
         elif isinstance(val, datetime.datetime):
             return val.strftime(LDAP_GENERALIZED_TIME_FORMAT)