methods like user_add post_callback assume that computed attributes like memberof and mepmanagedentry will not be in the entry immediately after the add. When all of the 389 plugins are enabled for backend transaction (betxn), the memberof and mepmanageentry data will be immediately available in the entry after the add/update response is returned. However, it doesn't seem there is a provision in the ipa code - for example, the only way user_add.post_callback will update the user entry is if wait_for_attr is enabled, and this isn't needed with betxn plugins. For example, the following patch makes ipa user-add return the entry with the memberof and mepmanagedentry attributes, with wait_for_attr=False, when 389 has all of the plugins enabled for betxn:

--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -568,6 +568,11 @@ class user_add(LDAPCreate):
                 newentry = wait_for_value(ldap, dn, 'objectclass', 'mepOriginEn
                 entry_from_entry(entry_attrs, newentry)

+        if not self.api.env.wait_for_attr:
+            # have to update memberof, mep data in entry to return
+            (newdn, newentry) = ldap.get_entry(dn, ['*'])
+            entry_attrs.update(newentry)
+
         if options.get('random', False):
             try:
                 entry_attrs['randompassword'] = unicode(getattr(context, 'rando

I don't know if this is the best way to fix the problem - it would probably be better to update only the memberof and mep attributes in entry_attrs, if possible.

There are other places in the code where wait_for_attr is used, and the functions wait_for_memberof and wait_for_value, that should be changed to take advantage of 389 with betxn plugins.