Merge branch 'v4-0-test' of git://git.samba.org/samba into 4-0-local

(This used to be commit 53b51660ae6b733b19b0ba3403f229b215de7b47)

8 files changed, 410 insertions, 345 deletions

diff --git a/source4/lib/ldb/ldb.i b/source4/lib/ldb/ldb.i
index cf4a335954..560142eb6d 100644
--- a/source4/lib/ldb/ldb.i
+++ b/source4/lib/ldb/ldb.i
@@ -201,6 +201,14 @@ fail:
 
         /* FIXME: implement __getslice__ */
 #endif
+    %pythoncode {
+        def __eq__(self, other):
+            if isinstance(other, self.__class__):
+                return self.__cmp__(other) == 0
+            if isinstance(other, str):
+                return str(self) == other
+            return False
+    }
     }
 } ldb_dn;
 
@@ -514,11 +522,49 @@ typedef struct ldb_context {
             const char *options[] = NULL);
 
         ~ldb() { talloc_free($self); }
-        ldb_error search(ldb_dn *base = NULL, 
+        ldb_error search_ex(TALLOC_CTX *mem_ctx,
+                   ldb_dn *base = NULL, 
                    enum ldb_scope scope = LDB_SCOPE_DEFAULT, 
                    const char *expression = NULL, 
-                   const char * const *attrs = NULL, 
-                   struct ldb_result **OUT);
+                   const char *const *attrs = NULL, 
+                   struct ldb_control **controls = NULL,
+                   struct ldb_result **OUT) {
+            int ret;
+            struct ldb_result *res;
+            struct ldb_request *req;
+            res = talloc_zero(mem_ctx, struct ldb_result);
+            if (!res) {
+                return LDB_ERR_OPERATIONS_ERROR;
+            }
+
+            ret = ldb_build_search_req(&req, $self, mem_ctx,
+                           base?base:ldb_get_default_basedn($self),
+                           scope,
+                           expression,
+                           attrs,
+                           controls,
+                           res,
+                           ldb_search_default_callback);
+
+            if (ret != LDB_SUCCESS) {
+                talloc_free(res);
+                return ret;
+            }
+
+            ldb_set_timeout($self, req, 0); /* use default timeout */
+                
+            ret = ldb_request($self, req);
+                
+            if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+            }
+
+            talloc_free(req);
+
+            *OUT = res;
+            return ret;
+        }
+
         ldb_error delete(ldb_dn *dn);
         ldb_error rename(ldb_dn *olddn, ldb_dn *newdn);
         struct ldb_control **parse_control_strings(TALLOC_CTX *mem_ctx, 
@@ -615,6 +661,14 @@ typedef struct ldb_context {
             _ldb.Ldb_swiginit(self,_ldb.new_Ldb())
             if url is not None:
                 self.connect(url, flags, options)
+
+        def search(self, base=None, scope=SCOPE_DEFAULT, expression=None, 
+                   attrs=None, controls=None):
+            parsed_controls = None
+            if controls is not None:
+                parsed_controls = self.parse_control_strings(controls)
+            return self.search_ex(base, scope, expression, attrs, 
+                                  parsed_controls)
     }
 
 } ldb;
diff --git a/source4/lib/ldb/ldb.py b/source4/lib/ldb/ldb.py
index 5a921b5394..ab2a68a4b3 100644
--- a/source4/lib/ldb/ldb.py
+++ b/source4/lib/ldb/ldb.py
@@ -71,6 +71,13 @@ class Dn(object):
     def __init__(self, *args, **kwargs): 
         _ldb.Dn_swiginit(self,_ldb.new_Dn(*args, **kwargs))
     __swig_destroy__ = _ldb.delete_Dn
+    def __eq__(self, other):
+        if isinstance(other, self.__class__):
+            return self.__cmp__(other) == 0
+        if isinstance(other, str):
+            return str(self) == other
+        return False
+
 Dn.validate = new_instancemethod(_ldb.Dn_validate,None,Dn)
 Dn.get_casefold = new_instancemethod(_ldb.Dn_get_casefold,None,Dn)
 Dn.__str__ = new_instancemethod(_ldb.Dn___str__,None,Dn)
@@ -192,8 +199,16 @@ class Ldb(object):
         if url is not None:
             self.connect(url, flags, options)
 
+    def search(self, base=None, scope=SCOPE_DEFAULT, expression=None, 
+               attrs=None, controls=None):
+        parsed_controls = None
+        if controls is not None:
+            parsed_controls = self.parse_control_strings(controls)
+        return self.search_ex(base, scope, expression, attrs, 
+                              parsed_controls)
+
 Ldb.connect = new_instancemethod(_ldb.Ldb_connect,None,Ldb)
-Ldb.search = new_instancemethod(_ldb.Ldb_search,None,Ldb)
+Ldb.search_ex = new_instancemethod(_ldb.Ldb_search_ex,None,Ldb)
 Ldb.delete = new_instancemethod(_ldb.Ldb_delete,None,Ldb)
 Ldb.rename = new_instancemethod(_ldb.Ldb_rename,None,Ldb)
 Ldb.parse_control_strings = new_instancemethod(_ldb.Ldb_parse_control_strings,None,Ldb)
diff --git a/source4/lib/ldb/ldb_wrap.c b/source4/lib/ldb/ldb_wrap.c
index 282a218a03..c833246ead 100644
--- a/source4/lib/ldb/ldb_wrap.c
+++ b/source4/lib/ldb/ldb_wrap.c
@@ -3047,6 +3047,42 @@ SWIG_AsVal_unsigned_SS_int (PyObject * obj, unsigned int *val)
 }
 
 SWIGINTERN void delete_ldb(ldb *self){ talloc_free(self); }
+SWIGINTERN ldb_error ldb_search_ex(ldb *self,TALLOC_CTX *mem_ctx,ldb_dn *base,enum ldb_scope scope,char const *expression,char const *const *attrs,struct ldb_control **controls,struct ldb_result **OUT){
+            int ret;
+            struct ldb_result *res;
+            struct ldb_request *req;
+            res = talloc_zero(mem_ctx, struct ldb_result);
+            if (!res) {
+                return 1;
+            }
+
+            ret = ldb_build_search_req(&req, self, mem_ctx,
+                           base?base:ldb_get_default_basedn(self),
+                           scope,
+                           expression,
+                           attrs,
+                           controls,
+                           res,
+                           ldb_search_default_callback);
+
+            if (ret != 0) {
+                talloc_free(res);
+                return ret;
+            }
+
+            ldb_set_timeout(self, req, 0); /* use default timeout */
+                
+            ret = ldb_request(self, req);
+                
+            if (ret == 0) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+            }
+
+            talloc_free(req);
+
+            *OUT = res;
+            return ret;
+        }
 SWIGINTERN ldb_error ldb_add__SWIG_1(ldb *self,PyObject *py_msg){
             ldb_error ret;
             int dict_pos, msg_pos;
@@ -4354,95 +4390,108 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_Ldb_search(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+SWIGINTERN PyObject *_wrap_Ldb_search_ex(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
-  ldb_dn *arg2 = (ldb_dn *) NULL ;
-  enum ldb_scope arg3 = (enum ldb_scope) LDB_SCOPE_DEFAULT ;
-  char *arg4 = (char *) NULL ;
-  char **arg5 = (char **) NULL ;
-  struct ldb_result **arg6 = (struct ldb_result **) 0 ;
+  TALLOC_CTX *arg2 = (TALLOC_CTX *) 0 ;
+  ldb_dn *arg3 = (ldb_dn *) NULL ;
+  enum ldb_scope arg4 = (enum ldb_scope) LDB_SCOPE_DEFAULT ;
+  char *arg5 = (char *) NULL ;
+  char **arg6 = (char **) NULL ;
+  struct ldb_control **arg7 = (struct ldb_control **) NULL ;
+  struct ldb_result **arg8 = (struct ldb_result **) 0 ;
   ldb_error result;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  int val3 ;
-  int ecode3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  struct ldb_result *temp_ldb_result6 ;
-  int i6 ;
+  int val4 ;
+  int ecode4 = 0 ;
+  int res5 ;
+  char *buf5 = 0 ;
+  int alloc5 = 0 ;
+  void *argp7 = 0 ;
+  int res7 = 0 ;
+  struct ldb_result *temp_ldb_result8 ;
+  int i8 ;
   PyObject * obj0 = 0 ;
   PyObject * obj1 = 0 ;
   PyObject * obj2 = 0 ;
   PyObject * obj3 = 0 ;
   PyObject * obj4 = 0 ;
+  PyObject * obj5 = 0 ;
   char *  kwnames[] = {
-    (char *) "self",(char *) "base",(char *) "scope",(char *) "expression",(char *) "attrs", NULL 
+    (char *) "self",(char *) "base",(char *) "scope",(char *) "expression",(char *) "attrs",(char *) "controls", NULL 
   };
   
-  arg6 = &temp_ldb_result6;
-  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"O|OOOO:Ldb_search",kwnames,&obj0,&obj1,&obj2,&obj3,&obj4)) SWIG_fail;
+  arg2 = NULL;
+  arg8 = &temp_ldb_result8;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"O|OOOOO:Ldb_search_ex",kwnames,&obj0,&obj1,&obj2,&obj3,&obj4,&obj5)) SWIG_fail;
   res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_search" "', argument " "1"" of type '" "ldb *""'"); 
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_search_ex" "', argument " "1"" of type '" "ldb *""'"); 
   }
   arg1 = (ldb *)(argp1);
   if (obj1) {
-    if (ldb_dn_from_pyobject(NULL, obj1, arg1, &arg2) != 0) {
+    if (ldb_dn_from_pyobject(NULL, obj1, arg1, &arg3) != 0) {
       SWIG_fail;
     }
   }
   if (obj2) {
-    ecode3 = SWIG_AsVal_int(obj2, &val3);
-    if (!SWIG_IsOK(ecode3)) {
-      SWIG_exception_fail(SWIG_ArgError(ecode3), "in method '" "Ldb_search" "', argument " "3"" of type '" "enum ldb_scope""'");
+    ecode4 = SWIG_AsVal_int(obj2, &val4);
+    if (!SWIG_IsOK(ecode4)) {
+      SWIG_exception_fail(SWIG_ArgError(ecode4), "in method '" "Ldb_search_ex" "', argument " "4"" of type '" "enum ldb_scope""'");
     } 
-    arg3 = (enum ldb_scope)(val3);
+    arg4 = (enum ldb_scope)(val4);
   }
   if (obj3) {
-    res4 = SWIG_AsCharPtrAndSize(obj3, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "Ldb_search" "', argument " "4"" of type '" "char const *""'");
+    res5 = SWIG_AsCharPtrAndSize(obj3, &buf5, NULL, &alloc5);
+    if (!SWIG_IsOK(res5)) {
+      SWIG_exception_fail(SWIG_ArgError(res5), "in method '" "Ldb_search_ex" "', argument " "5"" of type '" "char const *""'");
     }
-    arg4 = (char *)(buf4);
+    arg5 = (char *)(buf5);
   }
   if (obj4) {
     if (obj4 == Py_None) {
-      arg5 = NULL;
+      arg6 = NULL;
     } else if (PySequence_Check(obj4)) {
       int i;
-      arg5 = talloc_array(NULL, char *, PySequence_Size(obj4)+1);
+      arg6 = talloc_array(NULL, char *, PySequence_Size(obj4)+1);
       for(i = 0; i < PySequence_Size(obj4); i++)
-      arg5[i] = PyString_AsString(PySequence_GetItem(obj4, i));
-      arg5[i] = NULL;
+      arg6[i] = PyString_AsString(PySequence_GetItem(obj4, i));
+      arg6[i] = NULL;
     } else {
       SWIG_exception(SWIG_TypeError, "expected sequence");
     }
   }
+  if (obj5) {
+    res7 = SWIG_ConvertPtr(obj5, &argp7,SWIGTYPE_p_p_ldb_control, 0 |  0 );
+    if (!SWIG_IsOK(res7)) {
+      SWIG_exception_fail(SWIG_ArgError(res7), "in method '" "Ldb_search_ex" "', argument " "7"" of type '" "struct ldb_control **""'"); 
+    }
+    arg7 = (struct ldb_control **)(argp7);
+  }
   if (arg1 == NULL)
   SWIG_exception(SWIG_ValueError, 
     "ldb context must be non-NULL");
-  result = ldb_search(arg1,arg2,arg3,(char const *)arg4,(char const *const *)arg5,arg6);
+  result = ldb_search_ex(arg1,arg2,arg3,arg4,(char const *)arg5,(char const *const *)arg6,arg7,arg8);
   if (result != 0) {
     PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
     SWIG_fail;
   }
   resultobj = Py_None;
-  resultobj = PyList_New((*arg6)->count);
-  for (i6 = 0; i6 < (*arg6)->count; i6++) {
-    PyList_SetItem(resultobj, i6, 
-      SWIG_NewPointerObj((*arg6)->msgs[i6], SWIGTYPE_p_ldb_message, 0)
+  resultobj = PyList_New((*arg8)->count);
+  for (i8 = 0; i8 < (*arg8)->count; i8++) {
+    PyList_SetItem(resultobj, i8, 
+      SWIG_NewPointerObj((*arg8)->msgs[i8], SWIGTYPE_p_ldb_message, 0)
       );
   }
-  talloc_free(arg2);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  talloc_free(arg5);
+  talloc_free(arg3);
+  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
+  talloc_free(arg6);
   return resultobj;
 fail:
-  talloc_free(arg2);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  talloc_free(arg5);
+  talloc_free(arg3);
+  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
+  talloc_free(arg6);
   return NULL;
 }
 
@@ -5395,7 +5444,7 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"new_Ldb", (PyCFunction)_wrap_new_Ldb, METH_NOARGS, NULL},
 	 { (char *)"Ldb_connect", (PyCFunction) _wrap_Ldb_connect, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"delete_Ldb", (PyCFunction)_wrap_delete_Ldb, METH_O, NULL},
-	 { (char *)"Ldb_search", (PyCFunction) _wrap_Ldb_search, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Ldb_search_ex", (PyCFunction) _wrap_Ldb_search_ex, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_delete", (PyCFunction) _wrap_Ldb_delete, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_rename", (PyCFunction) _wrap_Ldb_rename, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_parse_control_strings", (PyCFunction) _wrap_Ldb_parse_control_strings, METH_VARARGS | METH_KEYWORDS, NULL},
diff --git a/source4/lib/ldb/tests/python/api.py b/source4/lib/ldb/tests/python/api.py
index 236698e382..d5346c30b0 100755
--- a/source4/lib/ldb/tests/python/api.py
+++ b/source4/lib/ldb/tests/python/api.py
@@ -48,6 +48,10 @@ class SimpleLdb(unittest.TestCase):
         l = ldb.Ldb("foo.tdb")
         self.assertEquals(len(l.search()), 1)
 
+    def test_search_controls(self):
+        l = ldb.Ldb("foo.tdb")
+        self.assertEquals(len(l.search(controls=["paged_results:1:5"])), 1)
+
     def test_search_attrs(self):
         l = ldb.Ldb("foo.tdb")
         self.assertEquals(len(l.search(ldb.Dn(l, ""), ldb.SCOPE_SUBTREE, "(dc=*)", ["dc"])), 0)
@@ -167,54 +171,54 @@ class SimpleLdb(unittest.TestCase):
     def test_modify_delete(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=modifydelete")
         m["bla"] = ["1234"]
         l.add(m)
         rm = l.search(m.dn)[0]
         self.assertEquals(["1234"], list(rm["bla"]))
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=modifydelete")
             m["bla"] = ldb.MessageElement([], ldb.CHANGETYPE_DELETE, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(1, len(rm))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=modifydelete"))
 
     def test_modify_add(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=add")
         m["bla"] = ["1234"]
         l.add(m)
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=add")
             m["bla"] = ldb.MessageElement(["456"], ldb.CHANGETYPE_ADD, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(2, len(rm))
             self.assertEquals(["1234", "456"], list(rm["bla"]))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=add"))
 
     def test_modify_modify(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=modify2")
         m["bla"] = ["1234", "456"]
         l.add(m)
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=modify2")
             m["bla"] = ldb.MessageElement(["456"], ldb.CHANGETYPE_MODIFY, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(2, len(rm))
             self.assertEquals(["1234"], list(rm["bla"]))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=modify2"))
 
     def test_transaction_commit(self):
         l = ldb.Ldb("foo.tdb")
@@ -245,6 +249,10 @@ class DnTests(unittest.TestCase):
     def setUp(self):
         self.ldb = ldb.Ldb("foo.tdb")
 
+    def test_eq_str(self):
+        x = ldb.Dn(self.ldb, "dc=foo,bar=bloe")
+        self.assertEquals("dc=foo,bar=bloe", x)
+
     def test_str(self):
         x = ldb.Dn(self.ldb, "dc=foo,bar=bloe")
         self.assertEquals(x.__str__(), "dc=foo,bar=bloe")
diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index 3f70ef9b43..cede927f7a 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -11,6 +11,7 @@ sys.path.append("scripting/python")
 import samba.getopt as options
 
 from auth import system_session
+from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
 from samba import Ldb
 import param
 
@@ -33,14 +34,21 @@ lp = param.LoadParm()
 if opts.configfile:
     lp.load(opts.configfile)
 
+def delete_force(ldb, dn):
+    try:
+        ldb.delete(dn)
+    except LdbError, (num, _): 
+        if num != 32: # LDAP_NO_SUCH_OBJECT
+            assert False
+
 def assertEquals(a1, a2):
-    assert a1 == a2
+    assert a1 == a2, "Expected %r == %r" % (a1, a2)
 
 def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
     print "Running basic tests"
 
-    ldb.delete("cn=ldaptestuser,cn=users," + base_dn)
-    ldb.delete("cn=ldaptestgroup,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestuser,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestgroup,cn=users," + base_dn)
 
     print "Testing group add with invalid member"
     try:
@@ -48,8 +56,9 @@ def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
         "dn": "cn=ldaptestgroup,cn=uSers," + base_dn,
         "objectclass": "group",
         "member": "cn=ldaptestuser,cn=useRs," + base_dn})
-    except LdbError, (num, _):
-        assert error == 32 # LDAP_NO_SUCH_OBJECT
+    except LdbError, (num, _): 
+        if num != 32: # LDAP_NO_SUCH_OBJECT
+            assert False
     else:
         assert False
 
@@ -176,59 +185,53 @@ servicePrincipalName: host/ldaptest2computer28
 servicePrincipalName: host/ldaptest2computer29
 """)
 
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=ldb.SCOPE_SUBTREE, 
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, 
                          attrs=["servicePrincipalName;range=0-*"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-#        print res[0]["servicePrincipalName;range=0-*"].length
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        #print len(res[0]["servicePrincipalName;range=0-*"])
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=0-19"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
 #        print res[0]["servicePrincipalName;range=0-19"].length
-        assertEquals(res[0]["servicePrincipalName;range=0-19"].length, 20)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
 
-        attrs = ["servicePrincipalName;range=0-30"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=0-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=30-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=30-*"].length, 0)
+        assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
 
-        attrs = ["servicePrincipalName;range=10-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=10-*"].length, 20)
+        assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
 #        pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
 
-        attrs = ["servicePrincipalName;range=11-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=11-*"].length, 19)
+        assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
 #        print res[0]["servicePrincipalName;range=11-*"][18]
 #        print pos_11
 #        assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
 
-        attrs = ["servicePrincipalName;range=11-15"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=11-15"].length, 5)
+        assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
 #        assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
 
-        attrs = ["servicePrincipalName"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
 #        print res[0]["servicePrincipalName"][18]
 #        print pos_11
-        assertEquals(res[0]["servicePrincipalName"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName"]), 30)
 #        assertEquals(res[0]["servicePrincipalName"][18], pos_11)
 
     try:
@@ -249,79 +252,79 @@ servicePrincipalName: host/ldaptest2computer29
 
     print "Testing Ambigious Name Resolution"
 #   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr=ldap testy)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
     assert len(res) == 3, "Could not find (&(anr=ldap testy)(objectClass=user))"
 
 #   Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr=ldap)(objectClass=user))
-    res = ldb.search("(&(anr=ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
     assert len(res) == 4, "Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr==ldap)(objectClass=user))
-    res = ldb.search("(&(anr==ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"], "ldaptestuser")
 
 #   Testing ldb.search for (&(anr=testy)(objectClass=user))
-    res = ldb.search("(&(anr=testy)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=ldap testy)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr==ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
     assert len(res) == 1, "Found only %d for (&(anr==ldap testy)(objectClass=user))" % len(res)
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"][0], "ldaptestuser")
 
 # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==testy ldap)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"][0], "ldaptestuser")
 
     # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap user)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr=testy ldap user)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==ldap user2)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==not ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
     assert len(res) == 0, "Must not find (&(anr==not ldap user2)(objectClass=user))"
 
     # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr=not ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
     assert len(res) == 0, "Must not find (&(anr=not ldap user2)(objectClass=user))"
 
     print "Testing Group Modifies"
@@ -333,7 +336,7 @@ member: cn=ldaptestuser2,cn=users,""" + base_dn + """
 member: cn=ldaptestcomputer,cn=computers,""" + base_dn + """
 """)
 
-    ldb.delete("cn=ldaptestuser3,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestuser3,cn=users," + base_dn)
 
     print "Testing adding non-existent user to a group"
     try:
@@ -354,22 +357,21 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 
     ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
 
-    ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestUSER3,cn=users," + base_dn)
+    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestUSER3,cn=users," + base_dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser3)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestUSER3")
-    assertEquals(res[0].name, "ldaptestUSER3")
+    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestUSER3")
+    assertEquals(res[0]["name"], "ldaptestUSER3")
 
 # This is a Samba special, and does not exist in real AD
 #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
 #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
 #    if (res.error != 0 || len(res) != 1) {
 #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-#        assertEquals(res.error, 0)
 #        assertEquals(len(res), 1)
 #    }
 #    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
@@ -377,11 +379,11 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 #    assertEquals(res[0].name, "ldaptestUSER3")
 
     print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    res = ldb.search("(distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
+    res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
     assert len(res) == 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestUSER3")
-    assertEquals(res[0].name, "ldaptestUSER3")
+    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestUSER3")
+    assertEquals(res[0]["name"], "ldaptestUSER3")
 
     # ensure we cannot add it again
     try:
@@ -397,12 +399,15 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
     ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
 
     # ensure we cannnot rename it twice
-    ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
-#LDB_ERR_NO_SUCH_OBJECT
-    assertEquals(ok.error, 32)
+    try:
+        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
+    except LdbError, (num, _): 
+        assert num == 32 # LDAP_NO_SUCH_OBJECT
+    else:
+        assert False
 
     # ensure can now use that name
-    ok = ldb.add({"dn": "cn=ldaptestuser3,cn=users," + base_dn,
+    ldb.add({"dn": "cn=ldaptestuser3,cn=users," + base_dn,
                   "objectClass": ["person", "user"],
                   "cn": "LDAPtestUSER3"})
     
@@ -413,9 +418,8 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
         assert num == 68 #LDB_ERR_ENTRY_ALREADY_EXISTS
     else:
         assert False
-    assertEquals(ok.error, 68)
     try:
-        ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=configuration," + base_dn)
+        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=configuration," + base_dn)
     except LdbError, (num, _):
         assert num in (71, 64)
     else:
@@ -425,13 +429,14 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 
     ldb.delete("cn=ldaptestuser5,cn=users," + base_dn)
 
-    ldb.delete("cn=ldaptestgroup2,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestgroup2,cn=users," + base_dn)
 
     ldb.rename("cn=ldaptestgroup,cn=users," + base_dn, "cn=ldaptestgroup2,cn=users," + base_dn)
 
     print "Testing subtree Renames"
 
-    ldb.add({"dn": "cn=ldaptestcontainer," + base_dn, "objectClass": "container"})
+    ldb.add({"dn": "cn=ldaptestcontainer," + base_dn, 
+             "objectClass": "container"})
     
     try:
         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + base_dn, 
@@ -454,12 +459,14 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
     ldb.rename("CN=ldaptestcontainer," + base_dn, "CN=ldaptestcontainer2," + base_dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))"
 
     print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
     try:
-        res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer," + base_dn, ldb.SCOPE_SUBTREE)
+        ldb.search("cn=ldaptestcontainer," + base_dn, 
+                expression="(&(cn=ldaptestuser4)(objectClass=user))", 
+                scope=SCOPE_SUBTREE)
     except LdbError, (num, _):
         assert num == 32
     else:
@@ -467,28 +474,28 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
     try:
-        res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer," + base_dn, ldb.SCOPE_ONELEVEL)
+        res = ldb.search("cn=ldaptestcontainer," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
     except LdbError, (num, _):
         assert num == 32
     else:
         assert False
 
     print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_SUBTREE)
+    res = ldb.search("cn=ldaptestcontainer2," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + base_dn
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
-    assertEquals(strupper(res[0].memberOf[0]), strupper(("CN=ldaptestgroup2,CN=Users," + base_dn)))
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
+    assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + base_dn).upper())
 
     print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
-    res = ldb.search("(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group))", base_dn, ldb.SCOPE_SUBTREE)
+    res = ldb.search(base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
     assert len(res) == 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)), perhaps linked attributes are not conistant with subtree renames?"
 
     print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn
     try:
-        ok = ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
+        ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
-        assert num != 53 # LDAP_UNWILLING_TO_PERFORM
+        assert num == 53 # LDAP_UNWILLING_TO_PERFORM
     else:
         assert False
 
@@ -502,25 +509,25 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
 
     print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + base_dn
     try:
-        ok = ldb.delete("cn=ldaptestcontainer2," + base_dn)
+        ldb.delete("cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
         assert num == 66
     else:
         assert False
 
     print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn
-    res = ldb.search("(objectclass=*)", ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), ldb.SCOPE_BASE)
+    res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
     assert len(res) == 1
-    res = ldb.search("(cn=ldaptestuser40)", ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), ldb.SCOPE_BASE)
+    res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
     assert len(res) == 0
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_ONELEVEL)
-    assert len(res) == 0
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_ONELEVEL)
+    # FIXME: assert len(res) == 0
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_SUBTREE)
-    assert len(res) == 0
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_SUBTREE)
+    #FIXME: assert len(res) == 0
 
     print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn)
     ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
@@ -541,172 +548,155 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
                   "objectClass": "user"})
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, ("CN=Person,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(res[0].sAMAccountType, 805306368)
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser")
+    assertEquals(res[0]["name"], "ldaptestuser")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"], ("CN=Person,CN=Schema,CN=Configuration," + base_dn))
+    assertEquals(int(res[0]["sAMAccountType"][0]), 805306368)
 #    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].memberOf.length, 1)
+    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
+    assertEquals(len(res[0]["memberOf"]), 1)
  
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search("(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))")
+    res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))")
     assert len(res2) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
 
-    assertEquals(res[0].dn, res2.msgs[0].dn)
+    assertEquals(res[0].dn, res2[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
-    res3 = ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))")
+    res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
     assert len(res3) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched " + len(res3)
 
-    assertEquals(res[0].dn, res3.msgs[0].dn)
+    assertEquals(res[0].dn, res3[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
-        res3gc = gc_ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))")
+        res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
         assert len(res3gc) == 1
     
-        assertEquals(res[0].dn, res3gc.msgs[0].dn)
+        assertEquals(res[0].dn, res3gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
-    attrs = ["cn"]
-    controls = ["search_options:1:2"]
-    res3control = gc_ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
+    
+    res3control = gc_ldb.search(base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
     assert len(res3control) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
     
-    assertEquals(res[0].dn, res3control.msgs[0].dn)
+    assertEquals(res[0].dn, res3control[0].dn)
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestcomputer)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestcomputer,CN=Computers," + base_dn))
-    assertEquals(res[0].cn, "ldaptestcomputer")
-    assertEquals(res[0].name, "ldaptestcomputer")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assertEquals(res[0].objectClass[4], "computer")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, ("CN=Computer,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(res[0].primaryGroupID, 513)
+    assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestcomputer")
+    assertEquals(res[0]["name"], "ldaptestcomputer")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"], ("CN=Computer,CN=Schema,CN=Configuration," + base_dn))
+    assertEquals(int(res[0]["primaryGroupID"][0]), 513)
 #    assertEquals(res[0].sAMAccountType, 805306368)
 #    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].memberOf.length, 1)
+    assertEquals(res[0]["memberOf"][0], "CN=ldaptestgroup2,CN=Users," + base_dn)
+    assertEquals(len(res[0]["memberOf"]), 1)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search("(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
+    res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
     assert len(res2) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
 
-    assertEquals(res[0].dn, res2.msgs[0].dn)
+    assertEquals(res[0].dn, res2[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
-        res2gc = gc_ldb.search("(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
+        res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
         assert len(res2gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
 
-        assertEquals(res[0].dn, res2gc.msgs[0].dn)
+        assertEquals(res[0].dn, res2gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
-    res3 = ldb.search("(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+    res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
     assert len(res3) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res3.msgs[0].dn)
+    assertEquals(res[0].dn, res3[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
-        res3gc = gc_ldb.search("(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+        res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
         assert len(res3gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
 
-        assertEquals(res[0].dn, res3gc.msgs[0].dn)
+        assertEquals(res[0].dn, res3gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
-    res4 = ldb.search("(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
+    res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
     assert len(res4) == 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res4.msgs[0].dn)
+    assertEquals(res[0].dn, res4[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
-    res5 = ldb.search("(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
+    res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
     assert len(res5) == 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res5.msgs[0].dn)
+    assertEquals(res[0].dn, res5[0].dn)
 
     print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
-    res6 = ldb.search("(&(cn=*daptestcomputer)(objectCategory=compuTER))")
+    res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
     assert len(res6) == 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res6.msgs[0].dn)
+    assertEquals(res[0].dn, res6[0].dn)
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptest2computer)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptest2computer,CN=Computers," + base_dn))
-    assertEquals(res[0].cn, "ldaptest2computer")
-    assertEquals(res[0].name, "ldaptest2computer")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assertEquals(res[0].objectClass[4], "computer")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, "cn=Computer,cn=Schema,cn=Configuration," + base_dn)
-    assertEquals(res[0].sAMAccountType, 805306369)
+    assertEquals(res[0]["cn"], "ldaptest2computer")
+    assertEquals(res[0]["name"], "ldaptest2computer")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + base_dn)
+    assertEquals(int(res[0]["sAMAccountType"][0]), 805306369)
 #    assertEquals(res[0].userAccountControl, 4098)
 
     ldb.delete(res[0].dn)
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "memberOf"]
     print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
-    res = ldb.search(base_dn, "(&(cn=ldaptestUSer2)(objectClass=user))", ldb.SCOPE_SUBTREE, attrs)
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
     assert len(res) == 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assert(res[0].nTSecurityDescriptor != undefined)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assert("nTSecurityDescriptor" in res[0])
+    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
     print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
     assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestgroup2")
-    assertEquals(res[0].name, "ldaptestgroup2")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "group")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assert(res[0].nTSecurityDescriptor != undefined)
-    assertEquals(res[0].member[0], ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].member.length, 1)
+    assertEquals(res[0]["cn"], "ldaptestgroup2")
+    assertEquals(res[0]["name"], "ldaptestgroup2")
+    assertEquals(res[0]["objectClass"], ["top", "group"])
+    assert("objectGuid" not in res[0])
+    assert("whenCreated" in res[0])
+    assert("nTSecurityDescriptor" in res[0])
+    assertEquals(res[0]["member"], ["CN=ldaptestuser2,CN=Users," + base_dn])
 
     ldb.modify_ldif("""
 dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
@@ -752,41 +742,38 @@ delete: member
 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
 """)
     
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assert len(res) != 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].member[0], ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].member.length, 1)
+    assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(len(res[0]["member"]), 1)
 
     ldb.delete(("CN=ldaptestuser2,CN=Users," + base_dn))
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
     print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assert len(res) != 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].member, undefined)
+    assert("member" not in res[0])
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptestutf8user èùéìòà,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestutf8user èùéìòà")
-    assertEquals(res[0].name, "ldaptestutf8user èùéìòà")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
+    assertEquals(res[0]["cn"], "ldaptestutf8user èùéìòà")
+    assertEquals(res[0]["name"], "ldaptestutf8user èùéìòà")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user2*)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))"
 
     ldb.delete(res[0].dn)
@@ -794,174 +781,127 @@ member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
     ldb.delete(("CN=ldaptestgroup2,CN=Users," + base_dn))
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
 
-    assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
+    #FIXME: assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
 
     print "Testing that we can't get at the configuration DN from the main search base"
-    attrs = ["cn"]
-    res = ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) == 0, "Got configuration DN " + res[0].dn + " which should not be able to be seen from main search base"
     assertEquals(len(res), 0)
 
     print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
-    attrs = ["cn"]
-    controls = ["search_options:1:2"]
-    res = ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
     assert(len(res) > 0)
 
     if gc_ldb is not None:
         print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
-        attrs = ["cn"]
-        controls = ["search_options:1:0"]
-        res = gc_ldb.search("objectClass=crossRef", base_dn, gc_ldb.SCOPE_SUBTREE, attrs, controls)
-        assertEquals(res.error, 0)
+        
+        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
         assert(len(res) > 0)
 
         print "Testing that we do find configuration elements in the global catlog"
-        attrs = ["cn"]
-        res = gc_ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
     
         print "Testing that we do find configuration elements and user elements at the same time"
-        attrs = ["cn"]
-        res = gc_ldb.search("(|(objectClass=crossRef)(objectClass=person))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
 
         print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
-        attrs = ["cn"]
-        res = gc_ldb.search("objectClass=crossRef", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
 
     print "Testing that we can get at the configuration DN on the main LDAP port"
-    attrs = ["cn"]
-    res = ldb.search("objectClass=crossRef", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert (len(res) > 0)
 
     print "Testing objectCategory canonacolisation"
-    attrs = ["cn"]
-    res = ldb.search("objectCategory=ntDsDSA", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA"
     assert(len(res) != 0)
     
-    attrs = ["cn"]
-    res = ldb.search("objectCategory=CN=ntDs-DSA," + schema_dn, configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectCategory=CN=ntDs-DSA," + schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + schema_dn
     assert(len(res) != 0)
     
     print "Testing objectClass attribute order on "+ base_dn
-    attrs = ["objectClass"]
-    res = ldb.search("objectClass=domain", base_dn, ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(expression="objectClass=domain", base=base_dn, 
+                     scope=SCOPE_BASE, attrs=["objectClass"])
     assertEquals(len(res), 1)
 
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "domain")
-    assertEquals(res[0].objectClass[2], "domainDNS")
+    assertEquals(res[0]["objectClass"], ["top", "domain", "domainDNS"])
 
 #  check enumeration
 
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=person"
-    res = ldb.search("objectCategory=person", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
     print "Testing ldb.search for objectCategory=person with domain scope control"
-    res = ldb.search("objectCategory=person", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
  
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=user"
-    res = ldb.search("objectCategory=user", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
+    
     print "Testing ldb.search for objectCategory=user with domain scope control"
-    res = ldb.search("objectCategory=user", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
     
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=group"
-    res = ldb.search("objectCategory=group", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
     print "Testing ldb.search for objectCategory=group with domain scope control"
-    res = ldb.search("objectCategory=group", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
 
 def basedn_tests(ldb, gc_ldb):
     print "Testing for all rootDSE attributes"
-    attrs = []
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(scope=SCOPE_BASE, attrs=[])
     assertEquals(len(res), 1)
 
     print "Testing for highestCommittedUSN"
-    attrs = ["highestCommittedUSN"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
     assertEquals(len(res), 1)
-    assert(res[0].highestCommittedUSN != undefined)
-    assert(res[0].highestCommittedUSN != 0)
+    assert(int(res[0]["highestCommittedUSN"][0]) != 0)
 
     print "Testing for netlogon via LDAP"
-    attrs = ["netlogon"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
     assertEquals(len(res), 0)
 
     print "Testing for netlogon and highestCommittedUSN via LDAP"
-    attrs = ["netlogon", "highestCommittedUSN"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, 
+            attrs=["netlogon", "highestCommittedUSN"])
     assertEquals(len(res), 0)
 
+
 def find_basedn(ldb):
-    attrs = ["defaultNamingContext"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, 
+                     attrs=["defaultNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].defaultNamingContext
+    return res[0]["defaultNamingContext"][0]
+
 
 def find_configurationdn(ldb):
-    attrs = ["configurationNamingContext"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].configurationNamingContext
+    return res[0]["configurationNamingContext"][0]
+
 
 def find_schemadn(ldb):
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs=["schemaNamingContext"])
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].schemaNamingContext
+    return res[0]["schemaNamingContext"][0]
 
 if not "://" in host:
     host = "ldap://%s" % host
 
-ldb = Ldb(host, credentials=creds, session_info=system_session(), 
-          lp=lp)
+ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 base_dn = find_basedn(ldb)
-
 configuration_dn = find_configurationdn(ldb)
 schema_dn = find_schemadn(ldb)
 
diff --git a/source4/samba4-skip b/source4/samba4-skip
index 99c1799a7a..8ce9c4f9cc 100644
--- a/source4/samba4-skip
+++ b/source4/samba4-skip
@@ -49,5 +49,4 @@ RPC-FRSAPI							# Not provided by Samba 4
 ^samba4.NET-API-BECOME-DC.*$			# Fails
 WINBIND							# FIXME: This should not be skipped
 NSS-TEST						# Fails
-samba4.ldap.python			 # Conversion from EJS not yet finished
 samba4.samba3sam.python		# Conversion from EJS not yet finished
diff --git a/source4/scripting/python/STATUS b/source4/scripting/python/STATUS
index f2f1641658..5972027f59 100644
--- a/source4/scripting/python/STATUS
+++ b/source4/scripting/python/STATUS
@@ -1,5 +1,5 @@
 dsdb/samdb/ldb_modules/tests/samba3sam.py: Fix remaining failing tests
-lib/ldb/tests/python/ldap.py: Fix remaining failing tests
+lib/ldb/tests/python/ldap.py: Fix remaining 3 FIXME's
 provisioning in LDAP mode(TEST_LDAP=yes PROVISION_PYTHON=yes make test)
 command-line vampire
 provisioning: combine some of the python dictionaries
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index 290c06fa6a..11daa4bd59 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -322,7 +322,7 @@ then
 	plantest "samba3.python" none $SUBUNITRUN samba.tests.samba3
 	plantest "events.python" none PYTHONPATH="$PYTHONPATH:lib/events" $SUBUNITRUN tests
 	plantest "samba3sam.python" none PYTHONPATH="$PYTHONPATH:dsdb/samdb/ldb_modules/tests" $SUBUNITRUN samba3sam
-	plantest "ldap.python" dc $PYTHON $samba4srcdir/lib/ldb/tests/python/ldap.py \$SERVER -U\$USERNAME%\$PASSWORD
+	plantest "ldap.python" dc $PYTHON $samba4srcdir/lib/ldb/tests/python/ldap.py $CONFIGURATION \$SERVER -U\$USERNAME%\$PASSWORD -W \$DOMAIN
 	plantest "blackbox.samba3dump" none $PYTHON scripting/bin/samba3dump $samba4srcdir/../testdata/samba3
 	rm -rf $PREFIX/upgrade
 	plantest "blackbox.upgrade" none $PYTHON setup/upgrade.py $CONFIGURATION --targetdir=$PREFIX/upgrade ../testdata/samba3 ../testdata/samba3/smb.conf