ipatests: adapt expected output with SID

From now on, new users/groups automatically get a SID.
Update the expect test outputs.

Related: https://pagure.io/freeipa/issue/8995
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

ipatests/test_xmlrpc/mock_trust.py

@@ -2,55 +2,10 @@
 #
 # Copyright (C) 2016  FreeIPA Contributors see COPYING for license
 #
-from contextlib import contextmanager
 import six
 
 from ipalib import api
-from ipatests.util import MockLDAP
 
-trust_container_dn = "cn=ad,cn=trusts,{basedn}".format(
-    basedn=api.env.basedn)
-trust_container_add = dict(
-    objectClass=[b"nsContainer", b"top"]
-    )
-
-smb_cont_dn = "{cifsdomains},{basedn}".format(
-    cifsdomains=api.env.container_cifsdomains,
-    basedn=api.env.basedn)
-smb_cont_add = dict(
-    objectClass=[b"nsContainer", b"top"]
-    )
-
-
-def create_mock_trust_containers():
-    with MockLDAP() as ldap:
-        ldap.add_entry(trust_container_dn, trust_container_add)
-        ldap.add_entry(smb_cont_dn, smb_cont_add)
-
-
-def remove_mock_trust_containers():
-    with MockLDAP() as ldap:
-        ldap.del_entry(trust_container_dn)
-        ldap.del_entry(smb_cont_dn)
-
-
-@contextmanager
-def mocked_trust_containers():
-    """Mocked trust containers
-
-    Provides containers for the RPC tests:
-    cn=ad,cn=trusts,BASEDN
-    cn=ad,cn=etc,BASEDN
-
-    Upon exiting, it tries to remove the container entries.
-    If the user of the context manager failed to remove
-    all child entries, exiting the context manager will fail.
-    """
-    create_mock_trust_containers()
-    try:
-        yield
-    finally:
-        remove_mock_trust_containers()
 
 def get_range_dn(name):
     format_str = "cn={name},cn=ranges,cn=etc,{basedn}"

ipatests/test_xmlrpc/objectclasses.py

@@ -35,7 +35,7 @@ user_base = [
     u'ipaSshGroupOfPubKeys',
 ]
 
-user = user_base + [u'mepOriginEntry']
+user = user_base + [u'mepOriginEntry', 'ipantuserattrs',]
 
 group = [
     u'top',
@@ -46,7 +46,7 @@ group = [
 ]
 
 externalgroup = group + [u'ipaexternalgroup']
-posixgroup = group + [u'posixgroup']
+posixgroup = group + [u'posixgroup', 'ipantgroupattrs']
 
 host = [
     u'ipasshhost',

ipatests/test_xmlrpc/test_batch_plugin.py

@@ -25,6 +25,7 @@ from ipalib import api
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.util import Fuzzy, assert_deepequal
 from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, fuzzy_digits,
+                                              fuzzy_set_optional_oc,
                                               fuzzy_uuid)
 from ipapython.dn import DN
 import pytest
@@ -97,7 +98,8 @@ class test_batch(Declarative):
                         result=dict(
                             cn=[group1],
                             description=[u'Test desc 1'],
-                            objectclass=objectclasses.group + [u'posixgroup'],
+                            objectclass=fuzzy_set_optional_oc(
+                                objectclasses.posixgroup, 'ipantgroupattrs'),
                             ipauniqueid=[fuzzy_uuid],
                             gidnumber=[fuzzy_digits],
                             dn=DN(('cn', 'testgroup1'),
@@ -168,7 +170,8 @@ class test_batch(Declarative):
                         result=dict(
                             cn=[group1],
                             description=[u'Test desc 1'],
-                            objectclass=objectclasses.group + [u'posixgroup'],
+                            objectclass=fuzzy_set_optional_oc(
+                                objectclasses.posixgroup, 'ipantgroupattrs'),
                             ipauniqueid=[fuzzy_uuid],
                             gidnumber=[fuzzy_digits],
                             dn=DN(('cn', 'testgroup1'),

ipatests/test_xmlrpc/test_group_plugin.py

@@ -27,7 +27,8 @@ import pytest
 from ipalib import errors
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import (
-    fuzzy_digits, fuzzy_uuid, fuzzy_set_ci, add_oc,
+    fuzzy_digits, fuzzy_uuid, fuzzy_set_ci,
+    fuzzy_user_or_group_sid,
     XMLRPC_test, raises_exact
 )
 from ipatests.test_xmlrpc.tracker.group_plugin import GroupTracker
@@ -61,6 +62,8 @@ def managed_group(request, user):
     tracker.exists = True
     # Managed group gets created when user is created
     tracker.track_create()
+    # Managed groups don't have a SID
+    del tracker.attrs['ipantsecurityidentifier']
     return tracker
 
 
@@ -79,7 +82,7 @@ def user_npg2(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         gidnumber=[u'1000'], description=[], memberof_group=[group.cn],
-        objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+        objectclass=objectclasses.user_base + ['ipantuserattrs']
     )
     return tracker.make_fixture(request)
 
@@ -314,9 +317,9 @@ class TestFindGroup(XMLRPC_test):
                     'gidnumber': [fuzzy_digits],
                     'cn': [u'admins'],
                     'description': [u'Account administrators group'],
-                    'objectclass': fuzzy_set_ci(add_oc(
-                        objectclasses.posixgroup, u'ipantgroupattrs')),
+                    'objectclass': fuzzy_set_ci(objectclasses.posixgroup),
                     'ipauniqueid': [fuzzy_uuid],
+                    'ipantsecurityidentifier': [fuzzy_user_or_group_sid],
                 },
                 {
                     'dn': get_group_dn('editors'),
@@ -324,27 +327,27 @@ class TestFindGroup(XMLRPC_test):
                     'cn': [u'editors'],
                     'description':
                         [u'Limited admins who can edit other users'],
-                    'objectclass': fuzzy_set_ci(add_oc(
-                        objectclasses.posixgroup, u'ipantgroupattrs')),
+                    'objectclass': fuzzy_set_ci(objectclasses.posixgroup),
                     'ipauniqueid': [fuzzy_uuid],
+                    'ipantsecurityidentifier': [fuzzy_user_or_group_sid],
                 },
                 {
                     'dn': get_group_dn(group.cn),
                     'cn': [group.cn],
                     'description': [u'Test desc1'],
                     'gidnumber': [fuzzy_digits],
-                    'objectclass': fuzzy_set_ci(add_oc(
-                        objectclasses.posixgroup, u'ipantgroupattrs')),
+                    'objectclass': fuzzy_set_ci(objectclasses.posixgroup),
                     'ipauniqueid': [fuzzy_uuid],
+                    'ipantsecurityidentifier': [fuzzy_user_or_group_sid],
                 },
                 {
                     'dn': get_group_dn(group2.cn),
                     'cn': [group2.cn],
                     'description': [u'Test desc2'],
                     'gidnumber': [fuzzy_digits],
-                    'objectclass': fuzzy_set_ci(add_oc(
-                        objectclasses.posixgroup, u'ipantgroupattrs')),
+                    'objectclass': fuzzy_set_ci(objectclasses.posixgroup),
                     'ipauniqueid': [fuzzy_uuid],
+                    'ipantsecurityidentifier': [fuzzy_user_or_group_sid],
                 },
             ]), result)
 
@@ -498,6 +501,8 @@ class TestExternalGroup(XMLRPC_test):
         group.track_create()
         del group.attrs['gidnumber']
         group.attrs.update(objectclass=objectclasses.externalgroup)
+        # External group don't have a SID
+        del group.attrs['ipantsecurityidentifier']
         command = group.make_create_command(**dict(external=True))
         result = command()
         group.check_create(result)

ipatests/test_xmlrpc/test_idviews_plugin.py

@@ -27,7 +27,8 @@ import six
 
 from ipalib import api, errors
 from ipatests.test_xmlrpc import objectclasses
-from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, uuid_re, add_oc,
+from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, uuid_re,
+                                              fuzzy_set_optional_oc,
                                               fuzzy_uuid, fuzzy_digits)
 from ipatests.test_xmlrpc.test_user_plugin import get_user_result
 from ipatests.test_xmlrpc.test_group_plugin import get_group_dn
@@ -216,10 +217,7 @@ class test_idviews(Declarative):
                     u'Test',
                     u'User1',
                     'add',
-                    objectclass=add_oc(
-                        objectclasses.user,
-                        u'ipantuserattrs'
-                    )
+                    objectclass=objectclasses.user,
                 ),
             ),
         ),
@@ -237,7 +235,8 @@ class test_idviews(Declarative):
                 result=dict(
                     cn=[idoverridegroup1],
                     description=[u'Test desc 1'],
-                    objectclass=objectclasses.posixgroup,
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
                     dn=get_group_dn(idoverridegroup1),
@@ -1624,10 +1623,7 @@ class test_idviews(Declarative):
                     u'Removed',
                     u'User',
                     'add',
-                    objectclass=add_oc(
-                        objectclasses.user,
-                        u'ipantuserattrs'
-                    )
+                    objectclass=objectclasses.user,
                 ),
             ),
         ),
@@ -1645,7 +1641,8 @@ class test_idviews(Declarative):
                 result=dict(
                     cn=[idoverridegroup_removed],
                     description=[u'Removed group'],
-                    objectclass=objectclasses.posixgroup,
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
                     dn=get_group_dn(idoverridegroup_removed),

ipatests/test_xmlrpc/test_kerberos_principal_aliases.py

@@ -19,7 +19,7 @@ from ipatests.test_xmlrpc.tracker.host_plugin import HostTracker
 from ipatests.test_xmlrpc.tracker.service_plugin import ServiceTracker
 from ipatests.test_xmlrpc.tracker.stageuser_plugin import StageUserTracker
 from ipatests.test_xmlrpc.mock_trust import (
-    mocked_trust_containers, get_trust_dn, get_trusted_dom_dict,
+    get_trust_dn, get_trusted_dom_dict,
     encode_mockldap_value)
 from ipatests.util import unlock_principal_password, change_principal
 
@@ -62,7 +62,7 @@ def trusted_domain():
     trusted_dom = TRUSTED_DOMAIN_MOCK
 
     # Write the changes
-    with mocked_trust_containers(), MockLDAP() as ldap:
+    with MockLDAP() as ldap:
         ldap.add_entry(trusted_dom['dn'], trusted_dom['ldif'])
         yield trusted_dom
         ldap.del_entry(trusted_dom['dn'])
@@ -83,7 +83,7 @@ def trusted_domain_with_suffix():
     )
 
     # Write the changes
-    with mocked_trust_containers(), MockLDAP() as ldap:
+    with MockLDAP() as ldap:
         ldap.add_entry(trusted_dom['dn'], trusted_dom['ldif'])
         yield trusted_dom
         ldap.del_entry(trusted_dom['dn'])

ipatests/test_xmlrpc/test_netgroup_plugin.py

@@ -24,6 +24,7 @@ Test the `ipaserver/plugins/netgroup.py` module.
 from ipalib import api
 from ipalib import errors
 from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, fuzzy_digits,
+                                              fuzzy_set_optional_oc,
                                               fuzzy_uuid, fuzzy_netgroupdn)
 from ipatests.test_xmlrpc import objectclasses
 from ipapython.dn import DN
@@ -300,7 +301,8 @@ class test_netgroup(Declarative):
                     cn=[group1],
                     description=[u'Test desc 1'],
                     gidnumber=[fuzzy_digits],
-                    objectclass=objectclasses.group + [u'posixgroup'],
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     dn=DN(('cn',group1),('cn','groups'),('cn','accounts'),
                           api.env.basedn),

ipatests/test_xmlrpc/test_range_plugin.py

@@ -502,6 +502,8 @@ class test_range(Declarative):
                     user1, u'Test', u'User1', 'add',
                     uidnumber=[unicode(user1_uid)],
                     gidnumber=[unicode(user1_uid)],
+                    objectclass=objectclasses.user_base + [u'mepOriginEntry'],
+                    omit=['ipantsecurityidentifier'],
                 ),
             ),
         ),

ipatests/test_xmlrpc/test_selinuxusermap_plugin.py

@@ -25,6 +25,7 @@ from ipaplatform.constants import constants as platformconstants
 
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, fuzzy_digits,
+                                              fuzzy_set_optional_oc,
                                               fuzzy_uuid)
 from ipapython.dn import DN
 from ipatests.util import Fuzzy
@@ -230,7 +231,8 @@ class test_selinuxusermap(Declarative):
                     cn=[group1],
                     description=[u'Test desc 1'],
                     gidnumber=[fuzzy_digits],
-                    objectclass=objectclasses.group + [u'posixgroup'],
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     dn=DN(('cn', group1), ('cn', 'groups'), ('cn', 'accounts'),
                           api.env.basedn),

ipatests/test_xmlrpc/test_service_plugin.py

@@ -25,6 +25,7 @@ from ipalib import api, errors
 from ipatests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid, fuzzy_hash
 from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_digits, fuzzy_date, fuzzy_issuer
 from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_hex, XMLRPC_test
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_set_optional_oc
 from ipatests.test_xmlrpc.xmlrpc_test import raises_exact
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.testcert import get_testcert, subject_base
@@ -1113,7 +1114,8 @@ class test_service_allowed_to(Declarative):
                 summary=u'Added group "%s"' % group1,
                 result=dict(
                     cn=[group1],
-                    objectclass=objectclasses.group + [u'posixgroup'],
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
                     dn=group1_dn
@@ -1165,7 +1167,8 @@ class test_service_allowed_to(Declarative):
                 summary=u'Added group "%s"' % group2,
                 result=dict(
                     cn=[group2],
-                    objectclass=objectclasses.group + [u'posixgroup'],
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     gidnumber=[fuzzy_digits],
                     dn=group2_dn

ipatests/test_xmlrpc/test_trust_plugin.py

@@ -27,6 +27,7 @@ from ipapython.dn import DN
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import (
     Declarative, fuzzy_guid, fuzzy_domain_sid, fuzzy_string, fuzzy_uuid,
+    fuzzy_set_optional_oc,
     fuzzy_digits)
 import pytest
 
@@ -110,7 +111,8 @@ class test_trustconfig(Declarative):
                     cn=[testgroup],
                     description=[u'Test group'],
                     gidnumber=[fuzzy_digits],
-                    objectclass=objectclasses.group + [u'posixgroup'],
+                    objectclass=fuzzy_set_optional_oc(
+                        objectclasses.posixgroup, 'ipantgroupattrs'),
                     ipauniqueid=[fuzzy_uuid],
                     dn=testgroup_dn,
                 ),

ipatests/test_xmlrpc/test_user_plugin.py

@@ -38,7 +38,8 @@ from ipatests.util import (
     assert_deepequal, assert_equal, assert_not_equal, raises)
 from ipatests.test_xmlrpc.xmlrpc_test import (
     XMLRPC_test, fuzzy_digits, fuzzy_uuid, fuzzy_password,
-    Fuzzy, fuzzy_dergeneralizedtime, add_sid, add_oc, raises_exact)
+    fuzzy_user_or_group_sid,
+    Fuzzy, fuzzy_dergeneralizedtime, raises_exact)
 from ipapython.dn import DN
 from ipapython.ipaldap import ldap_initialize
 
@@ -124,7 +125,7 @@ def user_npg(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         description=[], memberof_group=[group.cn],
-        objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
     )
     return tracker.make_fixture(request)
 
@@ -138,7 +139,7 @@ def user_npg2(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         gidnumber=[u'1000'], description=[], memberof_group=[group.cn],
-        objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
     )
     return tracker.make_fixture(request)
 
@@ -645,7 +646,7 @@ class TestCreate(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+            objectclass=objectclasses.user_base + [u'ipantuserattrs']
         )
         command = testuser.make_create_command()
         result = command()
@@ -659,9 +660,12 @@ class TestCreate(XMLRPC_test):
             name=u'tuser1', givenname=u'Test', sn=u'Tuser1', uidnumber=999
         )
         testuser.track_create()
+        # When uid is outside of IPA id range, no SID is generated
+        del testuser.attrs['ipantsecurityidentifier']
         testuser.attrs.update(
             uidnumber=[u'999'],
-            gidnumber=[u'999']
+            gidnumber=[u'999'],
+            objectclass=objectclasses.user_base + ['mepOriginEntry']
         )
         command = testuser.make_create_command()
         result = command()
@@ -837,7 +841,7 @@ class TestUserWithUPGDisabled(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+            objectclass=objectclasses.user_base + [u'ipantuserattrs'],
         )
         command = testuser.make_create_command()
         result = command()
@@ -860,7 +864,7 @@ class TestUserWithUPGDisabled(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=add_oc(objectclasses.user_base, u'ipantuserattrs')
+            objectclass=objectclasses.user_base + [u'ipantuserattrs'],
         )
         command = testuser.make_create_command()
         result = command()
@@ -1147,7 +1151,7 @@ def get_user_result(uid, givenname, sn, operation='show', omit=[],
     # sn can be None; this should only be used from `get_admin_result`
     cn = overrides.get('cn', ['%s %s' % (givenname, sn or '')])
     cn[0] = cn[0].strip()
-    result = add_sid(dict(
+    result = dict(
         homedirectory=[u'/home/%s' % uid],
         loginshell=[platformconstants.DEFAULT_SHELL],
         uid=[uid],
@@ -1158,7 +1162,7 @@ def get_user_result(uid, givenname, sn, operation='show', omit=[],
         mail=[u'%s@%s' % (uid, api.env.domain)],
         has_keytab=False,
         has_password=False,
-    ))
+    )
     if sn:
         result['sn'] = [sn]
     if givenname:
@@ -1175,9 +1179,10 @@ def get_user_result(uid, givenname, sn, operation='show', omit=[],
             initials=[givenname[0] + (sn or '')[:1]],
             ipauniqueid=[fuzzy_uuid],
             mepmanagedentry=[get_group_dn(uid)],
-            objectclass=add_oc(objectclasses.user, u'ipantuserattrs'),
+            objectclass=objectclasses.user,
             krbprincipalname=[u'%s@%s' % (uid, api.env.realm)],
-            krbcanonicalname=[u'%s@%s' % (uid, api.env.realm)]
+            krbcanonicalname=[u'%s@%s' % (uid, api.env.realm)],
+            ipantsecurityidentifier=[fuzzy_user_or_group_sid],
         )
     if operation in ('show', 'show-all', 'find', 'mod'):
         result.update(

ipatests/test_xmlrpc/tracker/group_plugin.py

@@ -4,6 +4,8 @@
 
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_digits, fuzzy_uuid
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_user_or_group_sid
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_set_optional_oc
 
 from ipatests.test_xmlrpc.tracker.base import Tracker
 from ipatests.util import assert_deepequal, get_group_dn
@@ -21,9 +23,10 @@ class GroupTracker(Tracker):
         'idoverrideuser'
     }
 
-    retrieve_all_keys = retrieve_keys | {u'ipauniqueid', u'objectclass'}
+    retrieve_all_keys = retrieve_keys | {u'ipauniqueid', u'objectclass',
+                                         'ipantsecurityidentifier'}
 
-    create_keys = retrieve_all_keys
+    create_keys = retrieve_all_keys - {u'ipantsecurityidentifier'}
     update_keys = retrieve_keys - {u'dn'}
 
     add_member_keys = retrieve_keys | {u'description'}
@@ -91,7 +94,9 @@ class GroupTracker(Tracker):
             description=[self.description],
             gidnumber=[fuzzy_digits],
             ipauniqueid=[fuzzy_uuid],
-            objectclass=objectclasses.posixgroup,
+            objectclass=fuzzy_set_optional_oc(
+                objectclasses.posixgroup, 'ipantgroupattrs'),
+            ipantsecurityidentifier=[fuzzy_user_or_group_sid],
             )
         self.exists = True
 

ipatests/test_xmlrpc/tracker/user_plugin.py

@@ -11,7 +11,7 @@ import six
 from ipatests.util import assert_deepequal, get_group_dn
 from ipatests.test_xmlrpc import objectclasses
 from ipatests.test_xmlrpc.xmlrpc_test import (
-    fuzzy_digits, fuzzy_uuid, raises_exact)
+    fuzzy_digits, fuzzy_uuid, fuzzy_user_or_group_sid, raises_exact)
 from ipatests.test_xmlrpc.tracker.base import Tracker
 from ipatests.test_xmlrpc.tracker.kerberos_aliases import KerberosAliasMixin
 from ipatests.test_xmlrpc.tracker.certmapdata import CertmapdataMixin
@@ -40,7 +40,8 @@ class UserTracker(CertmapdataMixin, KerberosAliasMixin, Tracker):
         u'l', u'mobile', u'krbextradata', u'krblastpwdchange',
         u'krbpasswordexpiration', u'pager', u'st', u'manager', u'cn',
         u'ipauniqueid', u'objectclass', u'mepmanagedentry',
-        u'displayname', u'gecos', u'initials', u'preserved'}
+        u'displayname', u'gecos', u'initials', u'preserved',
+        'ipantsecurityidentifier'}
 
     retrieve_preserved_keys = (retrieve_keys - {u'memberof_group'}) | {
         u'preserved'}
@@ -122,7 +123,8 @@ class UserTracker(CertmapdataMixin, KerberosAliasMixin, Tracker):
                 api.env.container_deleteuser,
                 api.env.basedn
                 )
-            self.attrs[u'objectclass'] = objectclasses.user_base
+            self.attrs[u'objectclass'] = objectclasses.user_base \
+                + ['ipantuserattrs']
 
         return self.make_command(
             'user_del', self.uid,
@@ -188,6 +190,7 @@ class UserTracker(CertmapdataMixin, KerberosAliasMixin, Tracker):
             mepmanagedentry=[get_group_dn(self.uid)],
             memberof_group=[u'ipausers'],
             nsaccountlock=[u'false'],
+            ipantsecurityidentifier=[fuzzy_user_or_group_sid],
             )
 
         for key in self.kwargs:

ipatests/test_xmlrpc/xmlrpc_test.py

@@ -137,6 +137,12 @@ fuzzy_bytes = Fuzzy(type=bytes)
 def fuzzy_set_ci(s):
     return Fuzzy(test=lambda other: set(x.lower() for x in other) == set(y.lower() for y in s))
 
+
+def fuzzy_set_optional_oc(s, oc):
+    return Fuzzy(test=lambda other: set(x.lower() for x in other if x != oc)
+                 == set(y.lower() for y in s if y != oc))
+
+
 try:
     if not api.Backend.rpcclient.isconnected():
         api.Backend.rpcclient.connect()
@@ -152,12 +158,6 @@ adtrust_is_enabled = api.Command['adtrust_is_enabled']()['result']
 sidgen_was_run = api.Command['sidgen_was_run']()['result']
 
 
-def add_sid(d, check_sidgen=False):
-    if adtrust_is_enabled and (not check_sidgen or sidgen_was_run):
-        d['ipantsecurityidentifier'] = (fuzzy_user_or_group_sid,)
-    return d
-
-
 def add_oc(l, oc, check_sidgen=False):
     if adtrust_is_enabled and (not check_sidgen or sidgen_was_run):
         return l + [oc]