user1 = UserAccount(master, BIND_DN)

# You bind one time to the hub URI with DirSrv object created for master.
# It doedn't change the existing user1 but it creates a clone of master DirSrv
# which is returned (but it becomes a mess of master DirSrv object and
# URI set to hub instance, which doesn't work properly). But you have one time simple bind, yes. 
user1.bind(PASSWORD, uri=hub.get_ldap_uri())
# And you search on the master here. Becuase user1 is still bound to the same master DirSrv object with master URI. You can repeat the line a few times and you will see that the access log on hub doesn't have any additional searches
count = user1.get_attr_val_int('passwordRetryCount')

# Finally check if passwordRetyCount was replicated to the hub and consumer
user1 = UserAccount(hub, BIND_DN)
count = user1.get_attr_val_int('passwordRetryCount')
if count is None:
    log.fatal('PasswordRetyCount was not replicated to hub')
    assert False
if int(count) != 1:
    log.fatal('PasswordRetyCount has unexpected value: {}'.format(count))
    assert False
user1 = UserAccount(consumer, BIND_DN)
count = user1.get_attr_val_int('passwordRetryCount')
if count is None:
    log.fatal('PasswordRetyCount was not replicated to consumer')
    assert False
if int(count) != 1:
    log.fatal('PasswordRetyCount has unexpected value: {}'.format(count))
    assert False