You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2018/12/11 16:58:19 UTC

[syncope] 01/02: [SYNCOPE-1410] Now using [User, Group, AnyObject]CR instead of [\1]TO for create

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git

commit 90d1d931735a9e29e96f735ddaded1d9d24bfa1c
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Tue Dec 11 15:38:12 2018 +0100

    [SYNCOPE-1410] Now using [User,Group,AnyObject]CR instead of [\1]TO for create
---
 .../console/panels/RemediationDirectoryPanel.java  |  28 +-
 .../client/console/rest/AnyObjectRestClient.java   |   5 +-
 .../client/console/rest/GroupRestClient.java       |   5 +-
 .../client/console/rest/RemediationRestClient.java |   7 +-
 .../client/console/rest/UserRestClient.java        |   5 +-
 .../console/status/AnyStatusDirectoryPanel.java    |   6 +-
 .../status/ResourceStatusDirectoryPanel.java       |   3 +-
 .../wizards/any/AnyObjectWizardBuilder.java        |   7 +-
 .../console/wizards/any/GroupWizardBuilder.java    |   7 +-
 .../console/wizards/any/UserWizardBuilder.java     |   8 +-
 .../console/implementations/MyPullActions.groovy   |  26 +-
 .../client/enduser/resources/GroupResource.java    |   4 +-
 .../enduser/resources/UserSelfCreateResource.java  |  19 +-
 .../apache/syncope/common/lib/AnyOperations.java   |  30 +-
 .../apache/syncope/common/lib/EntityTOUtils.java   |  88 ++++
 .../syncope/common/lib/request/AbstractPatch.java  |   2 +-
 .../common/lib/request/{AnyUR.java => AnyCR.java}  | 115 ++---
 .../AnyObjectTO.java => request/AnyObjectCR.java}  |  95 ++++-
 .../syncope/common/lib/request/AnyObjectUR.java    |  20 +-
 .../apache/syncope/common/lib/request/AnyUR.java   |   4 +-
 .../lib/{to/GroupTO.java => request/GroupCR.java}  | 135 +++---
 .../{MembershipPatch.java => MembershipUR.java}    |  12 +-
 ...{RelationshipPatch.java => RelationshipUR.java} |  12 +-
 .../lib/request/{UserUR.java => UserCR.java}       | 148 ++++---
 .../apache/syncope/common/lib/request/UserUR.java  |  20 +-
 .../common/lib/to/AbstractAnnotatedBean.java       |   5 -
 .../apache/syncope/common/lib/to/AnyObjectTO.java  |   1 -
 .../org/apache/syncope/common/lib/to/AnyTO.java    |  14 +-
 .../AttributableReqEntity.java}                    |  13 +-
 .../org/apache/syncope/common/lib/to/GroupTO.java  |   4 -
 .../syncope/common/lib/to/RemediationTO.java       |  11 +-
 .../org/apache/syncope/common/lib/to/UserTO.java   |   9 -
 .../syncope/common/lib/types/AnyTypeKind.java      |  29 +-
 .../org/apache/syncope/common/lib/JSONTest.java    |   3 +-
 .../common/rest/api/service/AnyObjectService.java  |   5 +-
 .../common/rest/api/service/GroupService.java      |   5 +-
 .../rest/api/service/RemediationService.java       |   6 +-
 .../common/rest/api/service/UserSelfService.java   |   8 +-
 .../common/rest/api/service/UserService.java       |  10 +-
 .../syncope/core/logic/AbstractAnyLogic.java       |  46 +-
 .../apache/syncope/core/logic/AnyObjectLogic.java  |   7 +-
 .../org/apache/syncope/core/logic/GroupLogic.java  |   7 +-
 .../syncope/core/logic/RemediationLogic.java       |  16 +-
 .../org/apache/syncope/core/logic/UserLogic.java   |  23 +-
 .../core/persistence/api/entity/AnyUtils.java      |   5 +-
 .../core/persistence/api/entity/Remediation.java   |   8 +-
 .../core/persistence/jpa/entity/JPAAnyUtils.java   |  37 +-
 .../persistence/jpa/entity/JPARemediation.java     |  10 +-
 .../validation/entity/RemediationValidator.java    |   2 +-
 .../api/AnyObjectProvisioningManager.java          |   5 +-
 .../provisioning/api/GroupProvisioningManager.java |   6 +-
 .../core/provisioning/api/LogicActions.java        |   5 +-
 .../core/provisioning/api/ProvisioningManager.java |  14 +-
 .../provisioning/api/UserProvisioningManager.java  |   8 +-
 .../provisioning/api/data/AnyObjectDataBinder.java |   3 +-
 .../provisioning/api/data/GroupDataBinder.java     |   3 +-
 .../core/provisioning/api/data/UserDataBinder.java |   3 +-
 .../provisioning/api/pushpull/PullActions.java     |  47 ++-
 .../java/DefaultAnyObjectProvisioningManager.java  |  12 +-
 .../java/DefaultGroupProvisioningManager.java      |  18 +-
 .../java/DefaultUserProvisioningManager.java       |  23 +-
 .../java/data/AbstractAnyDataBinder.java           |   9 +-
 .../java/data/AnyObjectDataBinderImpl.java         |  21 +-
 .../java/data/GroupDataBinderImpl.java             |  33 +-
 .../java/data/RemediationDataBinderImpl.java       |   4 +-
 .../provisioning/java/data/UserDataBinderImpl.java |  31 +-
 .../provisioning/java/job/SetUMembershipsJob.java  |   8 +-
 .../java/pushpull/AbstractPullResultHandler.java   |  37 +-
 .../java/pushpull/DBPasswordPullActions.java       |  12 +-
 .../DefaultAnyObjectPullResultHandler.java         |  15 +-
 .../pushpull/DefaultGroupPullResultHandler.java    |  15 +-
 .../pushpull/DefaultUserPullResultHandler.java     |  15 +-
 .../java/pushpull/LDAPMembershipPullActions.java   |   4 +-
 .../java/pushpull/LDAPPasswordPullActions.java     |  12 +-
 .../provisioning/java/utils/ConnObjectUtils.java   |  61 +--
 .../provisioning/java/utils/TemplateUtils.java     |  63 ++-
 .../core/rest/cxf/service/AbstractAnyService.java  |   5 +-
 .../rest/cxf/service/AnyObjectServiceImpl.java     |  10 +-
 .../core/rest/cxf/service/GroupServiceImpl.java    |   9 +-
 .../rest/cxf/service/RemediationServiceImpl.java   |   6 +-
 .../core/rest/cxf/service/UserSelfServiceImpl.java |   5 +-
 .../core/rest/cxf/service/UserServiceImpl.java     |   9 +-
 .../workflow/api/AnyObjectWorkflowAdapter.java     |   6 +-
 .../core/workflow/api/GroupWorkflowAdapter.java    |   6 +-
 .../core/workflow/api/UserWorkflowAdapter.java     |  13 +-
 .../java/AbstractAnyObjectWorkflowAdapter.java     |   8 +-
 .../java/AbstractGroupWorkflowAdapter.java         |   8 +-
 .../workflow/java/AbstractUserWorkflowAdapter.java |  15 +-
 .../java/DefaultAnyObjectWorkflowAdapter.java      |   6 +-
 .../workflow/java/DefaultGroupWorkflowAdapter.java |   6 +-
 .../workflow/java/DefaultUserWorkflowAdapter.java  |   9 +-
 .../camel/CamelAnyObjectProvisioningManager.java   |  10 +-
 .../camel/CamelGroupProvisioningManager.java       |  10 +-
 .../camel/CamelUserProvisioningManager.java        |  19 +-
 .../camel/producer/CreateProducer.java             |  26 +-
 .../src/main/resources/userRoutes.xml              |   2 +-
 .../core/flowable/impl/FlowableRuntimeUtils.java   |   4 +-
 .../flowable/impl/FlowableUserWorkflowAdapter.java |  20 +-
 .../core/flowable/impl/FlowableWorkflowUtils.java  |   2 -
 .../apache/syncope/core/flowable/task/Create.java  |   7 +-
 .../syncope/core/logic/oidc/OIDCUserManager.java   |  21 +-
 .../core/provisioning/api/OIDCProviderActions.java |   4 +-
 .../java/DefaultOIDCProviderActions.java           |  48 ---
 .../syncope/core/logic/saml2/SAML2UserManager.java |  21 +-
 .../core/provisioning/api/SAML2IdPActions.java     |   3 +-
 .../apache/syncope/core/logic/SCIMDataBinder.java  | 111 ++---
 .../ext/scimv2/cxf/service/AbstractService.java    |   5 +-
 .../ext/scimv2/cxf/service/GroupServiceImpl.java   |  10 +-
 .../ext/scimv2/cxf/service/UserServiceImpl.java    |   2 +-
 .../reference/flowable/AssignDirectorGroup.java    |   4 +-
 .../reference/flowable/CreateARelationship.java    |   4 +-
 .../fit/core/reference/TestPullActions.java        |  33 +-
 .../org/apache/syncope/fit/AbstractITCase.java     |  27 +-
 .../apache/syncope/fit/core/AnyObjectITCase.java   |  61 ++-
 .../syncope/fit/core/AuthenticationITCase.java     |  67 +--
 .../org/apache/syncope/fit/core/BatchITCase.java   |  39 +-
 .../apache/syncope/fit/core/CamelRouteITCase.java  |  29 +-
 .../apache/syncope/fit/core/DynRealmITCase.java    |  32 +-
 .../syncope/fit/core/ExceptionMapperITCase.java    |  28 +-
 .../org/apache/syncope/fit/core/GroupITCase.java   | 213 +++++-----
 .../apache/syncope/fit/core/MembershipITCase.java  |  92 ++--
 .../syncope/fit/core/MultitenancyITCase.java       |  15 +-
 .../syncope/fit/core/NotificationTaskITCase.java   |   9 +-
 .../apache/syncope/fit/core/PlainSchemaITCase.java |  33 +-
 .../syncope/fit/core/PropagationTaskITCase.java    |  30 +-
 .../apache/syncope/fit/core/PullTaskITCase.java    | 152 +++----
 .../apache/syncope/fit/core/PushTaskITCase.java    |  13 +-
 .../org/apache/syncope/fit/core/RESTITCase.java    |   9 +-
 .../syncope/fit/core/ReconciliationITCase.java     |  13 +-
 .../apache/syncope/fit/core/ResourceITCase.java    |  20 +-
 .../org/apache/syncope/fit/core/SCIMITCase.java    |   2 +-
 .../org/apache/syncope/fit/core/SearchITCase.java  |  35 +-
 .../org/apache/syncope/fit/core/UserITCase.java    | 425 ++++++++++---------
 .../apache/syncope/fit/core/UserIssuesITCase.java  | 463 +++++++++++----------
 .../apache/syncope/fit/core/UserRequestITCase.java |   6 +-
 .../apache/syncope/fit/core/UserSelfITCase.java    |  78 ++--
 .../org/apache/syncope/fit/core/VirAttrITCase.java | 157 +++----
 .../test/resources/DoubleValueLogicActions.groovy  |   4 +-
 138 files changed, 2230 insertions(+), 1891 deletions(-)

diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
index ad628a4..4342c71 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
@@ -52,10 +52,14 @@ import org.apache.syncope.client.console.wizards.any.AnyWrapper;
 import org.apache.syncope.client.console.wizards.any.GroupWizardBuilder;
 import org.apache.syncope.client.console.wizards.any.UserWizardBuilder;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -191,7 +195,8 @@ public class RemediationDirectoryPanel
                             UserTO newUserTO;
                             UserTO previousUserTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newUserTO = (UserTO) remediationTO.getAnyTOPayload();
+                                newUserTO = new UserTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newUserTO);
                                 previousUserTO = null;
                             } else {
                                 previousUserTO = new UserRestClient().
@@ -217,7 +222,8 @@ public class RemediationDirectoryPanel
                             GroupTO newGroupTO;
                             GroupTO previousGroupTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newGroupTO = (GroupTO) remediationTO.getAnyTOPayload();
+                                newGroupTO = new GroupTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newGroupTO);
                                 previousGroupTO = null;
                             } else {
                                 previousGroupTO = new GroupRestClient().
@@ -243,7 +249,8 @@ public class RemediationDirectoryPanel
                             AnyObjectTO newAnyObjectTO;
                             AnyObjectTO previousAnyObjectTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newAnyObjectTO = (AnyObjectTO) remediationTO.getAnyTOPayload();
+                                newAnyObjectTO = new AnyObjectTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newAnyObjectTO);
                                 previousAnyObjectTO = null;
                             } else {
                                 previousAnyObjectTO = new AnyObjectRestClient().
@@ -371,7 +378,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<UserTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                UserCR req = new UserCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 UserUR req = AnyOperations.diff(inner, previousUserTO, false);
 
@@ -423,7 +433,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<GroupTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                GroupCR req = new GroupCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 GroupUR req = AnyOperations.diff(inner, previousGroupTO, false);
 
@@ -468,7 +481,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<AnyObjectTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                AnyObjectCR req = new AnyObjectCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 AnyObjectUR req = AnyOperations.diff(inner, previousAnyObjectTO, false);
 
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
index c2e71f6..9b47662 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -41,8 +42,8 @@ public class AnyObjectRestClient extends AbstractAnyRestClient<AnyObjectTO> {
         return AnyObjectService.class;
     }
 
-    public ProvisioningResult<AnyObjectTO> create(final AnyObjectTO anyObjectTO) {
-        Response response = getService(AnyObjectService.class).create(anyObjectTO);
+    public ProvisioningResult<AnyObjectTO> create(final AnyObjectCR createReq) {
+        Response response = getService(AnyObjectService.class).create(createReq);
         return response.readEntity(new GenericType<ProvisioningResult<AnyObjectTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
index f5bd6c3..cea9301 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -42,8 +43,8 @@ public class GroupRestClient extends AbstractAnyRestClient<GroupTO> {
         return GroupService.class;
     }
 
-    public ProvisioningResult<GroupTO> create(final GroupTO groupTO) {
-        Response response = getService(GroupService.class).create(groupTO);
+    public ProvisioningResult<GroupTO> create(final GroupCR groupCR) {
+        Response response = getService(GroupService.class).create(groupCR);
         return response.readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
index 30fb1b1..d2f2074 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -49,9 +50,9 @@ public class RemediationRestClient extends BaseRestClient {
         return getService(RemediationService.class).read(key);
     }
 
-    public <T extends AnyTO> ProvisioningResult<T> remedy(final String key, final T anyTO) {
-        Response response = getService(RemediationService.class).remedy(key, anyTO);
-        return response.readEntity(new GenericType<ProvisioningResult<T>>() {
+    public <C extends AnyCR, A extends AnyTO> ProvisioningResult<A> remedy(final String key, final C anyCR) {
+        Response response = getService(RemediationService.class).remedy(key, anyCR);
+        return response.readEntity(new GenericType<ProvisioningResult<A>>() {
         });
     }
 
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
index 223e37f..4ff2bca 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
@@ -29,6 +29,7 @@ import org.apache.syncope.client.console.commons.status.StatusBean;
 import org.apache.syncope.client.console.commons.status.StatusUtils;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -51,8 +52,8 @@ public class UserRestClient extends AbstractAnyRestClient<UserTO> {
         return UserService.class;
     }
 
-    public ProvisioningResult<UserTO> create(final UserTO userTO, final boolean storePassword) {
-        Response response = getService(UserService.class).create(userTO, storePassword);
+    public ProvisioningResult<UserTO> create(final UserCR createReq) {
+        Response response = getService(UserService.class).create(createReq);
         return response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
index fe67ff6..d8f103b 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
@@ -293,8 +293,7 @@ public class AnyStatusDirectoryPanel
                             getReconStatuses(anyTypeKind, anyTO.getKey(), Arrays.asList(resource));
                 }
 
-                return StatusUtils.getStatusBean(
-                        actual,
+                return StatusUtils.getStatusBean(actual,
                         resource,
                         statuses.isEmpty() ? null : statuses.get(0).getRight().getOnResource(),
                         actual instanceof GroupTO);
@@ -334,8 +333,7 @@ public class AnyStatusDirectoryPanel
                 statusBeans.addAll(resources.stream().
                         filter(resource -> !anyTO.getResources().contains(resource)).
                         map(resource -> {
-                            StatusBean statusBean = StatusUtils.getStatusBean(
-                                    actual,
+                            StatusBean statusBean = StatusUtils.getStatusBean(actual,
                                     resource,
                                     null,
                                     actual instanceof GroupTO);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
index bba8d2f..e3bdd0b 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
@@ -280,8 +280,7 @@ public class ResourceStatusDirectoryPanel
                 List<? extends AnyTO> result = restClient.search(
                         SyncopeConstants.ROOT_REALM, fiql, (page < 0 ? 0 : page) + 1, paginatorRows, getSort(), type);
 
-                statusBeans.addAll(result.stream().map(any -> StatusUtils.getStatusBean(
-                        any,
+                statusBeans.addAll(result.stream().map(any -> StatusUtils.getStatusBean(any,
                         resource.getKey(),
                         null,
                         any instanceof GroupTO)).collect(Collectors.toList()));
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
index 12b9dea..1d63ea9 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
@@ -25,6 +25,8 @@ import org.apache.syncope.client.console.layout.AnyObjectFormLayoutInfo;
 import org.apache.syncope.client.console.rest.AnyObjectRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -70,7 +72,10 @@ public class AnyObjectWizardBuilder extends AnyWizardBuilder<AnyObjectTO> implem
 
         ProvisioningResult<AnyObjectTO> result;
         if (inner.getKey() == null) {
-            result = anyObjectRestClient.create(inner);
+            AnyObjectCR req = new AnyObjectCR();
+            EntityTOUtils.toAnyCR(inner, req);
+
+            result = anyObjectRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             AnyObjectUR req = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
index dbbde35..575f6bc 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
@@ -28,6 +28,8 @@ import org.apache.syncope.client.console.rest.GroupRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.client.console.wizards.AjaxWizardBuilder;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -89,7 +91,10 @@ public class GroupWizardBuilder extends AnyWizardBuilder<GroupTO> implements Gro
 
         ProvisioningResult<GroupTO> result;
         if (inner.getKey() == null) {
-            result = groupRestClient.create(inner);
+            GroupCR req = new GroupCR();
+            EntityTOUtils.toAnyCR(inner, req);
+
+            result = groupRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             GroupUR groupUR = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
index c95cb5b..8201ec1 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
@@ -26,7 +26,9 @@ import org.apache.syncope.client.console.layout.UserFormLayoutInfo;
 import org.apache.syncope.client.console.rest.UserRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -78,9 +80,13 @@ public class UserWizardBuilder extends AnyWizardBuilder<UserTO> implements UserF
 
         ProvisioningResult<UserTO> result;
         if (inner.getKey() == null) {
-            result = userRestClient.create(inner, modelObject instanceof UserWrapper
+            UserCR req = new UserCR();
+            EntityTOUtils.toAnyCR(inner, req);
+            req.setStorePassword(modelObject instanceof UserWrapper
                     ? UserWrapper.class.cast(modelObject).isStorePasswordInSyncope()
                     : StringUtils.isNotBlank(inner.getPassword()));
+
+            result = userRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             UserUR userUR = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy b/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
index 125d527..5de8a22 100644
--- a/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
+++ b/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
@@ -17,8 +17,10 @@
  * under the License.
  */
 import groovy.transform.CompileStatic
+import org.apache.syncope.common.lib.request.AnyCR
 import org.apache.syncope.common.lib.request.AnyUR
 import org.apache.syncope.common.lib.to.EntityTO
+import org.apache.syncope.common.lib.to.RealmTO
 import org.apache.syncope.core.persistence.api.entity.task.ProvisioningTask
 import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningActions
@@ -40,7 +42,15 @@ class MyPullActions implements PullActions {
   void beforeProvision(
     ProvisioningProfile profile,
     SyncDelta delta,
-    EntityTO entity) throws JobExecutionException {
+    AnyCR anyCR) throws JobExecutionException {
+
+  }
+
+  @Override
+  void beforeProvision(
+    ProvisioningProfile profile,
+    SyncDelta delta,
+    RealmTO realmTO) throws JobExecutionException {
 
   }
 
@@ -48,7 +58,15 @@ class MyPullActions implements PullActions {
   void beforeAssign(
     ProvisioningProfile profile,
     SyncDelta delta,
-    EntityTO entity) throws JobExecutionException {
+    AnyCR anyCR) throws JobExecutionException {
+
+  }
+
+  @Override
+  void beforeAssign(
+    ProvisioningProfile profile,
+    SyncDelta delta,
+    RealmTO realmTO) throws JobExecutionException {
 
   }
 
@@ -85,11 +103,11 @@ class MyPullActions implements PullActions {
   }
 
   @Override
-  <R extends AnyUR> void beforeUpdate(
+  void beforeUpdate(
     ProvisioningProfile profile,
     SyncDelta delta,
     EntityTO entity,
-    R anyUR) throws JobExecutionException {
+    AnyUR anyUR) throws JobExecutionException {
 
   }
 
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
index 14fb790..d2b7a20 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
@@ -75,8 +75,8 @@ public class GroupResource extends BaseResource {
                         1,
                         30).getResult();
                 groupResponse.setTotGroups(totGroups);
-                groupResponse.setGroupTOs(groupTOs.stream().collect(
-                        Collectors.toMap(GroupTO::getKey, GroupTO::getName)));
+                groupResponse.setGroupTOs(groupTOs.stream().
+                        collect(Collectors.toMap(GroupTO::getKey, GroupTO::getName)));
             } else {
                 groupResponse.setTotGroups(0);
                 Map<String, String> groups = new HashMap<>();
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
index acc1577..41be448 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
@@ -30,6 +30,7 @@ import org.apache.syncope.client.enduser.SyncopeEnduserSession;
 import org.apache.syncope.client.enduser.annotations.Resource;
 import org.apache.syncope.client.enduser.util.Validation;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -165,8 +166,22 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     LOG.trace("Received user self registration request is: [{}]", userTO);
 
                     // adapt request and create user
-                    final Response res = SyncopeEnduserSession.get().getService(UserSelfService.class).create(userTO,
-                            true);
+                    UserCR req = new UserCR.Builder().
+                            realm(userTO.getRealm()).
+                            username(userTO.getUsername()).
+                            password(userTO.getPassword()).
+                            mustChangePassword(userTO.isMustChangePassword()).
+                            securityQuestion(userTO.getSecurityQuestion()).
+                            securityAnswer(userTO.getSecurityAnswer()).
+                            auxClasses(userTO.getAuxClasses()).
+                            plainAttrs(userTO.getPlainAttrs()).
+                            virAttrs(userTO.getVirAttrs()).
+                            memberships(userTO.getMemberships()).
+                            relationships(userTO.getRelationships()).
+                            roles(userTO.getRoles()).
+                            resources(userTO.getResources()).
+                            build();
+                    Response res = SyncopeEnduserSession.get().getService(UserSelfService.class).create(req);
 
                     buildResponse(response, res.getStatus(),
                             Response.Status.Family.SUCCESSFUL.equals(res.getStatusInfo().getFamily())
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
index 59d8ac2..0f9cb00 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
@@ -31,9 +31,9 @@ import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
-import org.apache.syncope.common.lib.request.RelationshipPatch;
+import org.apache.syncope.common.lib.request.RelationshipUR;
 import org.apache.syncope.common.lib.request.AbstractReplacePatchItem;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.StringPatchItem;
@@ -189,7 +189,7 @@ public final class AnyOperations {
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
                 forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipPatch.Builder().
+                    result.getRelationships().add(new RelationshipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).
                             relationshipTO(entry.getValue()).build());
                 });
@@ -197,7 +197,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipPatch.Builder().
+                        result.getRelationships().add(new RelationshipUR.Builder().
                                 operation(PatchOperation.DELETE).
                                 relationshipTO(originalRels.get(key)).build());
                     });
@@ -208,7 +208,7 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().
+            MembershipUR membershipPatch = new MembershipUR.Builder().
                     operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
 
             diff(value, membershipPatch);
@@ -223,7 +223,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipPatch.Builder().
+                        result.getMemberships().add(new MembershipUR.Builder().
                                 operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
                     });
         }
@@ -233,7 +233,7 @@ public final class AnyOperations {
 
     private static void diff(
             final MembershipTO updated,
-            final MembershipPatch result) {
+            final MembershipUR result) {
 
         // 1. plain attributes
         result.getPlainAttrs().addAll(updated.getPlainAttrs().stream().
@@ -311,7 +311,7 @@ public final class AnyOperations {
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
                 forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipPatch.Builder().
+                    result.getRelationships().add(new RelationshipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).
                             relationshipTO(entry.getValue()).build());
                 });
@@ -319,7 +319,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipPatch.Builder().
+                        result.getRelationships().add(new RelationshipUR.Builder().
                                 operation(PatchOperation.DELETE).
                                 relationshipTO(originalRels.get(key)).build());
                     });
@@ -330,7 +330,7 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().
+            MembershipUR membershipPatch = new MembershipUR.Builder().
                     operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
 
             diff(value, membershipPatch);
@@ -345,7 +345,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipPatch.Builder().
+                        result.getMemberships().add(new MembershipUR.Builder().
                                 operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
                     });
         }
@@ -511,7 +511,7 @@ public final class AnyOperations {
         anyObjectUR.getRelationships().
                 forEach(relPatch -> {
                     if (relPatch.getRelationshipTO() == null) {
-                        LOG.warn("Invalid {} specified: {}", RelationshipPatch.class.getName(), relPatch);
+                        LOG.warn("Invalid {} specified: {}", RelationshipUR.class.getName(), relPatch);
                     } else {
                         result.getRelationships().remove(relPatch.getRelationshipTO());
                         if (relPatch.getOperation() == PatchOperation.ADD_REPLACE) {
@@ -524,7 +524,7 @@ public final class AnyOperations {
         anyObjectUR.getMemberships().
                 forEach(membPatch -> {
                     if (membPatch.getGroup() == null) {
-                        LOG.warn("Invalid {} specified: {}", MembershipPatch.class.getName(), membPatch);
+                        LOG.warn("Invalid {} specified: {}", MembershipUR.class.getName(), membPatch);
                     } else {
                         result.getMemberships().stream().
                                 filter(membership -> membPatch.getGroup().equals(membership.getGroupKey())).
@@ -566,7 +566,7 @@ public final class AnyOperations {
         userUR.getRelationships().
                 forEach(relPatch -> {
                     if (relPatch.getRelationshipTO() == null) {
-                        LOG.warn("Invalid {} specified: {}", RelationshipPatch.class.getName(), relPatch);
+                        LOG.warn("Invalid {} specified: {}", RelationshipUR.class.getName(), relPatch);
                     } else {
                         result.getRelationships().remove(relPatch.getRelationshipTO());
                         if (relPatch.getOperation() == PatchOperation.ADD_REPLACE) {
@@ -579,7 +579,7 @@ public final class AnyOperations {
         userUR.getMemberships().
                 forEach(membPatch -> {
                     if (membPatch.getGroup() == null) {
-                        LOG.warn("Invalid {} specified: {}", MembershipPatch.class.getName(), membPatch);
+                        LOG.warn("Invalid {} specified: {}", MembershipUR.class.getName(), membPatch);
                     } else {
                         result.getMemberships().stream().
                                 filter(membership -> membPatch.getGroup().equals(membership.getGroupKey())).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java b/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
index e5b2bee..d085a19 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
@@ -23,9 +23,17 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
+import org.apache.syncope.common.lib.to.AnyObjectTO;
+import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.RelationshipTO;
+import org.apache.syncope.common.lib.to.UserTO;
 
 public final class EntityTOUtils {
 
@@ -52,6 +60,86 @@ public final class EntityTOUtils {
         return Collections.unmodifiableMap(result);
     }
 
+    public static <A extends AnyTO, C extends AnyCR> void toAnyCR(final A anyTO, final C anyCR) {
+        anyCR.setRealm(anyTO.getRealm());
+        anyCR.getAuxClasses().addAll(anyTO.getAuxClasses());
+        anyCR.getPlainAttrs().addAll(anyTO.getPlainAttrs());
+        anyCR.getVirAttrs().addAll(anyTO.getVirAttrs());
+        anyCR.getResources().addAll(anyTO.getResources());
+
+        if (anyCR instanceof UserCR && anyTO instanceof UserTO) {
+            UserCR userCR = (UserCR) anyCR;
+            UserTO userTO = (UserTO) anyTO;
+
+            userCR.setUsername(userTO.getUsername());
+            userCR.setPassword(userTO.getPassword());
+            userCR.setSecurityQuestion(userTO.getSecurityQuestion());
+            userCR.setSecurityAnswer(userTO.getSecurityAnswer());
+            userCR.setMustChangePassword(userTO.isMustChangePassword());
+            userCR.getRelationships().addAll(userTO.getRelationships());
+            userCR.getMemberships().addAll(userTO.getMemberships());
+            userCR.getRoles().addAll(userTO.getRoles());
+        } else if (anyCR instanceof GroupCR && anyTO instanceof GroupTO) {
+            GroupCR groupCR = (GroupCR) anyCR;
+            GroupTO groupTO = (GroupTO) anyTO;
+
+            groupCR.setName(groupTO.getName());
+            groupCR.setUserOwner(groupTO.getUserOwner());
+            groupCR.setGroupOwner(groupTO.getGroupOwner());
+            groupCR.setUDynMembershipCond(groupTO.getUDynMembershipCond());
+            groupCR.getADynMembershipConds().putAll(groupTO.getADynMembershipConds());
+            groupCR.getTypeExtensions().addAll(groupTO.getTypeExtensions());
+        } else if (anyCR instanceof AnyObjectCR && anyTO instanceof AnyObjectTO) {
+            AnyObjectCR anyObjectCR = (AnyObjectCR) anyCR;
+            AnyObjectTO anyObjectTO = (AnyObjectTO) anyTO;
+
+            anyObjectCR.setType(anyObjectTO.getType());
+            anyObjectCR.setName(anyObjectTO.getName());
+            anyObjectCR.getRelationships().addAll(anyObjectTO.getRelationships());
+            anyObjectCR.getMemberships().addAll(anyObjectTO.getMemberships());
+        }
+    }
+
+    public static <C extends AnyCR, A extends AnyTO> void toAnyTO(final C anyCR, final A anyTO) {
+        anyTO.setRealm(anyCR.getRealm());
+        anyTO.getAuxClasses().addAll(anyCR.getAuxClasses());
+        anyTO.getPlainAttrs().addAll(anyCR.getPlainAttrs());
+        anyTO.getVirAttrs().addAll(anyCR.getVirAttrs());
+        anyTO.getResources().addAll(anyCR.getResources());
+
+        if (anyTO instanceof UserTO && anyCR instanceof UserCR) {
+            UserTO userTO = (UserTO) anyTO;
+            UserCR userCR = (UserCR) anyCR;
+
+            userTO.setUsername(userCR.getUsername());
+            userTO.setPassword(userCR.getPassword());
+            userTO.setSecurityQuestion(userCR.getSecurityQuestion());
+            userTO.setSecurityAnswer(userCR.getSecurityAnswer());
+            userTO.setMustChangePassword(userCR.isMustChangePassword());
+            userTO.getRelationships().addAll(userCR.getRelationships());
+            userTO.getMemberships().addAll(userCR.getMemberships());
+            userTO.getRoles().addAll(userCR.getRoles());
+        } else if (anyTO instanceof GroupTO && anyCR instanceof GroupCR) {
+            GroupTO groupTO = (GroupTO) anyTO;
+            GroupCR groupCR = (GroupCR) anyCR;
+
+            groupTO.setName(groupCR.getName());
+            groupTO.setUserOwner(groupCR.getUserOwner());
+            groupTO.setGroupOwner(groupCR.getGroupOwner());
+            groupTO.setUDynMembershipCond(groupCR.getUDynMembershipCond());
+            groupTO.getADynMembershipConds().putAll(groupCR.getADynMembershipConds());
+            groupTO.getTypeExtensions().addAll(groupCR.getTypeExtensions());
+        } else if (anyTO instanceof AnyObjectTO && anyCR instanceof AnyObjectCR) {
+            AnyObjectTO anyObjectTO = (AnyObjectTO) anyTO;
+            AnyObjectCR anyObjectCR = (AnyObjectCR) anyCR;
+
+            anyObjectTO.setType(anyObjectCR.getType());
+            anyObjectTO.setName(anyObjectCR.getName());
+            anyObjectTO.getRelationships().addAll(anyObjectCR.getRelationships());
+            anyObjectTO.getMemberships().addAll(anyObjectCR.getMemberships());
+        }
+    }
+
     /**
      * Private default constructor, for static-only classes.
      */
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
index 8d86659..357f92f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
@@ -26,7 +26,7 @@ import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.types.PatchOperation;
 
 @XmlType
-@XmlSeeAlso({ AbstractPatchItem.class, AttrPatch.class, MembershipPatch.class, RelationshipPatch.class })
+@XmlSeeAlso({ AbstractPatchItem.class, AttrPatch.class, MembershipUR.class, RelationshipUR.class })
 public abstract class AbstractPatch implements Serializable {
 
     private static final long serialVersionUID = -4729181508529829580L;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
similarity index 73%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
index d0befda..49efeb1 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
@@ -26,9 +26,10 @@ import io.swagger.v3.oas.annotations.media.Schema;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
+import java.util.Optional;
 import java.util.Set;
-import javax.ws.rs.PathParam;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlSeeAlso;
@@ -37,17 +38,18 @@ import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.AttributableReqEntity;
 
 @XmlType
 @XmlSeeAlso({ UserUR.class, GroupUR.class, AnyObjectUR.class })
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
-@JsonPropertyOrder(value = { "@class", "key" })
-@Schema(subTypes = { UserUR.class, GroupUR.class, AnyObjectUR.class }, discriminatorProperty = "@class")
-public abstract class AnyUR implements Serializable, AttributableUR {
+@JsonPropertyOrder(value = { "@class" })
+@Schema(subTypes = { UserCR.class, GroupCR.class, AnyObjectCR.class }, discriminatorProperty = "@class")
+public abstract class AnyCR implements Serializable, AttributableReqEntity {
 
-    private static final long serialVersionUID = -7445489774552440544L;
+    private static final long serialVersionUID = -1180587903919947455L;
 
-    protected abstract static class Builder<R extends AnyUR, B extends Builder<R, B>> {
+    protected abstract static class Builder<R extends AnyCR, B extends Builder<R, B>> {
 
         protected R instance;
 
@@ -61,49 +63,43 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         }
 
         @SuppressWarnings("unchecked")
-        public B key(final String key) {
-            getInstance().setKey(key);
-            return (B) this;
-        }
-
-        @SuppressWarnings("unchecked")
-        public B realm(final StringReplacePatchItem realm) {
+        public B realm(final String realm) {
             getInstance().setRealm(realm);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClass(final StringPatchItem auxClass) {
+        public B auxClass(final String auxClass) {
             getInstance().getAuxClasses().add(auxClass);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClasses(final StringPatchItem... auxClasses) {
+        public B auxClasses(final String... auxClasses) {
             getInstance().getAuxClasses().addAll(Arrays.asList(auxClasses));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClasses(final Collection<StringPatchItem> auxClasses) {
+        public B auxClasses(final Collection<String> auxClasses) {
             getInstance().getAuxClasses().addAll(auxClasses);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttr(final AttrPatch plainAttr) {
+        public B plainAttr(final AttrTO plainAttr) {
             getInstance().getPlainAttrs().add(plainAttr);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttrs(final AttrPatch... plainAttrs) {
+        public B plainAttrs(final AttrTO... plainAttrs) {
             getInstance().getPlainAttrs().addAll(Arrays.asList(plainAttrs));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttrs(final Collection<AttrPatch> plainAttrs) {
+        public B plainAttrs(final Collection<AttrTO> plainAttrs) {
             getInstance().getPlainAttrs().addAll(plainAttrs);
             return (B) this;
         }
@@ -127,19 +123,19 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         }
 
         @SuppressWarnings("unchecked")
-        public B resource(final StringPatchItem resource) {
+        public B resource(final String resource) {
             getInstance().getResources().add(resource);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B resources(final StringPatchItem... resources) {
+        public B resources(final String... resources) {
             getInstance().getResources().addAll(Arrays.asList(resources));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B resources(final Collection<StringPatchItem> resources) {
+        public B resources(final Collection<String> resources) {
             getInstance().getResources().addAll(resources);
             return (B) this;
         }
@@ -153,17 +149,15 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @JsonProperty("@class")
     private String discriminator;
 
-    private String key;
-
-    private StringReplacePatchItem realm;
+    private String realm;
 
-    private final Set<StringPatchItem> auxClasses = new HashSet<>();
+    private final Set<String> auxClasses = new HashSet<>();
 
-    private final Set<AttrPatch> plainAttrs = new HashSet<>();
+    private final Set<AttrTO> plainAttrs = new HashSet<>();
 
     private final Set<AttrTO> virAttrs = new HashSet<>();
 
-    private final Set<StringPatchItem> resources = new HashSet<>();
+    private final Set<String> resources = new HashSet<>();
 
     @Schema(name = "@class", required = true)
     public abstract String getDiscriminator();
@@ -174,38 +168,57 @@ public abstract class AnyUR implements Serializable, AttributableUR {
 
     @JsonProperty(required = true)
     @XmlElement(required = true)
-    public String getKey() {
-        return key;
-    }
-
-    @PathParam("key")
-    public void setKey(final String key) {
-        this.key = key;
-    }
-
-    public StringReplacePatchItem getRealm() {
+    @Override
+    public String getRealm() {
         return realm;
     }
 
-    public void setRealm(final StringReplacePatchItem realm) {
+    @Override
+    public void setRealm(final String realm) {
         this.realm = realm;
     }
 
     @XmlElementWrapper(name = "auxClasses")
-    @XmlElement(name = "auxClass")
+    @XmlElement(name = "class")
     @JsonProperty("auxClasses")
-    public Set<StringPatchItem> getAuxClasses() {
+    @Override
+    public Set<String> getAuxClasses() {
         return auxClasses;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getPlainAttr(final String schema) {
+        return plainAttrs.stream().filter(attr -> attr.getSchema().equals(schema)).findFirst();
+    }
+
     @XmlElementWrapper(name = "plainAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("plainAttrs")
     @Override
-    public Set<AttrPatch> getPlainAttrs() {
+    public Set<AttrTO> getPlainAttrs() {
         return plainAttrs;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getDerAttr(final String schema) {
+        return Optional.empty();
+    }
+
+    @XmlTransient
+    @JsonIgnore
+    @Override
+    public Set<AttrTO> getDerAttrs() {
+        return Collections.emptySet();
+    }
+
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getVirAttr(final String schema) {
+        return virAttrs.stream().filter(attr -> attr.getSchema().equals(schema)).findFirst();
+    }
+
     @XmlElementWrapper(name = "virAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("virAttrs")
@@ -217,26 +230,15 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "resources")
     @XmlElement(name = "resource")
     @JsonProperty("resources")
-    public Set<StringPatchItem> getResources() {
+    @Override
+    public Set<String> getResources() {
         return resources;
     }
 
-    /**
-     * @return true if no actual changes are defined
-     */
-    @JsonIgnore
-    public boolean isEmpty() {
-        return realm == null
-                && auxClasses.isEmpty()
-                && plainAttrs.isEmpty() && virAttrs.isEmpty()
-                && resources.isEmpty();
-    }
-
     @Override
     public int hashCode() {
         return new HashCodeBuilder().
                 append(discriminator).
-                append(key).
                 append(realm).
                 append(auxClasses).
                 append(plainAttrs).
@@ -256,10 +258,9 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final AnyUR other = (AnyUR) obj;
+        final AnyCR other = (AnyCR) obj;
         return new EqualsBuilder().
                 append(discriminator, other.discriminator).
-                append(key, other.key).
                 append(realm, other.realm).
                 append(auxClasses, other.auxClasses).
                 append(plainAttrs, other.plainAttrs).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
similarity index 59%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
index a2b6a44..a833034 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
@@ -16,28 +16,84 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.to;
+package org.apache.syncope.common.lib.request;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
+import org.apache.syncope.common.lib.to.GroupableRelatableTO;
+import org.apache.syncope.common.lib.to.MembershipTO;
+import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "anyObject")
+@XmlRootElement(name = "anyObjectCR")
 @XmlType
-@Schema(allOf = { AnyTO.class })
-public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
+@JsonPropertyOrder(value = { "@class", "name" })
+@Schema(allOf = { AnyCR.class })
+public class AnyObjectCR extends AnyCR implements GroupableRelatableTO {
 
-    private static final long serialVersionUID = 8841697496476959639L;
+    private static final long serialVersionUID = 5460996992553869226L;
+
+    public static class Builder extends AnyCR.Builder<AnyObjectCR, Builder> {
+
+        @Override
+        protected AnyObjectCR newInstance() {
+            return new AnyObjectCR();
+        }
+
+        public Builder(final String type) {
+            getInstance().setType(type);
+        }
+
+        public Builder name(final String name) {
+            getInstance().setName(name);
+            return this;
+        }
+
+        public Builder relationship(final RelationshipTO relationship) {
+            getInstance().getRelationships().add(relationship);
+            return this;
+        }
+
+        public Builder relationships(final RelationshipTO... relationships) {
+            getInstance().getRelationships().addAll(Arrays.asList(relationships));
+            return this;
+        }
+
+        public Builder relationships(final Collection<RelationshipTO> relationships) {
+            getInstance().getRelationships().addAll(relationships);
+            return this;
+        }
+
+        public Builder membership(final MembershipTO membership) {
+            getInstance().getMemberships().add(membership);
+            return this;
+        }
+
+        public Builder memberships(final MembershipTO... memberships) {
+            getInstance().getMemberships().addAll(Arrays.asList(memberships));
+            return this;
+        }
+
+        public Builder memberships(final Collection<MembershipTO> memberships) {
+            getInstance().getMemberships().addAll(memberships);
+            return this;
+        }
+    }
+
+    private String type;
 
     private String name;
 
@@ -45,16 +101,25 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
 
     private final List<MembershipTO> memberships = new ArrayList<>();
 
-    private final List<MembershipTO> dynMemberships = new ArrayList<>();
-
-    @XmlTransient
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.to.AnyObjectTO")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.AnyObjectCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
+    public String getType() {
+        return type;
+    }
+
+    public void setType(final String type) {
+        this.type = type;
+    }
+
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
     public String getName() {
         return name;
     }
@@ -93,13 +158,9 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    @XmlElementWrapper(name = "dynMemberships")
-    @XmlElement(name = "dynMembership")
-    @JsonProperty("dynMemberships")
     @Override
     public List<MembershipTO> getDynMemberships() {
-        return dynMemberships;
+        return Collections.emptyList();
     }
 
     @Override
@@ -109,7 +170,6 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
                 append(name).
                 append(relationships).
                 append(memberships).
-                append(dynMemberships).
                 build();
     }
 
@@ -124,13 +184,12 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final AnyObjectTO other = (AnyObjectTO) obj;
+        final AnyObjectCR other = (AnyObjectCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(name, other.name).
                 append(relationships, other.relationships).
                 append(memberships, other.memberships).
-                append(dynMemberships, other.dynMemberships).
                 build();
     }
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
index 87136fe..1f7cdbf 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
@@ -50,32 +50,32 @@ public class AnyObjectUR extends AnyUR {
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipUR relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipUR... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipUR> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipUR membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipUR... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipUR> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
@@ -83,9 +83,9 @@ public class AnyObjectUR extends AnyUR {
 
     private StringReplacePatchItem name;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final Set<RelationshipUR> relationships = new HashSet<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final Set<MembershipUR> memberships = new HashSet<>();
 
     @JsonProperty("@class")
     @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.AnyObjectUR")
@@ -105,14 +105,14 @@ public class AnyObjectUR extends AnyUR {
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    public Set<RelationshipUR> getRelationships() {
         return relationships;
     }
 
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    public Set<MembershipUR> getMemberships() {
         return memberships;
     }
 
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
index d0befda..52a6b3f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
@@ -43,7 +43,7 @@ import org.apache.syncope.common.lib.to.AttrTO;
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
 @JsonPropertyOrder(value = { "@class", "key" })
 @Schema(subTypes = { UserUR.class, GroupUR.class, AnyObjectUR.class }, discriminatorProperty = "@class")
-public abstract class AnyUR implements Serializable, AttributableUR {
+public abstract class AnyUR implements Serializable {
 
     private static final long serialVersionUID = -7445489774552440544L;
 
@@ -201,7 +201,6 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "plainAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("plainAttrs")
-    @Override
     public Set<AttrPatch> getPlainAttrs() {
         return plainAttrs;
     }
@@ -209,7 +208,6 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "virAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("virAttrs")
-    @Override
     public Set<AttrTO> getVirAttrs() {
         return virAttrs;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
similarity index 63%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
index cc01eda..8830e1c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
@@ -16,73 +16,105 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.to;
+package org.apache.syncope.common.lib.request;
 
-import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.jaxb.XmlGenericMapAdapter;
-import org.apache.syncope.common.lib.types.AnyTypeKind;
+import org.apache.syncope.common.lib.to.TypeExtensionTO;
 
-@XmlRootElement(name = "group")
+@XmlRootElement(name = "groupCR")
 @XmlType
-@Schema(allOf = { AnyTO.class })
-public class GroupTO extends AnyTO {
+@JsonPropertyOrder(value = { "@class", "name" })
+@Schema(allOf = { AnyCR.class })
+public class GroupCR extends AnyCR {
 
-    private static final long serialVersionUID = -7785920258290147542L;
+    private static final long serialVersionUID = -4559772531167385473L;
 
-    private String name;
+    public static class Builder extends AnyCR.Builder<GroupCR, Builder> {
 
-    private String userOwner;
+        @Override
+        protected GroupCR newInstance() {
+            return new GroupCR();
+        }
 
-    private String groupOwner;
+        public Builder name(final String name) {
+            getInstance().setName(name);
+            return this;
+        }
 
-    private String udynMembershipCond;
+        public Builder userOwner(final String userOwner) {
+            getInstance().setUserOwner(userOwner);
+            return this;
+        }
+
+        public Builder groupOwner(final String groupOwner) {
+            getInstance().setGroupOwner(groupOwner);
+            return this;
+        }
+
+        public Builder udynMembershipCond(final String udynMembershipCond) {
+            getInstance().setUDynMembershipCond(udynMembershipCond);
+            return this;
+        }
+
+        public Builder adynMembershipCond(final String type, final String fiql) {
+            getInstance().getADynMembershipConds().put(type, fiql);
+            return this;
+        }
+
+        public Builder typeExtension(final TypeExtensionTO typeExtension) {
+            getInstance().getTypeExtensions().add(typeExtension);
+            return this;
+        }
+
+        public Builder typeExtensions(final TypeExtensionTO... typeExtensions) {
+            getInstance().getTypeExtensions().addAll(Arrays.asList(typeExtensions));
+            return this;
+        }
+
+        public Builder typeExtensions(final Collection<TypeExtensionTO> typeExtensions) {
+            getInstance().getTypeExtensions().addAll(typeExtensions);
+            return this;
+        }
+    }
 
-    private int staticUserMembershipCount;
+    private String name;
 
-    private int dynamicUserMembershipCount;
+    private String userOwner;
 
-    private int staticAnyObjectMembershipCount;
+    private String groupOwner;
 
-    private int dynamicAnyObjectMembershipCount;
+    private String udynMembershipCond;
 
     @XmlJavaTypeAdapter(XmlGenericMapAdapter.class)
     private final Map<String, String> adynMembershipConds = new HashMap<>();
 
     private final List<TypeExtensionTO> typeExtensions = new ArrayList<>();
 
-    @XmlTransient
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.to.GroupTO")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.GroupCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
-    @Override
-    public String getType() {
-        return AnyTypeKind.GROUP.name();
-    }
-
-    @Override
-    public void setType(final String type) {
-        // fixed
-    }
-
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
     public String getName() {
         return name;
     }
@@ -115,54 +147,11 @@ public class GroupTO extends AnyTO {
         this.udynMembershipCond = uDynMembershipCond;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getStaticUserMembershipCount() {
-        return staticUserMembershipCount;
-    }
-
-    public void setStaticUserMembershipCount(final int staticUserMembershipCount) {
-        this.staticUserMembershipCount = staticUserMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getDynamicUserMembershipCount() {
-        return dynamicUserMembershipCount;
-    }
-
-    public void setDynamicUserMembershipCount(final int dynamicUserMembershipCount) {
-        this.dynamicUserMembershipCount = dynamicUserMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getStaticAnyObjectMembershipCount() {
-        return staticAnyObjectMembershipCount;
-    }
-
-    public void setStaticAnyObjectMembershipCount(final int staticAnyObjectMembershipCount) {
-        this.staticAnyObjectMembershipCount = staticAnyObjectMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getDynamicAnyObjectMembershipCount() {
-        return dynamicAnyObjectMembershipCount;
-    }
-
-    public void setDynamicAnyObjectMembershipCount(final int dynamicAnyObjectMembershipCount) {
-        this.dynamicAnyObjectMembershipCount = dynamicAnyObjectMembershipCount;
-    }
-
     @JsonProperty
     public Map<String, String> getADynMembershipConds() {
         return adynMembershipConds;
     }
 
-    @JsonIgnore
-    public Optional<TypeExtensionTO> getTypeExtension(final String anyType) {
-        return typeExtensions.stream().filter(
-                typeExtension -> anyType != null && anyType.equals(typeExtension.getAnyType())).
-                findFirst();
-    }
-
     @XmlElementWrapper(name = "typeExtensions")
     @XmlElement(name = "typeExtension")
     @JsonProperty("typeExtensions")
@@ -194,7 +183,7 @@ public class GroupTO extends AnyTO {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final GroupTO other = (GroupTO) obj;
+        final GroupCR other = (GroupCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(name, other.name).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
similarity index 93%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
index b79bf9c..dde21be 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
@@ -31,17 +31,17 @@ import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.AttrTO;
 
-@XmlRootElement(name = "membershipPatch")
+@XmlRootElement(name = "membershipUR")
 @XmlType
-public class MembershipPatch extends AbstractPatch {
+public class MembershipUR extends AbstractPatch {
 
     private static final long serialVersionUID = -6783121761221554433L;
 
-    public static class Builder extends AbstractPatch.Builder<MembershipPatch, Builder> {
+    public static class Builder extends AbstractPatch.Builder<MembershipUR, Builder> {
 
         @Override
-        protected MembershipPatch newInstance() {
-            return new MembershipPatch();
+        protected MembershipUR newInstance() {
+            return new MembershipUR();
         }
 
         public Builder group(final String group) {
@@ -129,7 +129,7 @@ public class MembershipPatch extends AbstractPatch {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final MembershipPatch other = (MembershipPatch) obj;
+        final MembershipUR other = (MembershipUR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(group, other.group).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
similarity index 89%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
index e777de7..d193fe8 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
@@ -24,17 +24,17 @@ import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "relationshipPatch")
+@XmlRootElement(name = "relationshipUR")
 @XmlType
-public class RelationshipPatch extends AbstractPatch {
+public class RelationshipUR extends AbstractPatch {
 
     private static final long serialVersionUID = 1314175521205206511L;
 
-    public static class Builder extends AbstractPatch.Builder<RelationshipPatch, Builder> {
+    public static class Builder extends AbstractPatch.Builder<RelationshipUR, Builder> {
 
         @Override
-        protected RelationshipPatch newInstance() {
-            return new RelationshipPatch();
+        protected RelationshipUR newInstance() {
+            return new RelationshipUR();
         }
 
         public Builder relationshipTO(final RelationshipTO relationshipTO) {
@@ -72,7 +72,7 @@ public class RelationshipPatch extends AbstractPatch {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final RelationshipPatch other = (RelationshipPatch) obj;
+        final RelationshipUR other = (RelationshipUR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(relationshipTO, other.relationshipTO).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
similarity index 56%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
index abe50cb..38929fa 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
@@ -18,11 +18,17 @@
  */
 package org.apache.syncope.common.lib.request;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Optional;
 import java.util.Set;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
@@ -30,195 +36,229 @@ import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
+import org.apache.syncope.common.lib.to.GroupableRelatableTO;
+import org.apache.syncope.common.lib.to.MembershipTO;
+import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "userUR")
+@XmlRootElement(name = "userCR")
 @XmlType
-@Schema(allOf = { AnyUR.class })
-public class UserUR extends AnyUR {
+@JsonPropertyOrder(value = { "@class", "username" })
+@Schema(allOf = { AnyCR.class })
+public class UserCR extends AnyCR implements GroupableRelatableTO {
 
-    private static final long serialVersionUID = 2872795537911821448L;
+    private static final long serialVersionUID = 2808404532469484940L;
 
-    public static class Builder extends AnyUR.Builder<UserUR, Builder> {
+    public static class Builder extends AnyCR.Builder<UserCR, Builder> {
 
         @Override
-        protected UserUR newInstance() {
-            return new UserUR();
+        protected UserCR newInstance() {
+            return new UserCR();
         }
 
-        public Builder username(final StringReplacePatchItem username) {
+        public Builder username(final String username) {
             getInstance().setUsername(username);
             return this;
         }
 
-        public Builder password(final PasswordPatch password) {
+        public Builder password(final String password) {
             getInstance().setPassword(password);
             return this;
         }
 
-        public Builder securityQuestion(final StringReplacePatchItem securityQuestion) {
+        public Builder storePassword(final boolean storePassword) {
+            getInstance().setStorePassword(storePassword);
+            return this;
+        }
+
+        public Builder securityQuestion(final String securityQuestion) {
             getInstance().setSecurityQuestion(securityQuestion);
             return this;
         }
 
-        public Builder securityAnswer(final StringReplacePatchItem securityAnswer) {
+        public Builder securityAnswer(final String securityAnswer) {
             getInstance().setSecurityAnswer(securityAnswer);
             return this;
         }
 
-        public Builder mustChangePassword(final BooleanReplacePatchItem mustChangePassword) {
+        public Builder mustChangePassword(final boolean mustChangePassword) {
             getInstance().setMustChangePassword(mustChangePassword);
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipTO relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipTO... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipTO> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipTO membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipTO... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipTO> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
 
-        public Builder role(final StringPatchItem role) {
+        public Builder role(final String role) {
             getInstance().getRoles().add(role);
             return this;
         }
 
-        public Builder roles(final StringPatchItem... roles) {
+        public Builder roles(final String... roles) {
             getInstance().getRoles().addAll(Arrays.asList(roles));
             return this;
         }
 
-        public Builder roles(final Collection<StringPatchItem> roles) {
+        public Builder roles(final Collection<String> roles) {
             getInstance().getRoles().addAll(roles);
             return this;
         }
     }
 
-    private StringReplacePatchItem username;
+    private String username;
+
+    private String password;
 
-    private PasswordPatch password;
+    private boolean storePassword = true;
 
-    private StringReplacePatchItem securityQuestion;
+    private String securityQuestion;
 
-    private StringReplacePatchItem securityAnswer;
+    private String securityAnswer;
 
-    private BooleanReplacePatchItem mustChangePassword;
+    private boolean mustChangePassword;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final List<RelationshipTO> relationships = new ArrayList<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final List<MembershipTO> memberships = new ArrayList<>();
 
-    private final Set<StringPatchItem> roles = new HashSet<>();
+    private final Set<String> roles = new HashSet<>();
 
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.UserUR")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.UserCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
-    public StringReplacePatchItem getUsername() {
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
+    public String getUsername() {
         return username;
     }
 
-    public void setUsername(final StringReplacePatchItem username) {
+    public void setUsername(final String username) {
         this.username = username;
     }
 
-    public PasswordPatch getPassword() {
+    public String getPassword() {
         return password;
     }
 
-    public void setPassword(final PasswordPatch password) {
+    public void setPassword(final String password) {
         this.password = password;
     }
 
-    public StringReplacePatchItem getSecurityQuestion() {
+    public boolean isStorePassword() {
+        return storePassword;
+    }
+
+    public void setStorePassword(final boolean storePassword) {
+        this.storePassword = storePassword;
+    }
+
+    public String getSecurityQuestion() {
         return securityQuestion;
     }
 
-    public void setSecurityQuestion(final StringReplacePatchItem securityQuestion) {
+    public void setSecurityQuestion(final String securityQuestion) {
         this.securityQuestion = securityQuestion;
     }
 
-    public StringReplacePatchItem getSecurityAnswer() {
+    public String getSecurityAnswer() {
         return securityAnswer;
     }
 
-    public void setSecurityAnswer(final StringReplacePatchItem securityAnswer) {
+    public void setSecurityAnswer(final String securityAnswer) {
         this.securityAnswer = securityAnswer;
     }
 
-    public BooleanReplacePatchItem getMustChangePassword() {
+    public boolean isMustChangePassword() {
         return mustChangePassword;
     }
 
-    public void setMustChangePassword(final BooleanReplacePatchItem mustChangePassword) {
+    public void setMustChangePassword(final boolean mustChangePassword) {
         this.mustChangePassword = mustChangePassword;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<RelationshipTO> getRelationship(final String type, final String otherKey) {
+        return relationships.stream().filter(
+                relationship -> type.equals(relationship.getType()) && otherKey.equals(relationship.getOtherEndKey())).
+                findFirst();
+    }
+
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    @Override
+    public List<RelationshipTO> getRelationships() {
         return relationships;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<MembershipTO> getMembership(final String groupKey) {
+        return memberships.stream().filter(membership -> groupKey.equals(membership.getGroupKey())).findFirst();
+    }
+
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    @Override
+    public List<MembershipTO> getMemberships() {
         return memberships;
     }
 
+    @Override
+    public List<MembershipTO> getDynMemberships() {
+        return Collections.emptyList();
+    }
+
     @XmlElementWrapper(name = "roles")
     @XmlElement(name = "role")
     @JsonProperty("roles")
-    public Set<StringPatchItem> getRoles() {
+    public Set<String> getRoles() {
         return roles;
     }
 
     @Override
-    public boolean isEmpty() {
-        return super.isEmpty()
-                && username == null && password == null && securityQuestion == null && securityAnswer == null
-                && mustChangePassword == null && relationships.isEmpty() && memberships.isEmpty() && roles.isEmpty();
-    }
-
-    @Override
     public int hashCode() {
         return new HashCodeBuilder().
                 appendSuper(super.hashCode()).
                 append(username).
-                append(password).
+                append(roles).
                 append(securityQuestion).
                 append(securityAnswer).
                 append(mustChangePassword).
                 append(relationships).
                 append(memberships).
-                append(roles).
                 build();
     }
 
@@ -233,16 +273,16 @@ public class UserUR extends AnyUR {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final UserUR other = (UserUR) obj;
+        final UserCR other = (UserCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(username, other.username).
+                append(roles, other.roles).
                 append(securityQuestion, other.securityQuestion).
                 append(securityAnswer, other.securityAnswer).
                 append(mustChangePassword, other.mustChangePassword).
                 append(relationships, other.relationships).
                 append(memberships, other.memberships).
-                append(roles, other.roles).
                 build();
     }
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
index abe50cb..bc5f854 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
@@ -70,32 +70,32 @@ public class UserUR extends AnyUR {
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipUR relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipUR... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipUR> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipUR membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipUR... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipUR> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
@@ -126,9 +126,9 @@ public class UserUR extends AnyUR {
 
     private BooleanReplacePatchItem mustChangePassword;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final Set<RelationshipUR> relationships = new HashSet<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final Set<MembershipUR> memberships = new HashSet<>();
 
     private final Set<StringPatchItem> roles = new HashSet<>();
 
@@ -182,14 +182,14 @@ public class UserUR extends AnyUR {
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    public Set<RelationshipUR> getRelationships() {
         return relationships;
     }
 
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    public Set<MembershipUR> getMemberships() {
         return memberships;
     }
 
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
index 7a4df9e..499fb93 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
@@ -19,7 +19,6 @@
 package org.apache.syncope.common.lib.to;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
-import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.Date;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.StringUtils;
@@ -67,7 +66,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
      */
     private Date lastChangeDate;
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getCreator() {
         return creator;
     }
@@ -76,7 +74,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         this.creator = creator;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getCreationDate() {
         if (creationDate != null) {
             return new Date(creationDate.getTime());
@@ -92,7 +89,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         }
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getLastModifier() {
         return lastModifier;
     }
@@ -101,7 +97,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         this.lastModifier = lastModifier;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getLastChangeDate() {
         if (lastChangeDate != null) {
             return new Date(lastChangeDate.getTime());
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
index a2b6a44..a2973f9 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
@@ -93,7 +93,6 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynMemberships")
     @XmlElement(name = "dynMembership")
     @JsonProperty("dynMemberships")
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
index d8bd896..2581013 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
@@ -41,7 +41,7 @@ import org.apache.commons.lang3.builder.HashCodeBuilder;
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
 @JsonPropertyOrder(value = { "@class", "key", "type", "realm", "username", "name" })
 @Schema(subTypes = { UserTO.class, GroupTO.class, AnyObjectTO.class }, discriminatorProperty = "@class")
-public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, AttributableTO {
+public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, AttributableReqEntity {
 
     private static final long serialVersionUID = -754311920679872084L;
 
@@ -59,7 +59,7 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
 
     private String status;
 
-    private final List<String> auxClasses = new ArrayList<>();
+    private final Set<String> auxClasses = new HashSet<>();
 
     private final Set<AttrTO> plainAttrs = new HashSet<>();
 
@@ -76,7 +76,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         // do nothing
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @Override
     public String getKey() {
         return key;
@@ -87,7 +86,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         this.key = key;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getType() {
         return type;
     }
@@ -96,15 +94,16 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         this.type = type;
     }
 
+    @Override
     public String getRealm() {
         return realm;
     }
 
+    @Override
     public void setRealm(final String realm) {
         this.realm = realm;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynRealms")
     @XmlElement(name = "dynRealmF")
     @JsonProperty("dynRealms")
@@ -112,7 +111,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         return dynRealms;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getStatus() {
         return status;
     }
@@ -124,7 +122,8 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
     @XmlElementWrapper(name = "auxClasses")
     @XmlElement(name = "class")
     @JsonProperty("auxClasses")
-    public List<String> getAuxClasses() {
+    @Override
+    public Set<String> getAuxClasses() {
         return auxClasses;
     }
 
@@ -173,6 +172,7 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
     @XmlElementWrapper(name = "resources")
     @XmlElement(name = "resource")
     @JsonProperty("resources")
+    @Override
     public Set<String> getResources() {
         return resources;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
similarity index 78%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
index 30b8396..8180a52 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
@@ -16,14 +16,17 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.request;
+package org.apache.syncope.common.lib.to;
 
 import java.util.Set;
-import org.apache.syncope.common.lib.to.AttrTO;
 
-public interface AttributableUR {
+public interface AttributableReqEntity extends AttributableTO {
 
-    Set<AttrPatch> getPlainAttrs();
+    String getRealm();
 
-    Set<AttrTO> getVirAttrs();
+    void setRealm(String realm);
+
+    Set<String> getAuxClasses();
+
+    Set<String> getResources();
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
index cc01eda..a7247d9 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
@@ -115,7 +115,6 @@ public class GroupTO extends AnyTO {
         this.udynMembershipCond = uDynMembershipCond;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getStaticUserMembershipCount() {
         return staticUserMembershipCount;
     }
@@ -124,7 +123,6 @@ public class GroupTO extends AnyTO {
         this.staticUserMembershipCount = staticUserMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getDynamicUserMembershipCount() {
         return dynamicUserMembershipCount;
     }
@@ -133,7 +131,6 @@ public class GroupTO extends AnyTO {
         this.dynamicUserMembershipCount = dynamicUserMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getStaticAnyObjectMembershipCount() {
         return staticAnyObjectMembershipCount;
     }
@@ -142,7 +139,6 @@ public class GroupTO extends AnyTO {
         this.staticAnyObjectMembershipCount = staticAnyObjectMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getDynamicAnyObjectMembershipCount() {
         return dynamicAnyObjectMembershipCount;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
index e27ecb0..65df20f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
@@ -24,6 +24,7 @@ import javax.ws.rs.PathParam;
 import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.syncope.common.lib.BaseBean;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 
@@ -39,7 +40,7 @@ public class RemediationTO extends BaseBean implements EntityTO {
 
     private ResourceOperation operation;
 
-    private AnyTO anyTOPayload;
+    private AnyCR anyCRPayload;
 
     private AnyUR anyURPayload;
 
@@ -85,12 +86,12 @@ public class RemediationTO extends BaseBean implements EntityTO {
     }
 
     @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public AnyTO getAnyTOPayload() {
-        return anyTOPayload;
+    public AnyCR getAnyCRPayload() {
+        return anyCRPayload;
     }
 
-    public void setAnyTOPayload(final AnyTO anyTOPayload) {
-        this.anyTOPayload = anyTOPayload;
+    public void setAnyCRPayload(final AnyCR anyCRPayload) {
+        this.anyCRPayload = anyCRPayload;
     }
 
     @Schema(accessMode = Schema.AccessMode.READ_ONLY)
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
index 4d1da53..5cad50c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
@@ -108,7 +108,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return roles;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynRoles")
     @XmlElement(name = "role")
     @JsonProperty("dynRoles")
@@ -123,7 +122,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return privileges;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getToken() {
         return token;
     }
@@ -132,7 +130,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.token = token;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getTokenExpireTime() {
         if (tokenExpireTime != null) {
             return new Date(tokenExpireTime.getTime());
@@ -158,7 +155,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.username = username;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getChangePwdDate() {
         if (changePwdDate != null) {
             return new Date(changePwdDate.getTime());
@@ -166,12 +162,10 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return null;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Integer getFailedLogins() {
         return failedLogins;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getLastLoginDate() {
         if (lastLoginDate != null) {
             return new Date(lastLoginDate.getTime());
@@ -215,7 +209,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.securityAnswer = securityAnswer;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public boolean isSuspended() {
         return suspended;
     }
@@ -224,7 +217,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.suspended = suspended;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public boolean isMustChangePassword() {
         return mustChangePassword;
     }
@@ -263,7 +255,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynMemberships")
     @XmlElement(name = "dynMembership")
     @JsonProperty("dynMemberships")
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java b/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
index 281a72e..9971f13 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
@@ -19,9 +19,13 @@
 package org.apache.syncope.common.lib.types;
 
 import javax.xml.bind.annotation.XmlEnum;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -31,25 +35,36 @@ import org.apache.syncope.common.lib.to.UserTO;
 @XmlEnum
 public enum AnyTypeKind {
 
-    USER(UserTO.class, UserUR.class),
-    GROUP(GroupTO.class, GroupUR.class),
-    ANY_OBJECT(AnyObjectTO.class, AnyObjectUR.class);
+    USER(UserTO.class, UserCR.class, UserUR.class),
+    GROUP(GroupTO.class, GroupCR.class, GroupUR.class),
+    ANY_OBJECT(AnyObjectTO.class, AnyObjectCR.class, AnyObjectUR.class);
 
     private final Class<? extends AnyTO> toClass;
 
-    private final Class<? extends AnyUR> reqClass;
+    private final Class<? extends AnyCR> crClass;
+
+    private final Class<? extends AnyUR> urClass;
+
+    AnyTypeKind(
+            final Class<? extends AnyTO> toClass,
+            final Class<? extends AnyCR> crClass,
+            final Class<? extends AnyUR> urClass) {
 
-    AnyTypeKind(final Class<? extends AnyTO> toClass, final Class<? extends AnyUR> reqClass) {
         this.toClass = toClass;
-        this.reqClass = reqClass;
+        this.crClass = crClass;
+        this.urClass = urClass;
     }
 
     public Class<? extends AnyTO> getTOClass() {
         return toClass;
     }
 
+    public Class<? extends AnyCR> getCRClass() {
+        return crClass;
+    }
+
     public Class<? extends AnyUR> getURClass() {
-        return reqClass;
+        return urClass;
     }
 
     public static AnyTypeKind fromTOClass(final Class<? extends AnyTO> clazz) {
diff --git a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
index 7ef5c24..780fc30 100644
--- a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
+++ b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
@@ -100,8 +100,7 @@ public class JSONTest {
         StringWriter writer = new StringWriter();
         mapper.writeValue(writer, original);
 
-        ProvisioningResult<GroupTO> actual = mapper.readValue(
-                writer.toString(), new TypeReference<ProvisioningResult<GroupTO>>() {
+        ProvisioningResult<GroupTO> actual = mapper.readValue(writer.toString(), new TypeReference<ProvisioningResult<GroupTO>>() {
         });
         assertEquals(original, actual);
     }
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
index 4a28787..3388b7c 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
@@ -37,6 +37,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.PagedResult;
@@ -71,7 +72,7 @@ public interface AnyObjectService extends AnyService<AnyObjectTO> {
     /**
      * Creates a new any object.
      *
-     * @param anyObjectTO any object to be created
+     * @param createReq any object create request
      * @return Response object featuring Location header of created any object as well as the any
      * object itself enriched with propagation status information
      */
@@ -105,7 +106,7 @@ public interface AnyObjectService extends AnyService<AnyObjectTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull AnyObjectTO anyObjectTO);
+    Response create(@NotNull AnyObjectCR createReq);
 
     /**
      * Updates any object matching the provided key.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
index 21aee3c..17ed036 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
@@ -40,6 +40,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.ExecTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -76,7 +77,7 @@ public interface GroupService extends AnyService<GroupTO> {
     /**
      * Creates a new group.
      *
-     * @param groupTO group to be created
+     * @param createReq group create request
      * @return Response object featuring Location header of created group as well as the any
      * object itself enriched with propagation status information
      */
@@ -109,7 +110,7 @@ public interface GroupService extends AnyService<GroupTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull GroupTO groupTO);
+    Response create(@NotNull GroupCR createReq);
 
     /**
      * Updates group matching the provided key.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
index f3c4e84..71b172e 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
@@ -41,8 +41,8 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
@@ -95,7 +95,7 @@ public interface RemediationService extends JAXRSService {
      * Perform remediation by creating the provided user, group or any object.
      *
      * @param remediationKey key for remediation to act on
-     * @param anyTO user, group or any object to create
+     * @param createReq user, group or any object to create
      * @return Response object featuring Location header of created object as well as the object itself
      * enriched with propagation status information
      */
@@ -131,7 +131,7 @@ public interface RemediationService extends JAXRSService {
     @Path("{remediationKey}")
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response remedy(@NotNull @PathParam("remediationKey") String remediationKey, @NotNull AnyTO anyTO);
+    Response remedy(@NotNull @PathParam("remediationKey") String remediationKey, @NotNull AnyCR createReq);
 
     /**
      * Perform remediation by updating the provided user, group or any object.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
index e278f70..923642e 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
@@ -31,7 +31,6 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import javax.validation.constraints.NotNull;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
 import javax.ws.rs.GET;
 import javax.ws.rs.PATCH;
 import javax.ws.rs.POST;
@@ -43,6 +42,7 @@ import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -82,8 +82,7 @@ public interface UserSelfService extends JAXRSService {
     /**
      * Self-registration for new user.
      *
-     * @param userTO user to be created
-     * @param storePassword whether password shall be stored internally
+     * @param createReq user to be created
      * @return Response object featuring Location header of self-registered user as well as the user itself
      * enriched with propagation status information
      */
@@ -111,8 +110,7 @@ public interface UserSelfService extends JAXRSService {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull UserTO userTO,
-            @DefaultValue("true") @QueryParam("storePassword") boolean storePassword);
+    Response create(@NotNull UserCR createReq);
 
     /**
      * Self-updates user.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
index e54c181..aef50d1 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
@@ -30,16 +30,15 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirements;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import javax.validation.constraints.NotNull;
 import javax.ws.rs.Consumes;
-import javax.ws.rs.DefaultValue;
 import javax.ws.rs.PATCH;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -74,8 +73,7 @@ public interface UserService extends AnyService<UserTO> {
     /**
      * Creates a new user.
      *
-     * @param userTO user to be created
-     * @param storePassword whether password shall be stored internally
+     * @param createReq user create request
      * @return Response object featuring Location header of created user as well as the user itself
      * enriched with propagation status information
      */
@@ -108,9 +106,7 @@ public interface UserService extends AnyService<UserTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(
-            @NotNull UserTO userTO,
-            @DefaultValue("true") @QueryParam("storePassword") boolean storePassword);
+    Response create(@NotNull UserCR createReq);
 
     /**
      * Updates user matching the provided key.
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
index 31329a6..9ae073c 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
@@ -22,15 +22,16 @@ import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
-import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
 import org.apache.syncope.core.persistence.api.dao.AnyDAO;
@@ -50,7 +51,8 @@ import org.apache.syncope.core.provisioning.api.utils.RealmUtils;
 import org.apache.syncope.core.spring.ImplementationManager;
 import org.springframework.beans.factory.annotation.Autowired;
 
-public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extends AbstractResourceAssociator<TO> {
+public abstract class AbstractAnyLogic<TO extends AnyTO, C extends AnyCR, U extends AnyUR>
+        extends AbstractResourceAssociator<TO> {
 
     @Autowired
     protected UserDAO userDAO;
@@ -84,7 +86,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
         return actions;
     }
 
-    protected Pair<TO, List<LogicActions>> beforeCreate(final TO input) {
+    protected Pair<C, List<LogicActions>> beforeCreate(final C input) {
         Realm realm = realmDAO.findByFullPath(input.getRealm());
         if (realm == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -92,32 +94,34 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             throw sce;
         }
 
-        AnyType anyType = input instanceof UserTO
-                ? anyTypeDAO.findUser()
-                : input instanceof GroupTO
-                        ? anyTypeDAO.findGroup()
-                        : anyTypeDAO.find(input.getType());
+        AnyType anyType = null;
+        if (input instanceof UserCR) {
+            anyType = anyTypeDAO.findUser();
+        } else if (input instanceof GroupCR) {
+            anyType = anyTypeDAO.findGroup();
+        } else if (input instanceof AnyObjectCR) {
+            anyType = anyTypeDAO.find(((AnyObjectCR) input).getType());
+        }
         if (anyType == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidAnyType);
-            sce.getElements().add(input.getType());
             throw sce;
         }
 
-        TO any = input;
+        C anyCR = input;
 
-        templateUtils.apply(any, realm.getTemplate(anyType));
+        templateUtils.apply(anyCR, realm.getTemplate(anyType));
 
         List<LogicActions> actions = getActions(realm);
         for (LogicActions action : actions) {
-            any = action.beforeCreate(any);
+            anyCR = action.beforeCreate(anyCR);
         }
 
-        LOG.debug("Input: {}\nOutput: {}\n", input, any);
+        LOG.debug("Input: {}\nOutput: {}\n", input, anyCR);
 
-        return ImmutablePair.of(any, actions);
+        return Pair.of(anyCR, actions);
     }
 
-    protected Pair<R, List<LogicActions>> beforeUpdate(final R input, final String realmPath) {
+    protected Pair<U, List<LogicActions>> beforeUpdate(final U input, final String realmPath) {
         Realm realm = realmDAO.findByFullPath(realmPath);
         if (realm == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -125,7 +129,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             throw sce;
         }
 
-        R mod = input;
+        U mod = input;
 
         List<LogicActions> actions = getActions(realm);
         for (LogicActions action : actions) {
@@ -134,7 +138,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
 
         LOG.debug("Input: {}\nOutput: {}\n", input, mod);
 
-        return ImmutablePair.of(mod, actions);
+        return Pair.of(mod, actions);
     }
 
     protected Pair<TO, List<LogicActions>> beforeDelete(final TO input) {
@@ -154,7 +158,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
 
         LOG.debug("Input: {}\nOutput: {}\n", input, any);
 
-        return ImmutablePair.of(any, actions);
+        return Pair.of(any, actions);
     }
 
     protected ProvisioningResult<TO> afterCreate(
@@ -253,7 +257,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             String realm,
             boolean details);
 
-    public abstract ProvisioningResult<TO> update(R updateReq, boolean nullPriorityAsync);
+    public abstract ProvisioningResult<TO> update(U updateReq, boolean nullPriorityAsync);
 
     public abstract ProvisioningResult<TO> delete(String key, boolean nullPriorityAsync);
 }
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
index 5ed80cf..05efdb7 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
@@ -28,6 +28,7 @@ import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -56,7 +57,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectUR> {
+public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectCR, AnyObjectUR> {
 
     @Autowired
     protected AnySearchDAO searchDAO;
@@ -99,8 +100,8 @@ public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectUR> {
         return Pair.of(count, result);
     }
 
-    public ProvisioningResult<AnyObjectTO> create(final AnyObjectTO anyObjectTO, final boolean nullPriorityAsync) {
-        Pair<AnyObjectTO, List<LogicActions>> before = beforeCreate(anyObjectTO);
+    public ProvisioningResult<AnyObjectTO> create(final AnyObjectCR createReq, final boolean nullPriorityAsync) {
+        Pair<AnyObjectCR, List<LogicActions>> before = beforeCreate(createReq);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
index 0da1b9d..a7aa6a0 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
@@ -33,6 +33,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -81,7 +82,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupUR> {
+public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupCR, GroupUR> {
 
     @Resource(name = "adminUser")
     protected String adminUser;
@@ -173,8 +174,8 @@ public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupUR> {
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.GROUP_CREATE + "')")
-    public ProvisioningResult<GroupTO> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
-        Pair<GroupTO, List<LogicActions>> before = beforeCreate(groupTO);
+    public ProvisioningResult<GroupTO> create(final GroupCR createReq, final boolean nullPriorityAsync) {
+        Pair<GroupCR, List<LogicActions>> before = beforeCreate(createReq);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
index 5757665..e22f157 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
@@ -24,16 +24,16 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
-import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.StandardEntitlement;
 import org.apache.syncope.core.persistence.api.dao.NotFoundException;
 import org.apache.syncope.core.persistence.api.dao.RemediationDAO;
@@ -104,7 +104,7 @@ public class RemediationLogic extends AbstractTransactionalLogic<RemediationTO>
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.REMEDIATION_REMEDY + "')")
-    public ProvisioningResult<?> remedy(final String key, final AnyTO anyTO, final boolean nullPriorityAsync) {
+    public ProvisioningResult<?> remedy(final String key, final AnyCR anyCR, final boolean nullPriorityAsync) {
         Remediation remediation = remediationDAO.find(key);
         if (remediation == null) {
             LOG.error("Could not find remediation '" + key + "'");
@@ -116,15 +116,15 @@ public class RemediationLogic extends AbstractTransactionalLogic<RemediationTO>
         switch (remediation.getAnyType().getKind()) {
             case USER:
             default:
-                result = userLogic.create((UserTO) anyTO, true, nullPriorityAsync);
+                result = userLogic.create((UserCR) anyCR, nullPriorityAsync);
                 break;
 
             case GROUP:
-                result = groupLogic.create((GroupTO) anyTO, nullPriorityAsync);
+                result = groupLogic.create((GroupCR) anyCR, nullPriorityAsync);
                 break;
 
             case ANY_OBJECT:
-                result = anyObjectLogic.create((AnyObjectTO) anyTO, nullPriorityAsync);
+                result = anyObjectLogic.create((AnyObjectCR) anyCR, nullPriorityAsync);
         }
 
         remediationDAO.delete(remediation);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
index e970b10..06674d0 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
@@ -33,6 +33,7 @@ import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -65,7 +66,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
+public class UserLogic extends AbstractAnyLogic<UserTO, UserCR, UserUR> {
 
     @Autowired
     protected AnySearchDAO searchDAO;
@@ -125,26 +126,21 @@ public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
     }
 
     @PreAuthorize("isAnonymous() or hasRole('" + StandardEntitlement.ANONYMOUS + "')")
-    public ProvisioningResult<UserTO> selfCreate(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return doCreate(userTO, storePassword, true, nullPriorityAsync);
+    public ProvisioningResult<UserTO> selfCreate(final UserCR createReq, final boolean nullPriorityAsync) {
+        return doCreate(createReq, true, nullPriorityAsync);
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.USER_CREATE + "')")
-    public ProvisioningResult<UserTO> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return doCreate(userTO, storePassword, false, nullPriorityAsync);
+    public ProvisioningResult<UserTO> create(final UserCR createReq, final boolean nullPriorityAsync) {
+        return doCreate(createReq, false, nullPriorityAsync);
     }
 
     protected ProvisioningResult<UserTO> doCreate(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR userCR,
             final boolean self,
             final boolean nullPriorityAsync) {
 
-        Pair<UserTO, List<LogicActions>> before = beforeCreate(userTO);
+        Pair<UserCR, List<LogicActions>> before = beforeCreate(userCR);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -157,8 +153,7 @@ public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
             securityChecks(effectiveRealms, before.getLeft().getRealm(), null);
         }
 
-        Pair<String, List<PropagationStatus>> created =
-                provisioningManager.create(before.getLeft(), storePassword, nullPriorityAsync);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(before.getLeft(), nullPriorityAsync);
 
         return afterCreate(
                 binder.returnUserTO(binder.getUserTO(created.getKey())), created.getRight(), before.getRight());
diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
index 7103352..d9b53c3 100644
--- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
+++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
@@ -20,6 +20,7 @@ package org.apache.syncope.core.persistence.api.entity;
 
 import java.lang.reflect.Field;
 import java.util.Set;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
@@ -50,7 +51,9 @@ public interface AnyUtils {
 
     <T extends AnyTO> T newAnyTO();
 
-    <P extends AnyUR> P newAnyUR(String key);
+    <C extends AnyCR> C newAnyCR();
+
+    <U extends AnyUR> U newAnyUR(String key);
 
     <A extends Any<?>> AnyDAO<A> dao();
 
diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
index cbca8ea..3504a16 100644
--- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
+++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
@@ -19,8 +19,8 @@
 package org.apache.syncope.core.persistence.api.entity;
 
 import java.util.Date;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.task.PullTask;
 
@@ -34,15 +34,15 @@ public interface Remediation extends Entity {
 
     void setOperation(ResourceOperation operation);
 
-    void setPayload(AnyTO anyTO);
+    void setPayload(AnyCR anyCR);
 
     void setPayload(AnyUR anyUR);
 
     void setPayload(String key);
 
-    <T extends AnyTO> T getPayloadAsTO(Class<T> reference);
+    <C extends AnyCR> C getPayloadAsCR(Class<C> reference);
 
-    <P extends AnyUR> P getPayloadAsUR(Class<P> reference);
+    <U extends AnyUR> U getPayloadAsUR(Class<U> reference);
 
     String getPayloadAsKey();
 
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
index 5914353..46e5215 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
@@ -27,9 +27,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.apache.commons.lang3.ClassUtils;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -308,20 +312,43 @@ public class JPAAnyUtils implements AnyUtils {
     }
 
     @Override
-    public <P extends AnyUR> P newAnyUR(final String key) {
-        P result = null;
+    public <C extends AnyCR> C newAnyCR() {
+        C result = null;
 
         switch (anyTypeKind) {
             case USER:
-                result = (P) new UserUR();
+                result = (C) new UserCR();
                 break;
 
             case GROUP:
-                result = (P) new GroupUR();
+                result = (C) new GroupCR();
                 break;
 
             case ANY_OBJECT:
-                result = (P) new AnyObjectUR();
+                result = (C) new AnyObjectCR();
+                break;
+
+            default:
+        }
+
+        return result;
+    }
+
+    @Override
+    public <U extends AnyUR> U newAnyUR(final String key) {
+        U result = null;
+
+        switch (anyTypeKind) {
+            case USER:
+                result = (U) new UserUR();
+                break;
+
+            case GROUP:
+                result = (U) new GroupUR();
+                break;
+
+            case ANY_OBJECT:
+                result = (U) new AnyObjectUR();
                 break;
 
             default:
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
index 87f9c9e..d93c6fe 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
@@ -28,8 +28,8 @@ import javax.persistence.Table;
 import javax.persistence.Temporal;
 import javax.persistence.TemporalType;
 import javax.validation.constraints.NotNull;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.AnyType;
 import org.apache.syncope.core.persistence.api.entity.Remediation;
@@ -94,12 +94,12 @@ public class JPARemediation extends AbstractGeneratedKeyEntity implements Remedi
     }
 
     @Override
-    public <T extends AnyTO> T getPayloadAsTO(final Class<T> reference) {
+    public <C extends AnyCR> C getPayloadAsCR(final Class<C> reference) {
         return POJOHelper.deserialize(this.payload, reference);
     }
 
     @Override
-    public <P extends AnyUR> P getPayloadAsUR(final Class<P> reference) {
+    public <U extends AnyUR> U getPayloadAsUR(final Class<U> reference) {
         return POJOHelper.deserialize(this.payload, reference);
     }
 
@@ -109,8 +109,8 @@ public class JPARemediation extends AbstractGeneratedKeyEntity implements Remedi
     }
 
     @Override
-    public void setPayload(final AnyTO anyTO) {
-        this.payload = POJOHelper.serialize(anyTO);
+    public void setPayload(final AnyCR anyCR) {
+        this.payload = POJOHelper.serialize(anyCR);
     }
 
     @Override
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
index 4a8a468..98ab4a1 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
@@ -31,7 +31,7 @@ public class RemediationValidator extends AbstractValidator<RemediationCheck, Re
 
         switch (remediation.getOperation()) {
             case CREATE:
-                if (remediation.getPayloadAsTO(remediation.getAnyType().getKind().getTOClass()) == null) {
+                if (remediation.getPayloadAsCR(remediation.getAnyType().getKind().getCRClass()) == null) {
                     context.disableDefaultConstraintViolation();
                     context.buildConstraintViolationWithTemplate(
                             getTemplate(EntityViolationType.InvalidRemediation,
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
index 8937684..7fe4064 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
@@ -22,14 +22,15 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 
-public interface AnyObjectProvisioningManager extends ProvisioningManager<AnyObjectTO, AnyObjectUR> {
+public interface AnyObjectProvisioningManager extends ProvisioningManager<AnyObjectTO, AnyObjectCR, AnyObjectUR> {
 
     Pair<String, List<PropagationStatus>> create(
-            AnyObjectTO anyObjectTO, Set<String> excludedResources, boolean nullPriorityAsync);
+            AnyObjectCR anyObjectCR, Set<String> excludedResources, boolean nullPriorityAsync);
 
     List<PropagationStatus> provision(String key, Collection<String> resources, boolean nullPriorityAsync);
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
index 94e850f..4278be4 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
@@ -23,18 +23,18 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.GroupTO;
 
-public interface GroupProvisioningManager extends ProvisioningManager<GroupTO, GroupUR> {
+public interface GroupProvisioningManager extends ProvisioningManager<GroupTO, GroupCR, GroupUR> {
 
     Pair<String, List<PropagationStatus>> create(
-            GroupTO groupTO,
+            GroupCR groupCR,
             Map<String, String> groupOwnerMap,
             Set<String> excludedResources,
             boolean nullPriorityAsync);
 
     List<PropagationStatus> provision(String key, Collection<String> resources, boolean nullPriorityAsync);
-
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
index a5d952d..4c57dee 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 
@@ -26,7 +27,7 @@ import org.apache.syncope.common.lib.to.AnyTO;
  */
 public interface LogicActions {
 
-    default <A extends AnyTO> A beforeCreate(A input) {
+    default <C extends AnyCR> C beforeCreate(C input) {
         return input;
     }
 
@@ -34,7 +35,7 @@ public interface LogicActions {
         return input;
     }
 
-    default <P extends AnyUR> P beforeUpdate(P input) {
+    default <U extends AnyUR> U beforeUpdate(U input) {
         return input;
     }
 
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
index 2672f9d..99ab5b1 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
@@ -22,26 +22,26 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 
-public interface ProvisioningManager<T extends AnyTO, R extends AnyUR> {
+public interface ProvisioningManager<T extends AnyTO, C extends AnyCR, U extends AnyUR> {
 
-    Pair<String, List<PropagationStatus>> create(T anyTO, boolean nullPriorityAsync);
+    Pair<String, List<PropagationStatus>> create(C anyCR, boolean nullPriorityAsync);
 
-    Pair<R, List<PropagationStatus>> update(R anyUR, boolean nullPriorityAsync);
+    Pair<U, List<PropagationStatus>> update(U anyUR, boolean nullPriorityAsync);
 
-    Pair<R, List<PropagationStatus>> update(R anyUR, Set<String> excludedResources, boolean nullPriorityAsync);
+    Pair<U, List<PropagationStatus>> update(U anyUR, Set<String> excludedResources, boolean nullPriorityAsync);
 
     List<PropagationStatus> delete(String anyKey, boolean nullPriorityAsync);
 
     List<PropagationStatus> delete(String anyKey, Set<String> excludedResources, boolean nullPriorityAsync);
 
-    String unlink(R anyUR);
+    String unlink(U anyUR);
 
-    String link(R anyUR);
+    String link(U anyUR);
 
     List<PropagationStatus> deprovision(String anyKey, Collection<String> resources, boolean nullPriorityAsync);
-
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
index 91e4a02..b397149 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
@@ -23,12 +23,13 @@ import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningReport;
 
-public interface UserProvisioningManager extends ProvisioningManager<UserTO, UserUR> {
+public interface UserProvisioningManager extends ProvisioningManager<UserTO, UserCR, UserUR> {
 
     Pair<String, List<PropagationStatus>> activate(StatusR statusR, boolean nullPriorityAsync);
 
@@ -38,11 +39,8 @@ public interface UserProvisioningManager extends ProvisioningManager<UserTO, Use
 
     void internalSuspend(String key);
 
-    Pair<String, List<PropagationStatus>> create(UserTO userTO, boolean storePassword, boolean nullPriorityAsync);
-
     Pair<String, List<PropagationStatus>> create(
-            UserTO userTO,
-            boolean storePassword,
+            UserCR userCR,
             boolean disablePwdPolicyCheck,
             Boolean enabled,
             Set<String> excludedResources,
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
index 6669188..2fb8cb6 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api.data;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -29,7 +30,7 @@ public interface AnyObjectDataBinder {
 
     AnyObjectTO getAnyObjectTO(AnyObject anyObject, boolean details);
 
-    void create(AnyObject anyObject, AnyObjectTO anyObjectTO);
+    void create(AnyObject anyObject, AnyObjectCR anyObjectCR);
 
     PropagationByResource update(AnyObject toBeUpdated, AnyObjectUR anyObjectUR);
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
index 0570af3..0b13456 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
@@ -19,6 +19,7 @@
 package org.apache.syncope.core.provisioning.api.data;
 
 import java.util.Map;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.TypeExtensionTO;
@@ -34,7 +35,7 @@ public interface GroupDataBinder {
 
     GroupTO getGroupTO(Group group, boolean details);
 
-    void create(Group group, GroupTO groupTO);
+    void create(Group group, GroupCR groupCR);
 
     PropagationByResource update(Group group, GroupUR groupUR);
 
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
index fe9800b..43dc841 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api.data;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -33,7 +34,7 @@ public interface UserDataBinder {
 
     UserTO getUserTO(User user, boolean details);
 
-    void create(User user, UserTO userTO, boolean storePassword);
+    void create(User user, UserCR userCR);
 
     /**
      * Update user, given {@link UserUR}.
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
index 1bf9d0b..1a1a578 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
@@ -18,8 +18,10 @@
  */
 package org.apache.syncope.core.provisioning.api.pushpull;
 
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.EntityTO;
+import org.apache.syncope.common.lib.to.RealmTO;
 import org.identityconnectors.framework.common.objects.SyncDelta;
 import org.quartz.JobExecutionException;
 
@@ -48,13 +50,29 @@ public interface PullActions extends ProvisioningActions {
      *
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
-     * @param entity entity
+     * @param createReq create request
      * @throws JobExecutionException in case of generic failure
      */
     default void beforeProvision(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
-            EntityTO entity) throws JobExecutionException {
+            AnyCR createReq) throws JobExecutionException {
+    }
+
+    /**
+     * Action to be executed before to create a pulled realm locally.
+     * The realm is created locally upon pull in case of the un-matching rule
+     * {@link org.apache.syncope.common.lib.types.UnmatchingRule#PROVISION} (default un-matching rule) is applied.
+     *
+     * @param profile profile of the pull being executed.
+     * @param delta retrieved pull information
+     * @param realm realm
+     * @throws JobExecutionException in case of generic failure
+     */
+    default void beforeProvision(
+            ProvisioningProfile<?, ?> profile,
+            SyncDelta delta,
+            RealmTO realm) throws JobExecutionException {
     }
 
     /**
@@ -64,13 +82,29 @@ public interface PullActions extends ProvisioningActions {
      *
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
-     * @param entity entity
+     * @param createReq create request
      * @throws JobExecutionException in case of generic failure
      */
     default void beforeAssign(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
-            EntityTO entity) throws JobExecutionException {
+            AnyCR createReq) throws JobExecutionException {
+    }
+
+    /**
+     * Action to be executed before creating (and linking to the resource) a pulled realm locally.
+     * The realm is created locally and linked to the pulled resource upon pull in case of the
+     * un-matching rule {@link org.apache.syncope.common.lib.types.UnmatchingRule#ASSIGN} is applied.
+     *
+     * @param profile profile of the pull being executed.
+     * @param delta retrieved pull information
+     * @param realm realm
+     * @throws JobExecutionException in case of generic failure
+     */
+    default void beforeAssign(
+            ProvisioningProfile<?, ?> profile,
+            SyncDelta delta,
+            RealmTO realm) throws JobExecutionException {
     }
 
     /**
@@ -142,18 +176,17 @@ public interface PullActions extends ProvisioningActions {
      * The entity is updated upon pull in case of the matching rule
      * {@link org.apache.syncope.common.lib.types.MatchingRule#UPDATE} (default matching rule) is applied.
      *
-     * @param <P> any object modifications
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
      * @param entity entity
      * @param anyUR modification
      * @throws JobExecutionException in case of generic failure.
      */
-    default <P extends AnyUR> void beforeUpdate(
+    default void beforeUpdate(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
             EntityTO entity,
-            P anyUR) throws JobExecutionException {
+            AnyUR anyUR) throws JobExecutionException {
     }
 
     /**
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
index b1be404..3f601e0 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
@@ -24,9 +24,9 @@ import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
@@ -63,24 +63,24 @@ public class DefaultAnyObjectProvisioningManager implements AnyObjectProvisionin
 
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final boolean nullPriorityAsync) {
+            final AnyObjectCR anyObjectCR, final boolean nullPriorityAsync) {
 
-        return create(anyObjectTO, Collections.<String>emptySet(), nullPriorityAsync);
+        return create(anyObjectCR, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final Set<String> excludedResources, final boolean nullPriorityAsync) {
+            final AnyObjectCR anyObjectCR, final Set<String> excludedResources, final boolean nullPriorityAsync) {
 
-        WorkflowResult<String> created = awfAdapter.create(anyObjectTO);
+        WorkflowResult<String> created = awfAdapter.create(anyObjectCR);
 
         List<PropagationTaskInfo> taskInfos = propagationManager.getCreateTasks(
                 AnyTypeKind.ANY_OBJECT,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                anyObjectTO.getVirAttrs(),
+                anyObjectCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
index 69de66b..6b14f25 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
@@ -28,9 +28,9 @@ import java.util.stream.Collectors;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
@@ -68,15 +68,15 @@ public class DefaultGroupProvisioningManager implements GroupProvisioningManager
     protected VirAttrHandler virtAttrHandler;
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
-        WorkflowResult<String> created = gwfAdapter.create(groupTO);
+    public Pair<String, List<PropagationStatus>> create(final GroupCR groupCR, final boolean nullPriorityAsync) {
+        WorkflowResult<String> created = gwfAdapter.create(groupCR);
 
         List<PropagationTaskInfo> tasks = propagationManager.getCreateTasks(
                 AnyTypeKind.GROUP,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                groupTO.getVirAttrs(),
+                groupCR.getVirAttrs(),
                 Collections.<String>emptySet());
         PropagationReporter propagationReporter = taskExecutor.execute(tasks, nullPriorityAsync);
 
@@ -86,23 +86,23 @@ public class DefaultGroupProvisioningManager implements GroupProvisioningManager
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final GroupTO groupTO,
+            final GroupCR groupCR,
             final Map<String, String> groupOwnerMap,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
 
-        WorkflowResult<String> created = gwfAdapter.create(groupTO);
+        WorkflowResult<String> created = gwfAdapter.create(groupCR);
 
         // see ConnObjectUtils#getAnyTOFromConnObject for GroupOwnerSchema
-        groupTO.getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
-                -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().iterator().next()));
+        groupCR.getPlainAttrs().stream().filter(attr -> StringUtils.EMPTY.equals(attr.getSchema())).findFirst().
+                ifPresent(groupOwner -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().get(0)));
 
         List<PropagationTaskInfo> tasks = propagationManager.getCreateTasks(
                 AnyTypeKind.GROUP,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                groupTO.getVirAttrs(),
+                groupCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(tasks, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
index 4d1a69a..9847ed4 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
@@ -29,9 +29,9 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
@@ -75,36 +75,27 @@ public class DefaultUserProvisioningManager implements UserProvisioningManager {
     protected UserDAO userDAO;
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final UserTO userTO, final boolean nullPriorityAsync) {
-        return create(userTO, true, false, null, Collections.<String>emptySet(), nullPriorityAsync);
-    }
-
-    @Override
-    public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return create(userTO, storePassword, false, null, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final UserCR userCR, final boolean nullPriorityAsync) {
+        return create(userCR, false, null, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
             final Boolean enabled,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
 
-        WorkflowResult<Pair<String, Boolean>> created =
-                uwfAdapter.create(userTO, disablePwdPolicyCheck, enabled, storePassword);
+        WorkflowResult<Pair<String, Boolean>> created = uwfAdapter.create(userCR, disablePwdPolicyCheck, enabled);
 
         List<PropagationTaskInfo> taskInfos = propagationManager.getUserCreateTasks(
                 created.getResult().getLeft(),
-                userTO.getPassword(),
+                userCR.getPassword(),
                 created.getResult().getRight(),
                 created.getPropByRes(),
-                userTO.getVirAttrs(),
+                userCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
index a4b8443..c33e9db 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
@@ -31,6 +31,7 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
@@ -434,13 +435,13 @@ abstract class AbstractAnyDataBinder {
     @SuppressWarnings({ "unchecked", "rawtypes" })
     protected void fill(
             final Any any,
-            final AnyTO anyTO,
+            final AnyCR anyCR,
             final AnyUtils anyUtils,
             final SyncopeClientCompositeException scce) {
 
         // 0. aux classes
         any.getAuxClasses().clear();
-        anyTO.getAuxClasses().stream().
+        anyCR.getAuxClasses().stream().
                 map(className -> anyTypeClassDAO.find(className)).
                 forEachOrdered(auxClass -> {
                     if (auxClass == null) {
@@ -453,7 +454,7 @@ abstract class AbstractAnyDataBinder {
         // 1. attributes
         SyncopeClientException invalidValues = SyncopeClientException.build(ClientExceptionType.InvalidValues);
 
-        anyTO.getPlainAttrs().stream().
+        anyCR.getPlainAttrs().stream().
                 filter(attrTO -> !attrTO.getValues().isEmpty()).
                 forEach(attrTO -> {
                     PlainSchema schema = getPlainSchema(attrTO.getSchema());
@@ -484,7 +485,7 @@ abstract class AbstractAnyDataBinder {
         }
 
         // 2. resources
-        anyTO.getResources().forEach(resourceKey -> {
+        anyCR.getResources().forEach(resourceKey -> {
             ExternalResource resource = resourceDAO.find(resourceKey);
             if (resource == null) {
                 LOG.debug("Invalid " + ExternalResource.class.getSimpleName() + " {}, ignoring...", resourceKey);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
index a6e3f17..02325d6 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
@@ -31,6 +31,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -131,11 +132,11 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
     }
 
     @Override
-    public void create(final AnyObject anyObject, final AnyObjectTO anyObjectTO) {
-        AnyType type = anyTypeDAO.find(anyObjectTO.getType());
+    public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) {
+        AnyType type = anyTypeDAO.find(anyObjectCR.getType());
         if (type == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidAnyType);
-            sce.getElements().add(anyObjectTO.getType());
+            sce.getElements().add(anyObjectCR.getType());
             throw sce;
         }
         anyObject.setType(type);
@@ -144,19 +145,19 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
 
         // name
         SyncopeClientException invalidGroups = SyncopeClientException.build(ClientExceptionType.InvalidGroup);
-        if (anyObjectTO.getName() == null) {
+        if (anyObjectCR.getName() == null) {
             LOG.error("No name specified for this anyObject");
 
             invalidGroups.getElements().add("No name specified for this anyObject");
         } else {
-            anyObject.setName(anyObjectTO.getName());
+            anyObject.setName(anyObjectCR.getName());
         }
 
         // realm
-        Realm realm = realmDAO.findByFullPath(anyObjectTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(anyObjectCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + anyObjectTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + anyObjectCR.getRealm());
             scce.addException(noRealm);
         }
         anyObject.setRealm(realm);
@@ -164,7 +165,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
         AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.ANY_OBJECT);
         if (anyObject.getRealm() != null) {
             // relationships
-            anyObjectTO.getRelationships().forEach(relationshipTO -> {
+            anyObjectCR.getRelationships().forEach(relationshipTO -> {
                 if (StringUtils.isBlank(relationshipTO.getOtherEndType())
                         || AnyTypeKind.USER.name().equals(relationshipTO.getOtherEndType())
                         || AnyTypeKind.GROUP.name().equals(relationshipTO.getOtherEndType())) {
@@ -202,7 +203,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
             });
 
             // memberships
-            anyObjectTO.getMemberships().forEach(membershipTO -> {
+            anyObjectCR.getMemberships().forEach(membershipTO -> {
                 Group group = membershipTO.getGroupKey() == null
                         ? groupDAO.findByName(membershipTO.getGroupName())
                         : groupDAO.find(membershipTO.getGroupKey());
@@ -230,7 +231,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
         }
 
         // attributes and resources
-        fill(anyObject, anyObjectTO, anyUtils, scce);
+        fill(anyObject, anyObjectCR, anyUtils, scce);
 
         // Throw composite exception if there is at least one element set in the composing exceptions
         if (scce.hasExceptions()) {
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
index b960fd7..d14a7f5 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
@@ -27,6 +27,7 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.TypeExtensionTO;
@@ -95,54 +96,54 @@ public class GroupDataBinderImpl extends AbstractAnyDataBinder implements GroupD
     }
 
     @Override
-    public void create(final Group group, final GroupTO groupTO) {
+    public void create(final Group group, final GroupCR groupCR) {
         SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
 
         // name
         SyncopeClientException invalidGroups = SyncopeClientException.build(ClientExceptionType.InvalidGroup);
-        if (groupTO.getName() == null) {
+        if (groupCR.getName() == null) {
             LOG.error("No name specified for this group");
 
             invalidGroups.getElements().add("No name specified for this group");
         } else {
-            group.setName(groupTO.getName());
+            group.setName(groupCR.getName());
         }
 
         // realm
-        Realm realm = realmDAO.findByFullPath(groupTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(groupCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + groupTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + groupCR.getRealm());
             scce.addException(noRealm);
         }
         group.setRealm(realm);
 
         // attributes and resources
-        fill(group, groupTO, anyUtilsFactory.getInstance(AnyTypeKind.GROUP), scce);
+        fill(group, groupCR, anyUtilsFactory.getInstance(AnyTypeKind.GROUP), scce);
 
         // owner
-        if (groupTO.getUserOwner() != null) {
-            User owner = userDAO.find(groupTO.getUserOwner());
+        if (groupCR.getUserOwner() != null) {
+            User owner = userDAO.find(groupCR.getUserOwner());
             if (owner == null) {
-                LOG.warn("Ignoring invalid user specified as owner: {}", groupTO.getUserOwner());
+                LOG.warn("Ignoring invalid user specified as owner: {}", groupCR.getUserOwner());
             } else {
                 group.setUserOwner(owner);
             }
         }
-        if (groupTO.getGroupOwner() != null) {
-            Group owner = groupDAO.find(groupTO.getGroupOwner());
+        if (groupCR.getGroupOwner() != null) {
+            Group owner = groupDAO.find(groupCR.getGroupOwner());
             if (owner == null) {
-                LOG.warn("Ignoring invalid group specified as owner: {}", groupTO.getGroupOwner());
+                LOG.warn("Ignoring invalid group specified as owner: {}", groupCR.getGroupOwner());
             } else {
                 group.setGroupOwner(owner);
             }
         }
 
         // dynamic membership
-        if (groupTO.getUDynMembershipCond() != null) {
-            setDynMembership(group, anyTypeDAO.findUser(), groupTO.getUDynMembershipCond());
+        if (groupCR.getUDynMembershipCond() != null) {
+            setDynMembership(group, anyTypeDAO.findUser(), groupCR.getUDynMembershipCond());
         }
-        groupTO.getADynMembershipConds().forEach((type, fiql) -> {
+        groupCR.getADynMembershipConds().forEach((type, fiql) -> {
             AnyType anyType = anyTypeDAO.find(type);
             if (anyType == null) {
                 LOG.warn("Ignoring invalid {}: {}", AnyType.class.getSimpleName(), type);
@@ -152,7 +153,7 @@ public class GroupDataBinderImpl extends AbstractAnyDataBinder implements GroupD
         });
 
         // type extensions
-        groupTO.getTypeExtensions().forEach(typeExtTO -> {
+        groupCR.getTypeExtensions().forEach(typeExtTO -> {
             AnyType anyType = anyTypeDAO.find(typeExtTO.getAnyType());
             if (anyType == null) {
                 LOG.warn("Ignoring invalid {}: {}", AnyType.class.getSimpleName(), typeExtTO.getAnyType());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
index 0430295..5ae4b8b 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
@@ -37,8 +37,8 @@ public class RemediationDataBinderImpl implements RemediationDataBinder {
 
         switch (remediation.getOperation()) {
             case CREATE:
-                remediationTO.setAnyTOPayload(
-                        remediation.getPayloadAsTO(remediation.getAnyType().getKind().getTOClass()));
+                remediationTO.setAnyCRPayload(
+                        remediation.getPayloadAsCR(remediation.getAnyType().getKind().getCRClass()));
                 break;
 
             case UPDATE:
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
index c31bbbb..79e7e03 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
@@ -37,6 +37,7 @@ import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -144,32 +145,32 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
     }
 
     @Override
-    public void create(final User user, final UserTO userTO, final boolean storePassword) {
+    public void create(final User user, final UserCR userCR) {
         SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
 
         // set username
-        user.setUsername(userTO.getUsername());
+        user.setUsername(userCR.getUsername());
 
         // set password
-        if (StringUtils.isBlank(userTO.getPassword()) || !storePassword) {
+        if (StringUtils.isBlank(userCR.getPassword()) || !userCR.isStorePassword()) {
             LOG.debug("Password was not provided or not required to be stored");
         } else {
-            setPassword(user, userTO.getPassword(), scce);
+            setPassword(user, userCR.getPassword(), scce);
         }
 
-        user.setMustChangePassword(userTO.isMustChangePassword());
+        user.setMustChangePassword(userCR.isMustChangePassword());
 
         // security question / answer
-        if (userTO.getSecurityQuestion() != null) {
-            SecurityQuestion securityQuestion = securityQuestionDAO.find(userTO.getSecurityQuestion());
+        if (userCR.getSecurityQuestion() != null) {
+            SecurityQuestion securityQuestion = securityQuestionDAO.find(userCR.getSecurityQuestion());
             if (securityQuestion != null) {
                 user.setSecurityQuestion(securityQuestion);
             }
         }
-        user.setSecurityAnswer(userTO.getSecurityAnswer());
+        user.setSecurityAnswer(userCR.getSecurityAnswer());
 
         // roles
-        userTO.getRoles().forEach(roleKey -> {
+        userCR.getRoles().forEach(roleKey -> {
             Role role = roleDAO.find(roleKey);
             if (role == null) {
                 LOG.warn("Ignoring unknown role with id {}", roleKey);
@@ -179,10 +180,10 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         });
 
         // realm
-        Realm realm = realmDAO.findByFullPath(userTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(userCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + userTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + userCR.getRealm());
             scce.addException(noRealm);
         }
         user.setRealm(realm);
@@ -190,7 +191,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.USER);
         if (user.getRealm() != null) {
             // relationships
-            userTO.getRelationships().forEach(relationshipTO -> {
+            userCR.getRelationships().forEach(relationshipTO -> {
                 AnyObject otherEnd = anyObjectDAO.find(relationshipTO.getOtherEndKey());
                 if (otherEnd == null) {
                     LOG.debug("Ignoring invalid anyObject " + relationshipTO.getOtherEndKey());
@@ -217,7 +218,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
             });
 
             // memberships
-            userTO.getMemberships().forEach(membershipTO -> {
+            userCR.getMemberships().forEach(membershipTO -> {
                 Group group = membershipTO.getGroupKey() == null
                         ? groupDAO.findByName(membershipTO.getGroupName())
                         : groupDAO.find(membershipTO.getGroupKey());
@@ -245,7 +246,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         }
 
         // attributes and resources
-        fill(user, userTO, anyUtils, scce);
+        fill(user, userCR, anyUtils, scce);
 
         // Throw composite exception if there is at least one element set in the composing exceptions
         if (scce.hasExceptions()) {
@@ -421,7 +422,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
                     plainAttrValueDAO.deleteAll(attr, anyUtils);
                     plainAttrDAO.delete(attr);
                 });
-                
+
                 if (membPatch.getOperation() == PatchOperation.DELETE) {
                     groupDAO.findAllResourceKeys(membership.getRightEnd().getKey()).stream().
                             filter(resource -> reasons.containsKey(resource)).
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
index a404e05..4fca9f2 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
@@ -22,7 +22,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.provisioning.api.UserProvisioningManager;
@@ -74,8 +74,7 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> before = membershipsBefore.get(user);
                         if (before == null || !before.contains(group)) {
-                            userUR.getMemberships().add(
-                                    new MembershipPatch.Builder().
+                            userUR.getMemberships().add(new MembershipUR.Builder().
                                             operation(PatchOperation.ADD_REPLACE).
                                             group(group).
                                             build());
@@ -95,8 +94,7 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> after = membershipsAfter.get(user);
                         if (after == null || !after.contains(group)) {
-                            userUR.getMemberships().add(
-                                    new MembershipPatch.Builder().
+                            userUR.getMemberships().add(new MembershipUR.Builder().
                                             operation(PatchOperation.DELETE).
                                             group(group).
                                             build());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
index 566403c..22cfee1 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
@@ -24,6 +24,7 @@ import java.util.Date;
 import java.util.List;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -99,11 +100,13 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
 
     protected abstract String getName(AnyTO anyTO);
 
-    protected abstract ProvisioningManager<?, ?> getProvisioningManager();
+    protected abstract String getName(AnyCR anyCR);
 
-    protected abstract AnyTO doCreate(AnyTO anyTO, SyncDelta delta);
+    protected abstract ProvisioningManager<?, ?, ?> getProvisioningManager();
 
-    protected abstract AnyUR doUpdate(AnyTO before, AnyUR req, SyncDelta delta, ProvisioningReport result);
+    protected abstract AnyTO doCreate(AnyCR anyCR, SyncDelta delta);
+
+    protected abstract AnyUR doUpdate(AnyTO before, AnyUR anyUR, SyncDelta delta, ProvisioningReport result);
 
     @Override
     public void setPullExecutor(final SyncopePullExecutor executor) {
@@ -182,14 +185,14 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             return Collections.<ProvisioningReport>emptyList();
         }
 
-        AnyTO anyTO = connObjectUtils.getAnyTO(delta.getObject(), profile.getTask(), provision, anyUtils);
-        anyTO.getResources().add(profile.getTask().getResource().getKey());
+        AnyCR anyCR = connObjectUtils.getAnyCR(delta.getObject(), profile.getTask(), provision, anyUtils);
+        anyCR.getResources().add(profile.getTask().getResource().getKey());
 
         ProvisioningReport result = new ProvisioningReport();
         result.setOperation(ResourceOperation.CREATE);
         result.setAnyType(provision.getAnyType().getKey());
         result.setStatus(ProvisioningReport.Status.SUCCESS);
-        result.setName(getName(anyTO));
+        result.setName(getName(anyCR));
         result.setUidValue(delta.getUid().getUidValue());
 
         if (profile.isDryRun()) {
@@ -197,10 +200,10 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             finalize(UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), Result.SUCCESS, null, null, delta);
         } else {
             for (PullActions action : profile.getActions()) {
-                action.beforeAssign(profile, delta, anyTO);
+                action.beforeAssign(profile, delta, anyCR);
             }
 
-            create(anyTO, delta, UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), provision, result);
+            create(anyCR, delta, UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), provision, result);
         }
 
         return Collections.singletonList(result);
@@ -216,13 +219,13 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             return Collections.<ProvisioningReport>emptyList();
         }
 
-        AnyTO anyTO = connObjectUtils.getAnyTO(delta.getObject(), profile.getTask(), provision, anyUtils);
+        AnyCR anyCR = connObjectUtils.getAnyCR(delta.getObject(), profile.getTask(), provision, anyUtils);
 
         ProvisioningReport result = new ProvisioningReport();
         result.setOperation(ResourceOperation.CREATE);
         result.setAnyType(provision.getAnyType().getKey());
         result.setStatus(ProvisioningReport.Status.SUCCESS);
-        result.setName(getName(anyTO));
+        result.setName(getName(anyCR));
         result.setUidValue(delta.getUid().getUidValue());
 
         if (profile.isDryRun()) {
@@ -230,10 +233,10 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             finalize(UnmatchingRule.toEventName(UnmatchingRule.PROVISION), Result.SUCCESS, null, null, delta);
         } else {
             for (PullActions action : profile.getActions()) {
-                action.beforeProvision(profile, delta, anyTO);
+                action.beforeProvision(profile, delta, anyCR);
             }
 
-            create(anyTO, delta, UnmatchingRule.toEventName(UnmatchingRule.PROVISION), provision, result);
+            create(anyCR, delta, UnmatchingRule.toEventName(UnmatchingRule.PROVISION), provision, result);
         }
 
         return Collections.singletonList(result);
@@ -258,7 +261,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
     }
 
     protected void create(
-            final AnyTO anyTO,
+            final AnyCR anyCR,
             final SyncDelta delta,
             final String operation,
             final Provision provision,
@@ -269,7 +272,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
         Result resultStatus;
 
         try {
-            AnyTO created = doCreate(anyTO, delta);
+            AnyTO created = doCreate(anyCR, delta);
             output = created;
             result.setKey(created.getKey());
             result.setName(getName(created));
@@ -283,7 +286,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
         } catch (PropagationException e) {
             // A propagation failure doesn't imply a pull failure.
             // The propagation exception status will be reported into the propagation task execution.
-            LOG.error("Could not propagate {} {}", anyTO.getType(), delta.getUid().getUidValue(), e);
+            LOG.error("Could not propagate {} {}", provision.getAnyType().getKey(), delta.getUid().getUidValue(), e);
             output = e;
             resultStatus = Result.FAILURE;
         } catch (Exception e) {
@@ -291,7 +294,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
 
             result.setStatus(ProvisioningReport.Status.FAILURE);
             result.setMessage(ExceptionUtils.getRootCauseMessage(e));
-            LOG.error("Could not create {} {} ", anyTO.getType(), delta.getUid().getUidValue(), e);
+            LOG.error("Could not create {} {} ", provision.getAnyType().getKey(), delta.getUid().getUidValue(), e);
             output = e;
             resultStatus = Result.FAILURE;
 
@@ -299,7 +302,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
                 Remediation entity = entityFactory.newEntity(Remediation.class);
                 entity.setAnyType(provision.getAnyType());
                 entity.setOperation(ResourceOperation.CREATE);
-                entity.setPayload(anyTO);
+                entity.setPayload(anyCR);
                 entity.setError(result.getMessage());
                 entity.setInstant(new Date());
                 entity.setRemoteName(delta.getObject().getName().getNameValue());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
index f5251f0..d177613 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
@@ -19,8 +19,10 @@
 package org.apache.syncope.core.provisioning.java.pushpull;
 
 import java.util.Optional;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -63,21 +65,21 @@ public class DBPasswordPullActions implements PullActions {
     public void beforeProvision(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
-            final EntityTO any) throws JobExecutionException {
+            final AnyCR anyCR) throws JobExecutionException {
 
-        if (any instanceof UserTO) {
-            String password = ((UserTO) any).getPassword();
+        if (anyCR instanceof UserCR) {
+            String password = ((UserCR) anyCR).getPassword();
             parseEncodedPassword(password, profile.getConnector());
         }
     }
 
     @Transactional(readOnly = true)
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (anyUR instanceof UserUR) {
             PasswordPatch modPassword = ((UserUR) anyUR).getPassword();
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
index 5fc6a17..08ae663 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
@@ -22,6 +22,8 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -53,7 +55,12 @@ public class DefaultAnyObjectPullResultHandler extends AbstractPullResultHandler
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return AnyObjectCR.class.cast(anyCR).getName();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return anyObjectProvisioningManager;
     }
 
@@ -68,11 +75,11 @@ public class DefaultAnyObjectPullResultHandler extends AbstractPullResultHandler
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        AnyObjectTO anyObjectTO = AnyObjectTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        AnyObjectCR anyObjectCR = AnyObjectCR.class.cast(anyCR);
 
         Map.Entry<String, List<PropagationStatus>> created = anyObjectProvisioningManager.create(
-                anyObjectTO, Collections.singleton(profile.getTask().getResource().getKey()), true);
+                anyObjectCR, Collections.singleton(profile.getTask().getResource().getKey()), true);
 
         return getAnyTO(created.getKey());
     }
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
index 2cc291c..e4be81d 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
@@ -23,8 +23,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -63,7 +65,12 @@ public class DefaultGroupPullResultHandler extends AbstractPullResultHandler imp
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return GroupCR.class.cast(anyCR).getName();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return groupProvisioningManager;
     }
 
@@ -78,11 +85,11 @@ public class DefaultGroupPullResultHandler extends AbstractPullResultHandler imp
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        GroupTO groupTO = GroupTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        GroupCR groupCR = GroupCR.class.cast(anyCR);
 
         Map.Entry<String, List<PropagationStatus>> created = groupProvisioningManager.create(
-                groupTO,
+                groupCR,
                 groupOwnerMap,
                 Collections.singleton(profile.getTask().getResource().getKey()),
                 true);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
index ede43f2..f16b77b 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
@@ -22,7 +22,9 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -53,7 +55,12 @@ public class DefaultUserPullResultHandler extends AbstractPullResultHandler impl
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return UserCR.class.cast(anyCR).getUsername();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return userProvisioningManager;
     }
 
@@ -69,12 +76,12 @@ public class DefaultUserPullResultHandler extends AbstractPullResultHandler impl
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        UserTO userTO = UserTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        UserCR userCR = UserCR.class.cast(anyCR);
 
         Boolean enabled = pullUtils.readEnabled(delta.getObject(), profile.getTask());
         Map.Entry<String, List<PropagationStatus>> created =
-                userProvisioningManager.create(userTO, true, true, enabled,
+                userProvisioningManager.create(userCR, true, enabled,
                         Collections.singleton(profile.getTask().getResource().getKey()), true);
 
         return getAnyTO(created.getKey());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
index 969571d..b2a26af 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
@@ -129,11 +129,11 @@ public class LDAPMembershipPullActions extends SchedulingPullActions {
      */
     @Transactional(readOnly = true)
     @Override
-    public <P extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entity,
-            final P anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (!(entity instanceof GroupTO)) {
             super.beforeUpdate(profile, delta, entity, anyUR);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
index fcc6384..3618cf8 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
@@ -20,8 +20,10 @@ package org.apache.syncope.core.provisioning.java.pushpull;
 
 import java.util.Base64;
 import javax.xml.bind.DatatypeConverter;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -58,21 +60,21 @@ public class LDAPPasswordPullActions implements PullActions {
     public void beforeProvision(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
-            final EntityTO entity) throws JobExecutionException {
+            final AnyCR anyCR) throws JobExecutionException {
 
-        if (entity instanceof UserTO) {
-            String password = ((UserTO) entity).getPassword();
+        if (anyCR instanceof UserCR) {
+            String password = ((UserCR) anyCR).getPassword();
             parseEncodedPassword(password);
         }
     }
 
     @Transactional(readOnly = true)
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (anyUR instanceof UserUR) {
             PasswordPatch modPassword = ((UserUR) anyUR).getPassword();
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
index a7acb6f..d971f46 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
@@ -25,7 +25,10 @@ import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -148,34 +151,34 @@ public class ConnObjectUtils {
     }
 
     /**
-     * Build a UserTO / GroupTO / AnyObjectTO out of connector object attributes and schema mapping.
+     * Build a UserCR / GroupCR / AnyObjectCR out of connector object attributes and schema mapping.
      *
      * @param obj connector object
      * @param pullTask pull task
      * @param provision provision information
      * @param anyUtils utils
-     * @param <T> any object
      * @return UserTO for the user to be created
      */
     @Transactional(readOnly = true)
-    public <T extends AnyTO> T getAnyTO(
+    public AnyCR getAnyCR(
             final ConnectorObject obj,
             final PullTask pullTask,
             final Provision provision,
             final AnyUtils anyUtils) {
 
-        T anyTO = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
+        AnyTO anyTO = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
+        AnyCR anyCR = anyUtils.newAnyCR();
+        EntityTOUtils.toAnyCR(anyTO, anyCR);
 
         // (for users) if password was not set above, generate if resource is configured for that
-        if (anyTO instanceof UserTO
-                && StringUtils.isBlank(((UserTO) anyTO).getPassword())
+        if (anyCR instanceof UserCR
+                && StringUtils.isBlank(((UserCR) anyCR).getPassword())
                 && provision.getResource().isRandomPwdIfNotProvided()) {
 
-            UserTO userTO = (UserTO) anyTO;
-
+            UserCR userCR = (UserCR) anyCR;
             List<PasswordPolicy> passwordPolicies = new ArrayList<>();
 
-            Realm realm = realmDAO.findByFullPath(userTO.getRealm());
+            Realm realm = realmDAO.findByFullPath(userCR.getRealm());
             if (realm != null) {
                 realmDAO.findAncestors(realm).stream().
                         filter(ancestor -> ancestor.getPasswordPolicy() != null).
@@ -184,7 +187,7 @@ public class ConnObjectUtils {
                         });
             }
 
-            userTO.getResources().stream().
+            userCR.getResources().stream().
                     map(resource -> resourceDAO.find(resource)).
                     filter(resource -> resource != null && resource.getPasswordPolicy() != null).
                     forEach(resource -> {
@@ -195,24 +198,14 @@ public class ConnObjectUtils {
             try {
                 password = passwordGenerator.generate(passwordPolicies);
             } catch (InvalidPasswordRuleConf e) {
-                LOG.error("Could not generate policy-compliant random password for {}", userTO, e);
+                LOG.error("Could not generate policy-compliant random password for {}", userCR, e);
 
                 password = SecureRandomUtils.generateRandomPassword(16);
             }
-            userTO.setPassword(password);
+            userCR.setPassword(password);
         }
 
-        return anyTO;
-    }
-
-    public RealmTO getRealmTO(final ConnectorObject obj, final PullTask task, final OrgUnit orgUnit) {
-        RealmTO realmTO = new RealmTO();
-
-        MappingUtils.getPullItems(orgUnit.getItems()).forEach(item -> {
-            mappingManager.setIntValues(item, obj.getAttributeByName(item.getExtAttrName()), realmTO);
-        });
-
-        return realmTO;
+        return anyCR;
     }
 
     /**
@@ -224,12 +217,12 @@ public class ConnObjectUtils {
      * @param pullTask pull task
      * @param provision provision information
      * @param anyUtils utils
-     * @param <T> any object
+     * @param <U> any object
      * @return modifications for the any object to be updated
      */
     @SuppressWarnings("unchecked")
     @Transactional(readOnly = true)
-    public <T extends AnyUR> T getAnyUR(
+    public <U extends AnyUR> U getAnyUR(
             final String key,
             final ConnectorObject obj,
             final AnyTO original,
@@ -240,7 +233,7 @@ public class ConnObjectUtils {
         AnyTO updated = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
         updated.setKey(key);
 
-        T anyUR = null;
+        U anyUR = null;
         if (null != anyUtils.anyTypeKind()) {
             switch (anyUtils.anyTypeKind()) {
                 case USER:
@@ -263,7 +256,7 @@ public class ConnObjectUtils {
                     updatedUser.setSecurityQuestion(updatedUser.getSecurityQuestion());
                     updatedUser.setMustChangePassword(originalUser.isMustChangePassword());
 
-                    anyUR = (T) AnyOperations.diff(updatedUser, originalUser, true);
+                    anyUR = (U) AnyOperations.diff(updatedUser, originalUser, true);
                     break;
 
                 case GROUP:
@@ -279,7 +272,7 @@ public class ConnObjectUtils {
                     updatedGroup.getADynMembershipConds().putAll(originalGroup.getADynMembershipConds());
                     updatedGroup.getTypeExtensions().addAll(originalGroup.getTypeExtensions());
 
-                    anyUR = (T) AnyOperations.diff(updatedGroup, originalGroup, true);
+                    anyUR = (U) AnyOperations.diff(updatedGroup, originalGroup, true);
                     break;
 
                 case ANY_OBJECT:
@@ -290,7 +283,7 @@ public class ConnObjectUtils {
                         updatedAnyObject.setName(originalAnyObject.getName());
                     }
 
-                    anyUR = (T) AnyOperations.diff(updatedAnyObject, originalAnyObject, true);
+                    anyUR = (U) AnyOperations.diff(updatedAnyObject, originalAnyObject, true);
                     break;
 
                 default:
@@ -323,4 +316,14 @@ public class ConnObjectUtils {
 
         return anyTO;
     }
+
+    public RealmTO getRealmTO(final ConnectorObject obj, final PullTask task, final OrgUnit orgUnit) {
+        RealmTO realmTO = new RealmTO();
+
+        MappingUtils.getPullItems(orgUnit.getItems()).forEach(item -> {
+            mappingManager.setIntValues(item, obj.getAttributeByName(item.getExtAttrName()), realmTO);
+        });
+
+        return realmTO;
+    }
 }
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
index 228952d..65abf2f 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
@@ -24,9 +24,12 @@ import org.apache.commons.jexl3.MapContext;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.AttributableReqEntity;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.GroupableRelatableTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -66,7 +69,7 @@ public class TemplateUtils {
         return result;
     }
 
-    private void fill(final AnyTO anyTO, final AnyTO template) {
+    private void fill(final AttributableReqEntity anyTO, final AttributableReqEntity template) {
         MapContext jexlContext = new MapContext();
         JexlUtils.addFieldsToContext(anyTO, jexlContext);
         JexlUtils.addAttrTOsToContext(anyTO.getPlainAttrs(), jexlContext);
@@ -138,61 +141,81 @@ public class TemplateUtils {
     }
 
     @Transactional(readOnly = true)
-    public <T extends AnyTO> void apply(final T anyTO, final Optional<? extends AnyTemplate> anyTemplate) {
-        if (anyTemplate.isPresent()) {
-            apply(anyTO, anyTemplate.get().get());
+    public void apply(final AttributableReqEntity reqEntity, final Optional<? extends AnyTemplate> template) {
+        if (template.isPresent()) {
+            apply(reqEntity, template.get().get());
         }
     }
 
     @Transactional(readOnly = true)
-    public <T extends AnyTO> void apply(final T anyTO, final AnyTO template) {
-        fill(anyTO, template);
+    public void apply(final AttributableReqEntity reqEntity, final AnyTO template) {
+        fill(reqEntity, template);
 
         MapContext jexlContext = new MapContext();
-        JexlUtils.addFieldsToContext(anyTO, jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getPlainAttrs(), jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getDerAttrs(), jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getVirAttrs(), jexlContext);
+        JexlUtils.addFieldsToContext(reqEntity, jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getPlainAttrs(), jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getDerAttrs(), jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getVirAttrs(), jexlContext);
 
         if (template instanceof AnyObjectTO) {
-            fillRelationships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            fillMemberships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
+            fillRelationships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            fillMemberships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
         } else if (template instanceof UserTO) {
             if (StringUtils.isNotBlank(((UserTO) template).getUsername())) {
                 String evaluated = JexlUtils.evaluate(((UserTO) template).getUsername(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((UserTO) anyTO).setUsername(evaluated);
+                    if (reqEntity instanceof UserTO) {
+                        ((UserTO) reqEntity).setUsername(evaluated);
+                    } else if (reqEntity instanceof UserCR) {
+                        ((UserCR) reqEntity).setUsername(evaluated);
+                    }
                 }
             }
 
             if (StringUtils.isNotBlank(((UserTO) template).getPassword())) {
                 String evaluated = JexlUtils.evaluate(((UserTO) template).getPassword(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((UserTO) anyTO).setPassword(evaluated);
+                    if (reqEntity instanceof UserTO) {
+                        ((UserTO) reqEntity).setPassword(evaluated);
+                    } else if (reqEntity instanceof UserCR) {
+                        ((UserCR) reqEntity).setPassword(evaluated);
+                    }
                 }
             }
 
-            fillRelationships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            fillMemberships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            ((UserTO) anyTO).getRoles().addAll(((UserTO) template).getRoles());
+            fillRelationships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            fillMemberships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            ((UserTO) reqEntity).getRoles().addAll(((UserTO) template).getRoles());
         } else if (template instanceof GroupTO) {
             if (StringUtils.isNotBlank(((GroupTO) template).getName())) {
                 String evaluated = JexlUtils.evaluate(((GroupTO) template).getName(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((GroupTO) anyTO).setName(evaluated);
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setName(evaluated);
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setName(evaluated);
+                    }
                 }
             }
 
             if (((GroupTO) template).getUserOwner() != null) {
                 final User userOwner = userDAO.find(((GroupTO) template).getUserOwner());
                 if (userOwner != null) {
-                    ((GroupTO) anyTO).setUserOwner(userOwner.getKey());
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setUserOwner(userOwner.getKey());
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setUserOwner(userOwner.getKey());
+                    }
                 }
             }
             if (((GroupTO) template).getGroupOwner() != null) {
                 final Group groupOwner = groupDAO.find(((GroupTO) template).getGroupOwner());
                 if (groupOwner != null) {
-                    ((GroupTO) anyTO).setGroupOwner(groupOwner.getKey());
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setGroupOwner(groupOwner.getKey());
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setGroupOwner(groupOwner.getKey());
+                    }
                 }
             }
         }
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
index 79a2ac3..3277109 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
@@ -29,6 +29,7 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
@@ -55,13 +56,13 @@ import org.apache.syncope.core.persistence.api.dao.search.SearchCond;
 import org.apache.syncope.core.provisioning.api.serialization.POJOHelper;
 import org.apache.syncope.core.spring.security.SecureRandomUtils;
 
-public abstract class AbstractAnyService<TO extends AnyTO, UR extends AnyUR>
+public abstract class AbstractAnyService<TO extends AnyTO, CR extends AnyCR, UR extends AnyUR>
         extends AbstractServiceImpl
         implements AnyService<TO> {
 
     protected abstract AnyDAO<?> getAnyDAO();
 
-    protected abstract AbstractAnyLogic<TO, UR> getAnyLogic();
+    protected abstract AbstractAnyLogic<TO, CR, UR> getAnyLogic();
 
     protected abstract UR newUpdateReq(String key);
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
index 8bcb7be..7660562 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
@@ -21,6 +21,7 @@ package org.apache.syncope.core.rest.cxf.service;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.search.SpecialAttr;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -37,7 +38,8 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObjectUR> implements AnyObjectService {
+public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObjectCR, AnyObjectUR>
+        implements AnyObjectService {
 
     @Autowired
     private AnyObjectDAO anyObjectDAO;
@@ -51,7 +53,7 @@ public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObj
     }
 
     @Override
-    protected AbstractAnyLogic<AnyObjectTO, AnyObjectUR> getAnyLogic() {
+    protected AbstractAnyLogic<AnyObjectTO, AnyObjectCR, AnyObjectUR> getAnyLogic() {
         return logic;
     }
 
@@ -61,8 +63,8 @@ public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObj
     }
 
     @Override
-    public Response create(final AnyObjectTO anyObjectTO) {
-        ProvisioningResult<AnyObjectTO> created = logic.create(anyObjectTO, isNullPriorityAsync());
+    public Response create(final AnyObjectCR createReq) {
+        ProvisioningResult<AnyObjectTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
index 3f453c5..855dd87 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
@@ -20,6 +20,7 @@ package org.apache.syncope.core.rest.cxf.service;
 
 import java.util.List;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.ExecTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -34,7 +35,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> implements GroupService {
+public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupCR, GroupUR> implements GroupService {
 
     @Autowired
     private GroupDAO groupDAO;
@@ -48,7 +49,7 @@ public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> imple
     }
 
     @Override
-    protected AbstractAnyLogic<GroupTO, GroupUR> getAnyLogic() {
+    protected AbstractAnyLogic<GroupTO, GroupCR, GroupUR> getAnyLogic() {
         return logic;
     }
 
@@ -58,8 +59,8 @@ public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> imple
     }
 
     @Override
-    public Response create(final GroupTO groupTO) {
-        ProvisioningResult<GroupTO> created = logic.create(groupTO, isNullPriorityAsync());
+    public Response create(final GroupCR createReq) {
+        ProvisioningResult<GroupTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
index e6965e5..a0141c5 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
@@ -22,8 +22,8 @@ import java.util.Date;
 import java.util.List;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
@@ -72,8 +72,8 @@ public class RemediationServiceImpl extends AbstractServiceImpl implements Remed
     }
 
     @Override
-    public Response remedy(final String remediationKey, final AnyTO anyTO) {
-        ProvisioningResult<?> created = logic.remedy(remediationKey, anyTO, isNullPriorityAsync());
+    public Response remedy(final String remediationKey, final AnyCR anyCR) {
+        ProvisioningResult<?> created = logic.remedy(remediationKey, anyCR, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
index 1227609..2a0e2d3 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
@@ -23,6 +23,7 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -44,14 +45,14 @@ public class UserSelfServiceImpl extends AbstractServiceImpl implements UserSelf
     private SyncopeLogic syncopeLogic;
 
     @Override
-    public Response create(final UserTO userTO, final boolean storePassword) {
+    public Response create(final UserCR createReq) {
         if (!syncopeLogic.isSelfRegAllowed()) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.DelegatedAdministration);
             sce.getElements().add("Self registration forbidden by configuration");
             throw sce;
         }
 
-        ProvisioningResult<UserTO> created = logic.selfCreate(userTO, storePassword, isNullPriorityAsync());
+        ProvisioningResult<UserTO> created = logic.selfCreate(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
index 29648f1..79d4023 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
@@ -21,6 +21,7 @@ package org.apache.syncope.core.rest.cxf.service;
 import java.util.Date;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -33,7 +34,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implements UserService {
+public class UserServiceImpl extends AbstractAnyService<UserTO, UserCR, UserUR> implements UserService {
 
     @Autowired
     private UserDAO userDAO;
@@ -47,7 +48,7 @@ public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implemen
     }
 
     @Override
-    protected AbstractAnyLogic<UserTO, UserUR> getAnyLogic() {
+    protected AbstractAnyLogic<UserTO, UserCR, UserUR> getAnyLogic() {
         return logic;
     }
 
@@ -57,8 +58,8 @@ public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implemen
     }
 
     @Override
-    public Response create(final UserTO userTO, final boolean storePassword) {
-        ProvisioningResult<UserTO> created = logic.create(userTO, storePassword, isNullPriorityAsync());
+    public Response create(final UserCR createReq) {
+        ProvisioningResult<UserTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
index 4b3bbf8..8aaaefc 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
@@ -18,9 +18,9 @@
  */
 package org.apache.syncope.core.workflow.api;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -30,10 +30,10 @@ public interface AnyObjectWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create a anyObject.
      *
-     * @param anyObjectTO anyObject to be created and whether to propagate it as active
+     * @param anyObjectCR anyObject to be created and whether to propagate it as active
      * @return anyObject just created
      */
-    WorkflowResult<String> create(AnyObjectTO anyObjectTO);
+    WorkflowResult<String> create(AnyObjectCR anyObjectCR);
 
     /**
      * Update a anyObject.
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
index dd7fe61..8743d26 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
@@ -18,9 +18,9 @@
  */
 package org.apache.syncope.core.workflow.api;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.GroupTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -30,10 +30,10 @@ public interface GroupWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create a group.
      *
-     * @param groupTO group to be created and whether to propagate it as active
+     * @param groupCR group to be created and whether to propagate it as active
      * @return group just created
      */
-    WorkflowResult<String> create(GroupTO groupTO);
+    WorkflowResult<String> create(GroupCR groupCR);
 
     /**
      * Update a group.
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
index 57cb249..2c728c3 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
@@ -19,9 +19,9 @@
 package org.apache.syncope.core.workflow.api;
 
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.UserTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -31,23 +31,20 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create an user.
      *
-     * @param userTO user to be created and whether to propagate it as active
-     * @param storePassword whether password shall be stored into the internal storage
+     * @param userCR user to be created and whether to propagate it as active
      * @return user just created
      */
-    WorkflowResult<Pair<String, Boolean>> create(UserTO userTO, boolean storePassword);
+    WorkflowResult<Pair<String, Boolean>> create(UserCR userCR);
 
     /**
      * Create an user, optionally disabling password policy check.
      *
-     * @param userTO user to be created and whether to propagate it as active
+     * @param userCR user to be created and whether to propagate it as active
      * @param disablePwdPolicyCheck disable password policy check?
      * @param enabled specify true/false to force active/supended status
-     * @param storePassword whether password shall be stored into the internal storage
      * @return user just created
      */
-    WorkflowResult<Pair<String, Boolean>> create(
-            UserTO userTO, boolean disablePwdPolicyCheck, final Boolean enabled, boolean storePassword);
+    WorkflowResult<Pair<String, Boolean>> create(UserCR userCR, boolean disablePwdPolicyCheck, final Boolean enabled);
 
     /**
      * Activate an user.
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
index 0b4b66d..5b4a975 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject;
@@ -47,11 +47,11 @@ public abstract class AbstractAnyObjectWorkflowAdapter implements AnyObjectWorkf
         return null;
     }
 
-    protected abstract WorkflowResult<String> doCreate(AnyObjectTO anyObjectTO);
+    protected abstract WorkflowResult<String> doCreate(AnyObjectCR anyObjectCR);
 
     @Override
-    public WorkflowResult<String> create(final AnyObjectTO anyObjectTO) {
-        return doCreate(anyObjectTO);
+    public WorkflowResult<String> create(final AnyObjectCR anyObjectCR) {
+        return doCreate(anyObjectCR);
     }
 
     protected abstract WorkflowResult<AnyObjectUR> doUpdate(AnyObject anyObject, AnyObjectUR anyObjectUR);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
index ca8c6bb..27d3adf 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.group.Group;
@@ -47,11 +47,11 @@ public abstract class AbstractGroupWorkflowAdapter implements GroupWorkflowAdapt
         return null;
     }
 
-    protected abstract WorkflowResult<String> doCreate(GroupTO groupTO);
+    protected abstract WorkflowResult<String> doCreate(GroupCR groupCR);
 
     @Override
-    public WorkflowResult<String> create(final GroupTO groupTO) {
-        return doCreate(groupTO);
+    public WorkflowResult<String> create(final GroupCR groupCR) {
+        return doCreate(groupCR);
     }
 
     protected abstract WorkflowResult<GroupUR> doUpdate(Group group, GroupUR groupUR);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
index 33433d9..52af9a2 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
@@ -20,8 +20,8 @@ package org.apache.syncope.core.workflow.java;
 
 import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.user.User;
@@ -54,21 +54,20 @@ public abstract class AbstractUserWorkflowAdapter implements UserWorkflowAdapter
     }
 
     @Override
-    public WorkflowResult<Pair<String, Boolean>> create(final UserTO userTO, final boolean storePassword) {
-        return create(userTO, false, null, storePassword);
+    public WorkflowResult<Pair<String, Boolean>> create(final UserCR userCR) {
+        return create(userCR, false, null);
     }
 
     protected abstract WorkflowResult<Pair<String, Boolean>> doCreate(
-            UserTO userTO, boolean disablePwdPolicyCheck, Boolean enabled, boolean storePassword);
+            UserCR userCR, boolean disablePwdPolicyCheck, Boolean enabled);
 
     @Override
     public WorkflowResult<Pair<String, Boolean>> create(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
-        return doCreate(userTO, disablePwdPolicyCheck, enabled, storePassword);
+        return doCreate(userCR, disablePwdPolicyCheck, enabled);
     }
 
     protected abstract WorkflowResult<String> doActivate(User user, String token);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
index 0cc7dd9..1439f25 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject;
@@ -31,9 +31,9 @@ import org.apache.syncope.core.provisioning.api.WorkflowResult;
 public class DefaultAnyObjectWorkflowAdapter extends AbstractAnyObjectWorkflowAdapter {
 
     @Override
-    protected WorkflowResult<String> doCreate(final AnyObjectTO anyObjectTO) {
+    protected WorkflowResult<String> doCreate(final AnyObjectCR anyObjectCR) {
         AnyObject anyObject = entityFactory.newEntity(AnyObject.class);
-        dataBinder.create(anyObject, anyObjectTO);
+        dataBinder.create(anyObject, anyObjectCR);
         anyObject = anyObjectDAO.save(anyObject);
 
         PropagationByResource propByRes = new PropagationByResource();
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
index 262dabc..691ee97 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.group.Group;
@@ -31,9 +31,9 @@ import org.apache.syncope.core.provisioning.api.WorkflowResult;
 public class DefaultGroupWorkflowAdapter extends AbstractGroupWorkflowAdapter {
 
     @Override
-    protected WorkflowResult<String> doCreate(final GroupTO groupTO) {
+    protected WorkflowResult<String> doCreate(final GroupCR groupCR) {
         Group group = entityFactory.newEntity(Group.class);
-        dataBinder.create(group, groupTO);
+        dataBinder.create(group, groupCR);
         group = groupDAO.saveAndRefreshDynMemberships(group);
 
         PropagationByResource propByRes = new PropagationByResource();
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
index 76b7f58..b71c515 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
@@ -20,8 +20,8 @@ package org.apache.syncope.core.workflow.java;
 
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.dao.ConfDAO;
@@ -40,13 +40,12 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
 
     @Override
     protected WorkflowResult<Pair<String, Boolean>> doCreate(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
         User user = entityFactory.newEntity(User.class);
-        dataBinder.create(user, userTO, storePassword);
+        dataBinder.create(user, userCR);
 
         // this will make UserValidator not to consider password policies at all
         if (disablePwdPolicyCheck) {
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
index 8cdfa37..a513955 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
@@ -27,9 +27,9 @@ import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.AnyObjectProvisioningManager;
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
@@ -38,15 +38,15 @@ public class CamelAnyObjectProvisioningManager
         extends AbstractCamelProvisioningManager implements AnyObjectProvisioningManager {
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final AnyObjectTO any, final boolean nullPriorityAsync) {
-        return create(any, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final AnyObjectCR req, final boolean nullPriorityAsync) {
+        return create(req, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final Set<String> excludedResources, final boolean nullPriorityAsync) {
+            final AnyObjectCR req, final Set<String> excludedResources, final boolean nullPriorityAsync) {
 
         PollingConsumer pollingConsumer = getConsumer("direct:createAnyObjectPort");
 
@@ -54,7 +54,7 @@ public class CamelAnyObjectProvisioningManager
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createAnyObject", anyObjectTO, props);
+        sendMessage("direct:createAnyObject", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
index ebb563c..c66eeef 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
@@ -27,9 +27,9 @@ import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.provisioning.api.GroupProvisioningManager;
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
@@ -39,14 +39,14 @@ public class CamelGroupProvisioningManager
 
     @Override
     @SuppressWarnings("unchecked")
-    public Pair<String, List<PropagationStatus>> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
+    public Pair<String, List<PropagationStatus>> create(final GroupCR req, final boolean nullPriorityAsync) {
         PollingConsumer pollingConsumer = getConsumer("direct:createGroupPort");
 
         Map<String, Object> props = new HashMap<>();
         props.put("excludedResources", Collections.<String>emptySet());
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createGroup", groupTO, props);
+        sendMessage("direct:createGroup", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
@@ -61,7 +61,7 @@ public class CamelGroupProvisioningManager
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final GroupTO groupTO,
+            final GroupCR req,
             final Map<String, String> groupOwnerMap,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
@@ -73,7 +73,7 @@ public class CamelGroupProvisioningManager
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createGroupInPull", groupTO, props);
+        sendMessage("direct:createGroupInPull", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
index b2ca24b..4540ac8 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
@@ -29,9 +29,9 @@ import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.core.provisioning.api.UserProvisioningManager;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
@@ -46,23 +46,15 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
     private static final Logger LOG = LoggerFactory.getLogger(CamelUserProvisioningManager.class);
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final UserTO userTO, final boolean nullPriorityAsync) {
-        return create(userTO, true, false, null, Collections.<String>emptySet(), nullPriorityAsync);
-    }
-
-    @Override
-    public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return create(userTO, storePassword, false, null, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final UserCR req, final boolean nullPriorityAsync) {
+        return create(req, false, null, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR req,
             final boolean disablePwdPolicyCheck,
             final Boolean enabled,
             final Set<String> excludedResources,
@@ -71,13 +63,12 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
         PollingConsumer pollingConsumer = getConsumer("direct:createPort");
 
         Map<String, Object> props = new HashMap<>();
-        props.put("storePassword", storePassword);
         props.put("disablePwdPolicyCheck", disablePwdPolicyCheck);
         props.put("enabled", enabled);
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createUser", userTO, props);
+        sendMessage("direct:createUser", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
index 95c1b2d..4f86cff 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
@@ -25,10 +25,10 @@ import org.apache.camel.Endpoint;
 import org.apache.camel.Exchange;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
-import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
-import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
 import org.apache.syncope.core.provisioning.api.propagation.PropagationReporter;
@@ -48,27 +48,27 @@ public class CreateProducer extends AbstractProducer {
             Set<String> excludedResources = exchange.getProperty("excludedResources", Set.class);
             Boolean nullPriorityAsync = exchange.getProperty("nullPriorityAsync", Boolean.class);
 
-            if (actual instanceof UserTO) {
+            if (actual instanceof UserCR) {
                 WorkflowResult<Pair<String, Boolean>> created =
                         (WorkflowResult<Pair<String, Boolean>>) exchange.getIn().getBody();
 
                 List<PropagationTaskInfo> taskInfos = getPropagationManager().getUserCreateTasks(
                         created.getResult().getKey(),
-                        ((UserTO) actual).getPassword(),
+                        ((UserCR) actual).getPassword(),
                         created.getResult().getValue(),
                         created.getPropByRes(),
-                        ((UserTO) actual).getVirAttrs(),
+                        ((UserCR) actual).getVirAttrs(),
                         excludedResources);
                 PropagationReporter reporter = getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
                 exchange.getOut().setBody(
                         Pair.of(created.getResult().getKey(), reporter.getStatuses()));
-            } else if (actual instanceof AnyTO) {
+            } else if (actual instanceof AnyCR) {
                 WorkflowResult<String> created = (WorkflowResult<String>) exchange.getIn().getBody();
 
-                if (actual instanceof GroupTO && isPull()) {
+                if (actual instanceof GroupCR && isPull()) {
                     Map<String, String> groupOwnerMap = exchange.getProperty("groupOwnerMap", Map.class);
-                    ((GroupTO) actual).getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
+                    ((GroupCR) actual).getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
                             -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().iterator().next()));
 
                     List<PropagationTaskInfo> taskInfos = getPropagationManager().getCreateTasks(
@@ -76,18 +76,18 @@ public class CreateProducer extends AbstractProducer {
                             created.getResult(),
                             null,
                             created.getPropByRes(),
-                            ((AnyTO) actual).getVirAttrs(),
+                            ((AnyCR) actual).getVirAttrs(),
                             excludedResources);
                     getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
                     exchange.getOut().setBody(Pair.of(created.getResult(), null));
                 } else {
                     List<PropagationTaskInfo> taskInfos = getPropagationManager().getCreateTasks(
-                            actual instanceof AnyObjectTO ? AnyTypeKind.ANY_OBJECT : AnyTypeKind.GROUP,
+                            actual instanceof AnyObjectCR ? AnyTypeKind.ANY_OBJECT : AnyTypeKind.GROUP,
                             created.getResult(),
                             null,
                             created.getPropByRes(),
-                            ((AnyTO) actual).getVirAttrs(),
+                            ((AnyCR) actual).getVirAttrs(),
                             excludedResources);
                     PropagationReporter reporter = getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
diff --git a/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml b/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
index 05f581c..d7c3afd 100644
--- a/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
+++ b/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
@@ -25,7 +25,7 @@ under the License.
       <simple>${body}</simple>
     </setProperty>
     <doTry>
-      <bean method="create(${body},${property.disablePwdPolicyCheck},${property.enabled},${property.storePassword})"
+      <bean method="create(${body},${property.disablePwdPolicyCheck},${property.enabled})"
             ref="uwfAdapter" />
       <to uri="propagate:create?anyTypeKind=USER"/>
       <to uri="direct:createPort"/>
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
index 093baf8..78f9e8f 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
@@ -55,6 +55,8 @@ public final class FlowableRuntimeUtils {
 
     public static final String FORM_SUBMITTER = "formSubmitter";
 
+    public static final String USER_CR = "userCR";
+
     public static final String USER_TO = "userTO";
 
     public static final String ENABLED = "enabled";
@@ -73,8 +75,6 @@ public final class FlowableRuntimeUtils {
 
     public static final String ENCRYPTED_PWD = "encryptedPwd";
 
-    public static final String STORE_PASSWORD = "storePassword";
-
     public static final String EVENT = "event";
 
     public static String encrypt(final String clear) {
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
index 446aad4..6ab00df 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
@@ -26,8 +26,8 @@ import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.to.WorkflowTask;
 import org.apache.syncope.common.lib.to.WorkflowTaskExecInput;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -82,16 +82,14 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
 
     @Override
     protected WorkflowResult<Pair<String, Boolean>> doCreate(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
         Map<String, Object> variables = new HashMap<>();
         variables.put(FlowableRuntimeUtils.WF_EXECUTOR, AuthContextUtils.getUsername());
-        variables.put(FlowableRuntimeUtils.USER_TO, userTO);
+        variables.put(FlowableRuntimeUtils.USER_CR, userCR);
         variables.put(FlowableRuntimeUtils.ENABLED, enabled);
-        variables.put(FlowableRuntimeUtils.STORE_PASSWORD, storePassword);
 
         ProcessInstance procInst = null;
         try {
@@ -105,9 +103,9 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
         engine.getRuntimeService().removeVariable(
                 procInst.getProcessInstanceId(), FlowableRuntimeUtils.WF_EXECUTOR);
         engine.getRuntimeService().removeVariable(
-                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_TO);
+                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_CR);
         engine.getRuntimeService().removeVariable(
-                procInst.getProcessInstanceId(), FlowableRuntimeUtils.STORE_PASSWORD);
+                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_TO);
 
         User user = engine.getRuntimeService().
                 getVariable(procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER, User.class);
@@ -149,7 +147,7 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
                 procInst.getProcessInstanceId(),
                 created,
                 dataBinder.getUserTO(created, true),
-                userTO.getPassword(),
+                userCR.getPassword(),
                 enabled,
                 propByRes);
 
@@ -413,8 +411,8 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
         FlowableRuntimeUtils.updateStatus(engine, procInstID, user);
         user = userDAO.save(user);
 
-        engine.getRuntimeService().setVariable(
-                procInstID, FlowableRuntimeUtils.USER_TO, dataBinder.getUserTO(user, true));
+        engine.getRuntimeService().setVariable(procInstID, FlowableRuntimeUtils.USER_TO, dataBinder.
+                getUserTO(user, true));
 
         if (engine.getRuntimeService().createProcessInstanceQuery().
                 processInstanceId(procInstID).active().list().isEmpty()) {
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
index d5fcd41..1d92553 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
@@ -22,14 +22,12 @@ import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.flowable.support.DomainProcessEngine;
 import org.apache.syncope.core.persistence.api.entity.user.User;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.transaction.annotation.Transactional;
 
 public class FlowableWorkflowUtils {
 
     @Autowired
     protected DomainProcessEngine engine;
 
-    @Transactional(readOnly = true)
     public boolean isUserIngroup(final UserTO user, final String groupName) {
         return user.getMemberships().stream().
                 anyMatch(membership -> groupName != null && groupName.equals(membership.getGroupName()));
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
index f3bd848..a31cdf4 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.core.flowable.task;
 
-import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.user.User;
 import org.apache.syncope.core.provisioning.api.data.UserDataBinder;
@@ -38,12 +38,11 @@ public class Create extends FlowableServiceTask {
 
     @Override
     protected void doExecute(final DelegateExecution execution) {
-        UserTO userTO = execution.getVariable(FlowableRuntimeUtils.USER_TO, UserTO.class);
-        Boolean storePassword = execution.getVariable(FlowableRuntimeUtils.STORE_PASSWORD, Boolean.class);
+        UserCR userCR = execution.getVariable(FlowableRuntimeUtils.USER_CR, UserCR.class);
 
         // create user
         User user = entityFactory.newEntity(User.class);
-        dataBinder.create(user, userTO, storePassword == null ? true : storePassword);
+        dataBinder.create(user, userCR);
 
         // report user as result
         execution.setVariable(FlowableRuntimeUtils.USER, user);
diff --git a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
index 1d57761..2df0dfd 100644
--- a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
+++ b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
@@ -27,7 +27,9 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
@@ -238,27 +240,30 @@ public class OIDCUserManager {
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     public String create(final OIDCProvider op, final OIDCLoginResponseTO responseTO, final String email) {
-        UserTO userTO = new UserTO();
+        UserCR userCR = new UserCR();
+        userCR.setStorePassword(false);
 
         if (op.getUserTemplate() != null && op.getUserTemplate().get() != null) {
-            templateUtils.apply(userTO, op.getUserTemplate().get());
+            templateUtils.apply(userCR, op.getUserTemplate().get());
         }
 
         List<OIDCProviderActions> actions = getActions(op);
         for (OIDCProviderActions action : actions) {
-            userTO = action.beforeCreate(userTO, responseTO);
+            userCR = action.beforeCreate(userCR, responseTO);
         }
 
+        UserTO userTO = new UserTO();
+        EntityTOUtils.toAnyTO(userCR, userTO);
         fill(op, responseTO, userTO);
 
-        if (userTO.getRealm() == null) {
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        if (userCR.getRealm() == null) {
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
         }
-        if (userTO.getUsername() == null) {
-            userTO.setUsername(email);
+        if (userCR.getUsername() == null) {
+            userCR.setUsername(email);
         }
 
-        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userTO, false, false);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userCR, false);
         userTO = binder.getUserTO(created.getKey());
 
         for (OIDCProviderActions action : actions) {
diff --git a/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java b/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
index 05945b3..45a3f3b 100644
--- a/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
+++ b/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
@@ -18,18 +18,18 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
 import org.apache.syncope.common.lib.to.UserTO;
 
 public interface OIDCProviderActions {
 
-    UserTO beforeCreate(UserTO input, OIDCLoginResponseTO loginResponse);
+    UserCR beforeCreate(UserCR input, OIDCLoginResponseTO loginResponse);
 
     UserTO afterCreate(UserTO input, OIDCLoginResponseTO loginResponse);
 
     UserUR beforeUpdate(UserUR input, OIDCLoginResponseTO loginResponse);
 
     UserTO afterUpdate(UserTO input, OIDCLoginResponseTO loginResponse);
-
 }
diff --git a/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java b/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java
deleted file mode 100644
index 2150567..0000000
--- a/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.syncope.core.provisioning.java;
-
-import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
-import org.apache.syncope.common.lib.to.UserTO;
-import org.apache.syncope.core.provisioning.api.OIDCProviderActions;
-
-public class DefaultOIDCProviderActions implements OIDCProviderActions {
-
-    @Override
-    public UserTO beforeCreate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserTO afterCreate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserUR beforeUpdate(final UserUR input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserTO afterUpdate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-}
diff --git a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
index 1b48d10..7cc36e2 100644
--- a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
+++ b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
@@ -27,7 +27,9 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -252,27 +254,30 @@ public class SAML2UserManager {
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     public String create(final SAML2IdPEntity idp, final SAML2LoginResponseTO responseTO, final String nameID) {
-        UserTO userTO = new UserTO();
+        UserCR userCR = new UserCR();
+        userCR.setStorePassword(false);
 
         if (idp.getUserTemplate() != null) {
-            templateUtils.apply(userTO, idp.getUserTemplate());
+            templateUtils.apply(userCR, idp.getUserTemplate());
         }
 
         List<SAML2IdPActions> actions = getActions(idp);
         for (SAML2IdPActions action : actions) {
-            userTO = action.beforeCreate(userTO, responseTO);
+            userCR = action.beforeCreate(userCR, responseTO);
         }
 
+        UserTO userTO = new UserTO();
+        EntityTOUtils.toAnyTO(userCR, userTO);
         fill(idp.getKey(), responseTO, userTO);
 
-        if (userTO.getRealm() == null) {
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        if (userCR.getRealm() == null) {
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
         }
-        if (userTO.getUsername() == null) {
-            userTO.setUsername(nameID);
+        if (userCR.getUsername() == null) {
+            userCR.setUsername(nameID);
         }
 
-        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userTO, false, false);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userCR, false);
         userTO = binder.getUserTO(created.getKey());
 
         for (SAML2IdPActions action : actions) {
diff --git a/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java b/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
index 0decd0c..dddc6dc 100644
--- a/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
+++ b/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
@@ -18,13 +18,14 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.SAML2LoginResponseTO;
 import org.apache.syncope.common.lib.to.UserTO;
 
 public interface SAML2IdPActions {
 
-    default UserTO beforeCreate(UserTO input, SAML2LoginResponseTO loginResponse) {
+    default UserCR beforeCreate(UserCR input, SAML2LoginResponseTO loginResponse) {
         return input;
     }
 
diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
index efb1b33..bf122d5 100644
--- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
+++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
@@ -24,14 +24,15 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.scim.SCIMComplexConf;
 import org.apache.syncope.common.lib.scim.SCIMConf;
-import org.apache.syncope.common.lib.scim.SCIMUserAddressConf;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
@@ -491,36 +492,29 @@ public class SCIMDataBinder {
             }
 
             if (conf.getUserConf().getDisplayName() != null && user.getDisplayName() != null) {
-                setAttribute(userTO, conf.getUserConf().getDisplayName(),
-                        user.getDisplayName());
+                setAttribute(userTO, conf.getUserConf().getDisplayName(), user.getDisplayName());
             }
             if (conf.getUserConf().getNickName() != null && user.getNickName() != null) {
-                setAttribute(userTO, conf.getUserConf().getNickName(),
-                        user.getNickName());
+                setAttribute(userTO, conf.getUserConf().getNickName(), user.getNickName());
             }
             if (conf.getUserConf().getProfileUrl() != null && user.getProfileUrl() != null) {
-                setAttribute(userTO, conf.getUserConf().getProfileUrl(),
-                        user.getProfileUrl());
+                setAttribute(userTO, conf.getUserConf().getProfileUrl(), user.getProfileUrl());
             }
             if (conf.getUserConf().getTitle() != null && user.getTitle() != null) {
                 setAttribute(userTO, conf.getUserConf().getTitle(),
                         user.getTitle());
             }
             if (conf.getUserConf().getUserType() != null && user.getUserType() != null) {
-                setAttribute(userTO, conf.getUserConf().getUserType(),
-                        user.getUserType());
+                setAttribute(userTO, conf.getUserConf().getUserType(), user.getUserType());
             }
             if (conf.getUserConf().getPreferredLanguage() != null && user.getPreferredLanguage() != null) {
-                setAttribute(userTO, conf.getUserConf().getPreferredLanguage(),
-                        user.getPreferredLanguage());
+                setAttribute(userTO, conf.getUserConf().getPreferredLanguage(), user.getPreferredLanguage());
             }
             if (conf.getUserConf().getLocale() != null && user.getLocale() != null) {
-                setAttribute(userTO, conf.getUserConf().getLocale(),
-                        user.getLocale());
+                setAttribute(userTO, conf.getUserConf().getLocale(), user.getLocale());
             }
             if (conf.getUserConf().getTimezone() != null && user.getTimezone() != null) {
-                setAttribute(userTO, conf.getUserConf().getTimezone(),
-                        user.getTimezone());
+                setAttribute(userTO, conf.getUserConf().getTimezone(), user.getTimezone());
             }
 
             fill(userTO.getPlainAttrs(), conf.getUserConf().getEmails(), user.getEmails());
@@ -529,41 +523,34 @@ public class SCIMDataBinder {
             fill(userTO.getPlainAttrs(), conf.getUserConf().getPhotos(), user.getPhotos());
 
             user.getAddresses().stream().filter(address -> address.getType() != null).forEach(address -> {
-                Optional<SCIMUserAddressConf> addressConf = conf.getUserConf().getAddresses().stream().
-                        filter(object -> address.getType().equals(object.getType().name())).findFirst();
-                if (addressConf.isPresent()) {
-                    if (addressConf.get().getFormatted() != null && address.getFormatted() != null) {
-                        setAttribute(userTO, addressConf.get().getFormatted(),
-                                address.getFormatted());
-                    }
-                    if (addressConf.get().getStreetAddress() != null && address.getStreetAddress() != null) {
-                        setAttribute(userTO, addressConf.get().getStreetAddress(),
-                                address.getStreetAddress());
-                    }
-                    if (addressConf.get().getLocality() != null && address.getLocality() != null) {
-                        setAttribute(userTO, addressConf.get().getLocality(),
-                                address.getLocality());
-                    }
-                    if (addressConf.get().getRegion() != null && address.getRegion() != null) {
-                        setAttribute(userTO, addressConf.get().getRegion(),
-                                address.getRegion());
-                    }
-                    if (addressConf.get().getPostalCode() != null && address.getPostalCode() != null) {
-                        setAttribute(userTO, addressConf.get().getPostalCode(),
-                                address.getPostalCode());
-                    }
-                    if (addressConf.get().getCountry() != null && address.getCountry() != null) {
-                        setAttribute(userTO, addressConf.get().getCountry(),
-                                address.getCountry());
-                    }
-                }
+                conf.getUserConf().getAddresses().stream().
+                        filter(object -> address.getType().equals(object.getType().name())).findFirst().
+                        ifPresent(addressConf -> {
+                            if (addressConf.getFormatted() != null && address.getFormatted() != null) {
+                                setAttribute(userTO, addressConf.getFormatted(), address.getFormatted());
+                            }
+                            if (addressConf.getStreetAddress() != null && address.getStreetAddress() != null) {
+                                setAttribute(userTO, addressConf.getStreetAddress(), address.getStreetAddress());
+                            }
+                            if (addressConf.getLocality() != null && address.getLocality() != null) {
+                                setAttribute(userTO, addressConf.getLocality(), address.getLocality());
+                            }
+                            if (addressConf.getRegion() != null && address.getRegion() != null) {
+                                setAttribute(userTO, addressConf.getRegion(), address.getRegion());
+                            }
+                            if (addressConf.getPostalCode() != null && address.getPostalCode() != null) {
+                                setAttribute(userTO, addressConf.getPostalCode(), address.getPostalCode());
+                            }
+                            if (addressConf.getCountry() != null && address.getCountry() != null) {
+                                setAttribute(userTO, addressConf.getCountry(), address.getCountry());
+                            }
+                        });
             });
 
             for (int i = 0; i < user.getX509Certificates().size(); i++) {
                 Value certificate = user.getX509Certificates().get(i);
                 if (conf.getUserConf().getX509Certificates().size() > i) {
-                    setAttribute(userTO, conf.getUserConf().getX509Certificates().get(i),
-                            certificate.getValue());
+                    setAttribute(userTO, conf.getUserConf().getX509Certificates().get(i), certificate.getValue());
                 }
             }
         }
@@ -609,17 +596,30 @@ public class SCIMDataBinder {
             }
         }
 
-        user.getGroups().forEach(group -> {
-            userTO.getMemberships().add(new MembershipTO.Builder().group(group.getValue()).build());
-        });
+        userTO.getMemberships().addAll(user.getGroups().stream().
+                map(group -> new MembershipTO.Builder().group(group.getValue()).build()).
+                collect(Collectors.toList()));
 
-        user.getRoles().forEach(role -> {
-            userTO.getRoles().add(role.getValue());
-        });
+        userTO.getRoles().addAll(user.getRoles().stream().
+                map(Value::getValue).
+                collect(Collectors.toList()));
 
         return userTO;
     }
 
+    public UserCR toUserCR(final SCIMUser user) {
+        UserTO userTO = toUserTO(user);
+
+        return new UserCR.Builder().
+                username(userTO.getUsername()).
+                password(userTO.getPassword()).
+                realm(userTO.getRealm()).
+                plainAttrs(userTO.getPlainAttrs()).
+                memberships(userTO.getMemberships()).
+                roles(userTO.getRoles()).
+                build();
+    }
+
     private void setAttribute(final UserTO userTO, final String schema, final String value) {
         switch (schema) {
             case "username":
@@ -690,4 +690,11 @@ public class SCIMDataBinder {
         return groupTO;
     }
 
+    public GroupCR toGroupCR(final SCIMGroup group) {
+        if (!GROUP_SCHEMAS.equals(group.getSchemas())) {
+            throw new BadRequestException(ErrorType.invalidValue);
+        }
+
+        return new GroupCR.Builder().realm(SyncopeConstants.ROOT_REALM).name(group.getDisplayName()).build();
+    }
 }
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
index 6bec6e2..6ab1e8d 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
@@ -136,7 +136,7 @@ abstract class AbstractService<R extends SCIMResource> {
         }
     }
 
-    protected AbstractAnyLogic<?, ?> anyLogic(final Resource type) {
+    protected AbstractAnyLogic<?, ?, ?> anyLogic(final Resource type) {
         switch (type) {
             case User:
                 return userLogic();
@@ -239,8 +239,7 @@ abstract class AbstractService<R extends SCIMResource> {
                         request.getAttributes(),
                         request.getExcludedAttributes());
             } else if (anyTO instanceof GroupTO) {
-                resource = binder().toSCIMGroup(
-                        (GroupTO) anyTO,
+                resource = binder().toSCIMGroup((GroupTO) anyTO,
                         uriInfo.getAbsolutePathBuilder().path(anyTO.getKey()).build().toASCIIString(),
                         request.getAttributes(),
                         request.getExcludedAttributes());
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
index 7938b52..0a7a747 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
@@ -29,7 +29,7 @@ import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.SyncopeConstants;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -53,13 +53,13 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
     @Override
     public Response create(final SCIMGroup group) {
         // first create group, no members assigned
-        ProvisioningResult<GroupTO> result = groupLogic().create(binder().toGroupTO(group), false);
+        ProvisioningResult<GroupTO> result = groupLogic().create(binder().toGroupCR(group), false);
 
         // then assign members
         group.getMembers().forEach(member -> {
             UserUR req = new UserUR.Builder().
                     key(member.getValue()).
-                    membership(new MembershipPatch.Builder().
+                    membership(new MembershipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
                     build();
             try {
@@ -138,7 +138,7 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
             if (!beforeMembers.contains(member.getValue())) {
                 UserUR req = new UserUR.Builder().
                         key(member.getValue()).
-                        membership(new MembershipPatch.Builder().
+                        membership(new MembershipUR.Builder().
                                 operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
                         build();
                 try {
@@ -153,7 +153,7 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
         beforeMembers.stream().filter(member -> !afterMembers.contains(member)).forEach(user -> {
             UserUR req = new UserUR.Builder().
                     key(user).
-                    membership(new MembershipPatch.Builder().
+                    membership(new MembershipUR.Builder().
                             operation(PatchOperation.DELETE).group(result.getEntity().getKey()).build()).
                     build();
             try {
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
index 4ecc966..51deffd 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
@@ -40,7 +40,7 @@ public class UserServiceImpl extends AbstractService<SCIMUser> implements UserSe
 
     @Override
     public Response create(final SCIMUser user) {
-        ProvisioningResult<UserTO> result = userLogic().create(binder().toUserTO(user), true, false);
+        ProvisioningResult<UserTO> result = userLogic().create(binder().toUserCR(user), false);
         return createResponse(
                 result.getEntity().getKey(),
                 binder().toSCIMUser(
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
index d4c17ed..a2fb529 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.fit.core.reference.flowable;
 
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.core.flowable.impl.FlowableRuntimeUtils;
 import org.apache.syncope.core.flowable.task.FlowableServiceTask;
@@ -50,7 +50,7 @@ public class AssignDirectorGroup extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getMemberships().add(new MembershipPatch.Builder().
+            userUR.getMemberships().add(new MembershipUR.Builder().
                     group("ebf97068-aa4b-4a85-9f01-680e8c4cf227").build());
 
             PropagationByResource propByRes = dataBinder.update(user, userUR);
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
index 9c9b33e..1944255 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.fit.core.reference.flowable;
 
-import org.apache.syncope.common.lib.request.RelationshipPatch;
+import org.apache.syncope.common.lib.request.RelationshipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.RelationshipTO;
 import org.apache.syncope.core.flowable.impl.FlowableRuntimeUtils;
@@ -53,7 +53,7 @@ public class CreateARelationship extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getRelationships().add(new RelationshipPatch.Builder().
+            userUR.getRelationships().add(new RelationshipUR.Builder().
                     relationshipTO(new RelationshipTO.Builder().
                             otherEnd("PRINTER", printer).type("neighborhood").build()).
                     build());
diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
index de1d8f3..ab33943 100644
--- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
+++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
@@ -19,12 +19,12 @@
 package org.apache.syncope.fit.core.reference;
 
 import java.util.Optional;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.to.AnyTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.EntityTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException;
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile;
@@ -41,39 +41,36 @@ public class TestPullActions implements PullActions {
 
     @Override
     public void beforeProvision(
-            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final EntityTO entity)
+            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final AnyCR anyCR)
             throws JobExecutionException {
 
-        if (entity instanceof AnyTO) {
-            AnyTO any = (AnyTO) entity;
-
-            Optional<AttrTO> attrTO = any.getPlainAttr("fullname");
-            if (!attrTO.isPresent()) {
-                attrTO = Optional.of(new AttrTO());
-                attrTO.get().setSchema("fullname");
-                any.getPlainAttrs().add(attrTO.get());
-            }
-            attrTO.get().getValues().clear();
-            attrTO.get().getValues().add(String.valueOf(counter++));
+        Optional<AttrTO> attrTO = anyCR.getPlainAttrs().stream().
+                filter(attr -> "fullname".equals(attr.getSchema())).findFirst();
+        if (!attrTO.isPresent()) {
+            attrTO = Optional.of(new AttrTO());
+            attrTO.get().setSchema("fullname");
+            anyCR.getPlainAttrs().add(attrTO.get());
         }
+        attrTO.get().getValues().clear();
+        attrTO.get().getValues().add(String.valueOf(counter++));
     }
 
     @Override
     public void beforeAssign(
-            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final EntityTO entity)
+            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final AnyCR anyCR)
             throws JobExecutionException {
 
-        if (entity instanceof UserTO && "test2".equals(UserTO.class.cast(entity).getUsername())) {
+        if (anyCR instanceof UserCR && "test2".equals(UserCR.class.cast(anyCR).getUsername())) {
             throw new IgnoreProvisionException();
         }
     }
 
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         AttrPatch fullnamePatch = null;
         for (AttrPatch attrPatch : anyUR.getPlainAttrs()) {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index ca444ab..2d61758 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -52,6 +52,9 @@ import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.PolicyTO;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.SchemaTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -435,21 +438,17 @@ public abstract class AbstractITCase {
         assertNotNull(notification);
 
         // 2. create user
-        UserTO userTO = UserITCase.getUniqueSampleTO("notificationtest@syncope.apache.org");
-        userTO.getMemberships().add(
+        UserCR req = UserITCase.getUniqueSample("notificationtest@syncope.apache.org");
+        req.getMemberships().add(
                 new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(req).getEntity();
         assertNotNull(userTO);
-        return Pair.of(notification.getKey(), userTO.getUsername());
+        return Pair.of(notification.getKey(), req.getUsername());
     }
 
-    protected ProvisioningResult<UserTO> createUser(final UserTO userTO) {
-        return createUser(userTO, true);
-    }
-
-    protected ProvisioningResult<UserTO> createUser(final UserTO userTO, final boolean storePassword) {
-        Response response = userService.create(userTO, storePassword);
+    protected ProvisioningResult<UserTO> createUser(final UserCR req) {
+        Response response = userService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
@@ -472,8 +471,8 @@ public abstract class AbstractITCase {
                 });
     }
 
-    protected ProvisioningResult<AnyObjectTO> createAnyObject(final AnyObjectTO anyObjectTO) {
-        Response response = anyObjectService.create(anyObjectTO);
+    protected ProvisioningResult<AnyObjectTO> createAnyObject(final AnyObjectCR req) {
+        Response response = anyObjectService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
@@ -496,8 +495,8 @@ public abstract class AbstractITCase {
                 });
     }
 
-    protected ProvisioningResult<GroupTO> createGroup(final GroupTO groupTO) {
-        Response response = groupService.create(groupTO);
+    protected ProvisioningResult<GroupTO> createGroup(final GroupCR req) {
+        Response response = groupService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
index 8c98ccf..38fcc3d 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
@@ -30,6 +30,7 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -46,22 +47,20 @@ import org.junit.jupiter.api.Test;
 
 public class AnyObjectITCase extends AbstractITCase {
 
-    public static AnyObjectTO getSampleTO(final String location) {
-        AnyObjectTO anyObjectTO = new AnyObjectTO();
-        anyObjectTO.setName(location + getUUIDString());
-        anyObjectTO.setRealm(SyncopeConstants.ROOT_REALM);
-        anyObjectTO.setType("PRINTER");
-        anyObjectTO.getPlainAttrs().add(attrTO("location", location + getUUIDString()));
-
-        anyObjectTO.getResources().add(RESOURCE_NAME_DBSCRIPTED);
-        return anyObjectTO;
+    public static AnyObjectCR getSample(final String location) {
+        return new AnyObjectCR.Builder("PRINTER").
+                name(location + getUUIDString()).
+                realm(SyncopeConstants.ROOT_REALM).
+                plainAttr(attrTO("location", location + getUUIDString())).
+                resource(RESOURCE_NAME_DBSCRIPTED).
+                build();
     }
 
     @Test
     public void create() {
-        AnyObjectTO anyObjectTO = getSampleTO("create");
+        AnyObjectCR anyObjectCR = getSample("create");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         ConnObjectTO connObjectTO =
@@ -76,22 +75,22 @@ public class AnyObjectITCase extends AbstractITCase {
     @Test
     public void createInvalidMembership() {
         // 1. create anyObject in realm /odd and attempt to assign group 15, from realm /even => exception
-        AnyObjectTO anyObjectTO = getSampleTO("createInvalidMembership");
-        anyObjectTO.setRealm("/odd");
-        anyObjectTO.getMemberships().add(
+        AnyObjectCR anyObjectCR = getSample("createInvalidMembership");
+        anyObjectCR.setRealm("/odd");
+        anyObjectCR.getMemberships().add(
                 new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build());
 
         try {
-            createAnyObject(anyObjectTO);
+            createAnyObject(anyObjectCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidMembership, e.getType());
         }
 
         // 2. change anyObject's realm to /even/two, now it works
-        anyObjectTO.setRealm("/even/two");
+        anyObjectCR.setRealm("/even/two");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1"));
     }
 
@@ -103,10 +102,10 @@ public class AnyObjectITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        AnyObjectTO anyObjectTO = getSampleTO("deletable");
-        anyObjectTO.setRealm("/even");
+        AnyObjectCR anyObjectCR = getSample("deletable");
+        anyObjectCR.setRealm("/even");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         AnyObjectTO deletedAnyObject = deleteAnyObject(anyObjectTO.getKey()).getEntity();
@@ -140,8 +139,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        AnyObjectTO anyObjectTO = getSampleTO("update");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("update");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
 
         assertEquals(1, anyObjectTO.getPlainAttrs().size());
 
@@ -157,8 +156,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void readAttrs() {
-        AnyObjectTO anyObjectTO = getSampleTO("readAttrs");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("readAttrs");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         Set<AttrTO> attrs = anyObjectService.read(anyObjectTO.getKey(), SchemaType.PLAIN);
@@ -170,8 +169,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void updateAttr() {
-        AnyObjectTO anyObjectTO = getSampleTO("updateAttr");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("updateAttr");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         AttrTO updated = attrTO("location", "newlocation");
@@ -183,8 +182,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void deleteAttr() {
-        AnyObjectTO anyObjectTO = getSampleTO("deleteAttr");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("deleteAttr");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
         assertNotNull(anyObjectTO.getPlainAttr("location"));
 
@@ -200,12 +199,12 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE756() {
-        AnyObjectTO anyObjectTO = getSampleTO("issueSYNCOPE756");
-        anyObjectTO.getRelationships().add(new RelationshipTO.Builder().otherEnd(
+        AnyObjectCR anyObjectCR = getSample("issueSYNCOPE756");
+        anyObjectCR.getRelationships().add(new RelationshipTO.Builder().otherEnd(
                 AnyTypeKind.USER.name(), "1417acbe-cbf6-4277-9372-e75e04f97000").build());
 
         try {
-            createAnyObject(anyObjectTO).getEntity();
+            createAnyObject(anyObjectCR).getEntity();
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidAnyType, e.getType());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
index b9dbfb5..3a167f5 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
@@ -39,13 +39,14 @@ import org.apache.syncope.client.lib.BasicAuthenticationHandler;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
@@ -135,8 +136,8 @@ public class AuthenticationITCase extends AbstractITCase {
         assertEquals(schemaTO, newPlainSchemaTO);
 
         // 2. create an user with the role created above (as admin)
-        UserTO userTO = UserITCase.getUniqueSampleTO("auth@test.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("auth@test.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 3. read the schema created above (as admin) - success
@@ -162,10 +163,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void userRead() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("testuserread@test.org");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("testuserread@test.org");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserService userService2 = clientFactory.create(userTO.getUsername(), "password123").
@@ -187,10 +188,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void userSearch() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("testusersearch@test.org");
-        userTO.getRoles().add("User reviewer");
+        UserCR userCR = UserITCase.getUniqueSample("testusersearch@test.org");
+        userCR.getRoles().add("User reviewer");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 1. user assigned to role 1, with search entitlement on realms /odd and /even: won't find anything with 
@@ -237,9 +238,9 @@ public class AuthenticationITCase extends AbstractITCase {
             assertNotNull(roleKey);
 
             // 2. as admin, create delegated admin user, and assign the role just created
-            UserTO delegatedAdmin = UserITCase.getUniqueSampleTO("admin@syncope.apache.org");
-            delegatedAdmin.getRoles().add(roleKey);
-            delegatedAdmin = createUser(delegatedAdmin).getEntity();
+            UserCR delegatedAdminCR = UserITCase.getUniqueSample("admin@syncope.apache.org");
+            delegatedAdminCR.getRoles().add(roleKey);
+            UserTO delegatedAdmin = createUser(delegatedAdminCR).getEntity();
             delegatedAdminKey = delegatedAdmin.getKey();
 
             // 3. instantiate a delegate user service client, for further operatins
@@ -247,21 +248,21 @@ public class AuthenticationITCase extends AbstractITCase {
                     clientFactory.create(delegatedAdmin.getUsername(), "password123").getService(UserService.class);
 
             // 4. as delegated, create user under realm / -> fail
-            UserTO user = UserITCase.getUniqueSampleTO("delegated@syncope.apache.org");
+            UserCR userCR = UserITCase.getUniqueSample("delegated@syncope.apache.org");
             try {
-                delegatedUserService.create(user, true);
+                delegatedUserService.create(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.DelegatedAdministration, e.getType());
             }
 
             // 5. set realm to /even/two -> succeed
-            user.setRealm("/even/two");
+            userCR.setRealm("/even/two");
 
-            Response response = delegatedUserService.create(user, true);
+            Response response = delegatedUserService.create(userCR);
             assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
 
-            user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
+            UserTO user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
             }).getEntity();
             assertEquals("surname", user.getPlainAttr("surname").get().getValues().get(0));
 
@@ -309,10 +310,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void checkFailedLogins() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("checkFailedLogin@syncope.apache.org");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("checkFailedLogin@syncope.apache.org");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         String userKey = userTO.getKey();
 
@@ -342,11 +343,11 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void checkUserSuspension() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("checkSuspension@syncope.apache.org");
-        userTO.setRealm("/odd");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("checkSuspension@syncope.apache.org");
+        userCR.setRealm("/odd");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         String userKey = userTO.getKey();
         assertNotNull(userTO);
 
@@ -437,7 +438,7 @@ public class AuthenticationITCase extends AbstractITCase {
                 anyMatch(entitlement -> entitlement.contains(anyTypeKey)));
 
         // 3. attempt to create an instance of the type above: fail because no entitlement was assigned
-        AnyObjectTO folder = new AnyObjectTO();
+        AnyObjectCR folder = new AnyObjectCR();
         folder.setName("home");
         folder.setRealm(SyncopeConstants.ROOT_REALM);
         folder.setType(anyTypeKey);
@@ -479,11 +480,11 @@ public class AuthenticationITCase extends AbstractITCase {
 
         // 1. create user with group 'groupForWorkflowApproval' 
         // (users with group groupForWorkflowApproval are defined in workflow as subject to approval)
-        UserTO userTO = UserITCase.getUniqueSampleTO("createWithReject@syncope.apache.org");
-        userTO.getMemberships().add(
+        UserCR userCR = UserITCase.getUniqueSample("createWithReject@syncope.apache.org");
+        userCR.getMemberships().add(
                 new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals("createApproval", userTO.getStatus());
 
@@ -515,11 +516,11 @@ public class AuthenticationITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE164() throws Exception {
         // 1. create user with db resource
-        UserTO user = UserITCase.getUniqueSampleTO("syncope164@syncope.apache.org");
-        user.setRealm("/even/two");
-        user.setPassword("password123");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope164@syncope.apache.org");
+        userCR.setRealm("/even/two");
+        userCR.setPassword("password123");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
 
         // 2. unlink the resource from the created user
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
index 0d621b0..6935935 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
@@ -50,7 +50,9 @@ import org.apache.cxf.jaxrs.client.Client;
 import org.apache.cxf.jaxrs.client.WebClient;
 import org.apache.syncope.client.lib.batch.BatchRequest;
 import org.apache.syncope.client.lib.batch.BatchResponse;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -75,9 +77,9 @@ public class BatchITCase extends AbstractITCase {
         List<BatchRequestItem> reqItems = new ArrayList<>();
 
         // 1. create user as JSON
-        UserTO user = UserITCase.getUniqueSampleTO("batch@syncope.apache.org");
-        assertNotEquals("/odd", user.getRealm());
-        String createUserPayload = MAPPER.writeValueAsString(user);
+        UserCR userCR = UserITCase.getUniqueSample("batch@syncope.apache.org");
+        assertNotEquals("/odd", userCR.getRealm());
+        String createUserPayload = MAPPER.writeValueAsString(userCR);
 
         BatchRequestItem createUser = new BatchRequestItem();
         createUser.setMethod(HttpMethod.POST);
@@ -90,11 +92,11 @@ public class BatchITCase extends AbstractITCase {
         reqItems.add(createUser);
 
         // 2. create group as XML
-        GroupTO group = GroupITCase.getBasicSampleTO("batch");
-        JAXBContext context = JAXBContext.newInstance(GroupTO.class);
+        GroupCR groupCR = GroupITCase.getBasicSample("batch");
+        JAXBContext context = JAXBContext.newInstance(GroupCR.class);
         Marshaller marshaller = context.createMarshaller();
         StringWriter writer = new StringWriter();
-        marshaller.marshal(group, writer);
+        marshaller.marshal(groupCR, writer);
         String createGroupPayload = writer.toString();
 
         BatchRequestItem createGroup = new BatchRequestItem();
@@ -109,13 +111,13 @@ public class BatchITCase extends AbstractITCase {
 
         // 3. update the user above as JSON, request for no user data being returned
         UserUR userUR = new UserUR();
-        userUR.setKey(user.getUsername());
+        userUR.setKey(userCR.getUsername());
         userUR.setRealm(new StringReplacePatchItem.Builder().value("/odd").build());
         String updateUserPayload = MAPPER.writeValueAsString(userUR);
 
         BatchRequestItem updateUser = new BatchRequestItem();
         updateUser.setMethod(HttpMethod.PATCH);
-        updateUser.setRequestURI("/users/" + user.getUsername());
+        updateUser.setRequestURI("/users/" + userCR.getUsername());
         updateUser.setHeaders(new HashMap<>());
         updateUser.getHeaders().put(RESTHeaders.PREFER, Arrays.asList(Preference.RETURN_NO_CONTENT.toString()));
         updateUser.getHeaders().put(HttpHeaders.ACCEPT, Arrays.asList(MediaType.APPLICATION_JSON));
@@ -139,7 +141,7 @@ public class BatchITCase extends AbstractITCase {
         // 6, delete the group created above, expect deleted group as JSON
         BatchRequestItem deleteGroup = new BatchRequestItem();
         deleteGroup.setMethod(HttpMethod.DELETE);
-        deleteGroup.setRequestURI("/groups/" + group.getName());
+        deleteGroup.setRequestURI("/groups/" + groupCR.getName());
         reqItems.add(deleteGroup);
 
         String body = BatchPayloadGenerator.generate(reqItems, boundary);
@@ -169,7 +171,7 @@ public class BatchITCase extends AbstractITCase {
         assertNotNull(resItems.get(1).getHeaders().get(RESTHeaders.RESOURCE_KEY));
         assertEquals(MediaType.APPLICATION_XML, resItems.get(1).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0));
 
-        JAXBContext context = JAXBContext.newInstance(ProvisioningResult.class, GroupTO.class);
+        JAXBContext context = JAXBContext.newInstance(ProvisioningResult.class, GroupCR.class);
         Unmarshaller unmarshaller = context.createUnmarshaller();
         @SuppressWarnings("unchecked")
         ProvisioningResult<GroupTO> group = (ProvisioningResult<GroupTO>) unmarshaller.unmarshal(
@@ -193,8 +195,7 @@ public class BatchITCase extends AbstractITCase {
         assertEquals(Response.Status.OK.getStatusCode(), resItems.get(5).getStatus());
         assertNotNull(resItems.get(5).getHeaders().get(RESTHeaders.DOMAIN));
         assertEquals(MediaType.APPLICATION_JSON, resItems.get(5).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0));
-        group = MAPPER.readValue(
-                resItems.get(5).getContent(), new TypeReference<ProvisioningResult<GroupTO>>() {
+        group = MAPPER.readValue(resItems.get(5).getContent(), new TypeReference<ProvisioningResult<GroupTO>>() {
         });
         assertNotNull(group);
     }
@@ -273,23 +274,23 @@ public class BatchITCase extends AbstractITCase {
 
         // 1. create user as JSON
         UserService batchUserService = batchRequest.getService(UserService.class);
-        UserTO user = UserITCase.getUniqueSampleTO("batch@syncope.apache.org");
-        assertNotEquals("/odd", user.getRealm());
-        batchUserService.create(user, true);
+        UserCR userCR = UserITCase.getUniqueSample("batch@syncope.apache.org");
+        assertNotEquals("/odd", userCR.getRealm());
+        batchUserService.create(userCR);
 
         // 2. create group as XML
         GroupService batchGroupService = batchRequest.getService(GroupService.class);
         Client client = WebClient.client(batchGroupService).reset();
         client.type(MediaType.APPLICATION_XML).accept(MediaType.APPLICATION_XML);
-        GroupTO group = GroupITCase.getBasicSampleTO("batch");
-        batchGroupService.create(group);
+        GroupCR groupCR = GroupITCase.getBasicSample("batch");
+        batchGroupService.create(groupCR);
 
         // 3. update the user above as JSON, request for no user data being returned
         client = WebClient.client(batchUserService).reset();
         client.type(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON);
         client.header(RESTHeaders.PREFER, Preference.RETURN_NO_CONTENT.toString());
         UserUR userUR = new UserUR();
-        userUR.setKey(user.getUsername());
+        userUR.setKey(userCR.getUsername());
         userUR.setRealm(new StringReplacePatchItem.Builder().value("/odd").build());
         batchUserService.update(userUR);
 
@@ -302,7 +303,7 @@ public class BatchITCase extends AbstractITCase {
         batchGroupService.delete(UUID.randomUUID().toString());
 
         // 6, delete the group created above, expect deleted group as JSON
-        batchGroupService.delete(group.getName());
+        batchGroupService.delete(groupCR.getName());
 
         return batchRequest;
     }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
index 8112cf8..1bfe609 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
@@ -25,6 +25,7 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 import java.util.List;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.CamelRouteTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
@@ -78,7 +79,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "  </setProperty>\n"
                 + "  <doTry>\n"
                 + "    <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                             ${property.enabled},${property.storePassword})\"/>\n"
+                + "                             ${property.enabled})\"/>\n"
                 + "    <to uri=\"propagate:create?anyTypeKind=USER\"/>\n"
                 + "    <to uri=\"direct:createPort\"/>\n"
                 + "    <to uri=\"log:myLog\"/>\n"
@@ -118,7 +119,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "    </setBody>\n"
                 + "    <doTry>\n"
                 + "      <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                                     ${property.enabled},${property.storePassword})\"/>\n"
+                + "                                     ${property.enabled})\"/>\n"
                 + "      <to uri=\"propagate:create?anyTypeKind=USER\"/>\n"
                 + "      <to uri=\"direct:createPort\"/>\n"
                 + "      <doCatch>        \n"
@@ -144,18 +145,18 @@ public class CamelRouteITCase extends AbstractITCase {
             typeClass.getPlainSchemas().add(schemaTO.getKey());
             anyTypeClassService.create(typeClass);
 
-            UserTO userTO = new UserTO();
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
-            userTO.getAuxClasses().add(typeClass.getKey());
+            UserCR userCR = new UserCR();
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
+            userCR.getAuxClasses().add(typeClass.getKey());
             String userId = getUUIDString() + "camelUser@syncope.apache.org";
-            userTO.setUsername(userId);
-            userTO.setPassword("password123");
-            userTO.getPlainAttrs().add(attrTO("userId", userId));
-            userTO.getPlainAttrs().add(attrTO("fullname", userId));
-            userTO.getPlainAttrs().add(attrTO("surname", userId));
-            userTO.getPlainAttrs().add(attrTO("camelAttribute", "false"));
-
-            userTO = createUser(userTO).getEntity();
+            userCR.setUsername(userId);
+            userCR.setPassword("password123");
+            userCR.getPlainAttrs().add(attrTO("userId", userId));
+            userCR.getPlainAttrs().add(attrTO("fullname", userId));
+            userCR.getPlainAttrs().add(attrTO("surname", userId));
+            userCR.getPlainAttrs().add(attrTO("camelAttribute", "false"));
+
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
             assertEquals("true", userTO.getPlainAttr("camelAttribute").get().getValues().get(0));
         } finally {
@@ -174,7 +175,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "  </setProperty>\n"
                 + "  <doTry>\n"
                 + "    <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                             ${property.enabled},${property.storePassword})\"/>\n"
+                + "                             ${property.enabled})\"/>\n"
                 + "    <to uri=\"propagate:create123?anyTypeKind=USER\"/>\n"
                 + "    <to uri=\"direct:createPort\"/>\n"
                 + "    <to uri=\"log:myLog\"/>\n"
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
index f4d368b..a8bf513 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
@@ -29,8 +29,10 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.DynRealmTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -116,26 +118,25 @@ public class DynRealmITCase extends AbstractITCase {
             assertNotNull(role);
 
             // 3. create new user and assign the new role
-            UserTO dynRealmAdmin = UserITCase.getUniqueSampleTO("dynRealmAdmin@apache.org");
+            UserCR dynRealmAdmin = UserITCase.getUniqueSample("dynRealmAdmin@apache.org");
             dynRealmAdmin.setPassword("password123");
             dynRealmAdmin.getRoles().add(role.getKey());
-            dynRealmAdmin = createUser(dynRealmAdmin).getEntity();
-            assertNotNull(dynRealmAdmin);
+            assertNotNull(createUser(dynRealmAdmin).getEntity());
 
             // 4. create new user and group, assign resource-ldap
-            UserTO user = UserITCase.getUniqueSampleTO("dynRealmUser@apache.org");
-            user.setRealm("/even/two");
-            user.getResources().clear();
-            user.getResources().add(RESOURCE_NAME_LDAP);
-            user = createUser(user).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("dynRealmUser@apache.org");
+            userCR.setRealm("/even/two");
+            userCR.getResources().clear();
+            userCR.getResources().add(RESOURCE_NAME_LDAP);
+            UserTO user = createUser(userCR).getEntity();
             assertNotNull(user);
             final String userKey = user.getKey();
 
-            GroupTO group = GroupITCase.getSampleTO("dynRealmGroup");
-            group.setRealm("/odd");
-            group.getResources().clear();
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getSample("dynRealmGroup");
+            groupCR.setRealm("/odd");
+            groupCR.getResources().clear();
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             assertNotNull(group);
             final String groupKey = group.getKey();
 
@@ -197,9 +198,8 @@ public class DynRealmITCase extends AbstractITCase {
             GroupUR groupUR = new GroupUR();
             groupUR.setKey(groupKey);
             groupUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("icon", "modified")).build());
-            group = delegatedGroupService.update(groupUR).
-                    readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
-                    }).getEntity();
+            group = delegatedGroupService.update(groupUR).readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
+            }).getEntity();
             assertNotNull(group);
             assertEquals("modified", group.getPlainAttr("icon").get().getValues().get(0));
         } finally {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
index 9566e8f..516de1a 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
@@ -27,12 +27,12 @@ import java.util.Properties;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ItemTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
 import org.apache.syncope.common.lib.to.ResourceTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.AttrSchemaType;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
@@ -73,7 +73,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         anyTypeClassService.create(typeClass);
 
         // 2. create an user with mandatory attributes and unique
-        UserTO userTO1 = new UserTO();
+        UserCR userTO1 = new UserCR();
         userTO1.setRealm(SyncopeConstants.ROOT_REALM);
         userTO1.getAuxClasses().add(typeClass.getKey());
         String userId1 = getUUIDString() + "issue654_1@syncope.apache.org";
@@ -88,7 +88,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         createUser(userTO1);
 
         // 3. create an other user with mandatory attributes and unique with the same value of userTO1
-        UserTO userTO2 = new UserTO();
+        UserCR userTO2 = new UserCR();
         userTO2.setRealm(SyncopeConstants.ROOT_REALM);
         userTO2.getAuxClasses().add(typeClass.getKey());
         String userId2 = getUUIDString() + "issue654_2@syncope.apache.org";
@@ -114,13 +114,13 @@ public class ExceptionMapperITCase extends AbstractITCase {
         String groupUUID = getUUIDString();
 
         // Create the first group
-        GroupTO groupTO1 = new GroupTO();
+        GroupCR groupTO1 = new GroupCR();
         groupTO1.setName("child1" + groupUUID);
         groupTO1.setRealm(SyncopeConstants.ROOT_REALM);
         createGroup(groupTO1);
 
         // Create the second group, with the same name of groupTO1
-        GroupTO groupTO2 = new GroupTO();
+        GroupCR groupTO2 = new GroupCR();
         groupTO2.setName("child1" + groupUUID);
         groupTO2.setRealm(SyncopeConstants.ROOT_REALM);
         try {
@@ -135,18 +135,18 @@ public class ExceptionMapperITCase extends AbstractITCase {
 
     @Test
     public void headersMultiValue() {
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "issue654@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", "issue654"));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", "issue654"));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientCompositeException e) {
             assertEquals(2, e.getExceptions().size());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
index 1dc462a..c5221ed 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
@@ -46,13 +46,16 @@ import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
@@ -95,29 +98,29 @@ import org.junit.jupiter.api.Test;
 
 public class GroupITCase extends AbstractITCase {
 
-    public static GroupTO getBasicSampleTO(final String name) {
-        GroupTO groupTO = new GroupTO();
-        groupTO.setRealm(SyncopeConstants.ROOT_REALM);
-        groupTO.setName(name + getUUIDString());
-        return groupTO;
+    public static GroupCR getBasicSample(final String name) {
+        return new GroupCR.Builder().
+                realm(SyncopeConstants.ROOT_REALM).
+                name(name + getUUIDString()).
+                build();
     }
 
-    public static GroupTO getSampleTO(final String name) {
-        GroupTO groupTO = getBasicSampleTO(name);
+    public static GroupCR getSample(final String name) {
+        GroupCR groupCR = getBasicSample(name);
 
-        groupTO.getPlainAttrs().add(attrTO("icon", "anIcon"));
+        groupCR.getPlainAttrs().add(attrTO("icon", "anIcon"));
 
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
-        return groupTO;
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
+        return groupCR;
     }
 
     @Test
     public void create() {
-        GroupTO groupTO = getSampleTO("lastGroup");
-        groupTO.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
-        groupTO.setGroupOwner("f779c0d4-633b-4be5-8f57-32eb478a3ca5");
+        GroupCR groupCR = getSample("lastGroup");
+        groupCR.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
+        groupCR.setGroupOwner("f779c0d4-633b-4be5-8f57-32eb478a3ca5");
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         assertNotNull(groupTO.getVirAttr("rvirtualdata").get().getValues());
@@ -141,9 +144,9 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void createWithInternationalCharacters() {
-        GroupTO groupTO = getSampleTO("räksmörgås");
+        GroupCR groupCR = getSample("räksmörgås");
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
     }
 
@@ -155,13 +158,13 @@ public class GroupITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("toBeDeleted" + getUUIDString());
-        groupTO.setRealm("/even");
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("toBeDeleted" + getUUIDString());
+        groupCR.setRealm("/even");
 
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         GroupTO deletedGroup = deleteGroup(groupTO.getKey()).getEntity();
@@ -217,8 +220,8 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        GroupTO groupTO = getSampleTO("latestGroup" + getUUIDString());
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getSample("latestGroup" + getUUIDString());
+        GroupTO groupTO = createGroup(groupCR).getEntity();
 
         assertEquals(1, groupTO.getPlainAttrs().size());
 
@@ -246,13 +249,13 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void patch() {
-        GroupTO original = getBasicSampleTO("patch");
-        original.setUDynMembershipCond("(($groups==3;$resources!=ws-target-resource-1);aLong==1)");
-        original.getADynMembershipConds().put(
+        GroupCR createReq = getBasicSample("patch");
+        createReq.setUDynMembershipCond("(($groups==3;$resources!=ws-target-resource-1);aLong==1)");
+        createReq.getADynMembershipConds().put(
                 "PRINTER",
                 "(($groups==7;cool==ss);$resources==ws-target-resource-2);$type==PRINTER");
 
-        GroupTO created = createGroup(original).getEntity();
+        GroupTO created = createGroup(createReq).getEntity();
 
         created.getPlainAttrs().add(new AttrTO.Builder().schema("icon").build());
         created.getPlainAttrs().add(new AttrTO.Builder().schema("show").build());
@@ -260,7 +263,7 @@ public class GroupITCase extends AbstractITCase {
         created.getPlainAttrs().add(new AttrTO.Builder().schema("rderived_dx").value("dx").build());
         created.getPlainAttrs().add(new AttrTO.Builder().schema("title").value("mr").build());
 
-        original = groupService.read(created.getKey());
+        GroupTO original = groupService.read(created.getKey());
 
         GroupUR groupUR = AnyOperations.diff(created, original, true);
         GroupTO updated = updateGroup(groupUR).getEntity();
@@ -316,7 +319,7 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void unlink() throws IOException {
-        GroupTO actual = createGroup(getSampleTO("unlink")).getEntity();
+        GroupTO actual = createGroup(getSample("unlink")).getEntity();
         assertNotNull(actual);
 
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), actual.getKey()));
@@ -335,10 +338,10 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void link() throws IOException {
-        GroupTO groupTO = getSampleTO("link");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("link");
+        groupCR.getResources().clear();
 
-        GroupTO actual = createGroup(groupTO).getEntity();
+        GroupTO actual = createGroup(groupCR).getEntity();
         assertNotNull(actual);
 
         try {
@@ -369,7 +372,7 @@ public class GroupITCase extends AbstractITCase {
         GroupTO groupTO = null;
 
         try {
-            groupTO = createGroup(getSampleTO("unassign")).getEntity();
+            groupTO = createGroup(getSample("unassign")).getEntity();
             assertNotNull(groupTO);
 
             assertNotNull(resourceService.readConnObject(
@@ -401,11 +404,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void assign() throws IOException {
-        GroupTO groupTO = getSampleTO("assign");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("assign");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -425,7 +429,7 @@ public class GroupITCase extends AbstractITCase {
             assertNotNull(resourceService.readConnObject(
                     RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), groupTO.getKey()));
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -436,7 +440,7 @@ public class GroupITCase extends AbstractITCase {
         GroupTO groupTO = null;
 
         try {
-            groupTO = createGroup(getSampleTO("deprovision")).getEntity();
+            groupTO = createGroup(getSample("deprovision")).getEntity();
             assertNotNull(groupTO);
             assertNotNull(groupTO.getKey());
 
@@ -466,11 +470,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void provision() throws IOException {
-        GroupTO groupTO = getSampleTO("provision");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("provision");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -491,7 +496,7 @@ public class GroupITCase extends AbstractITCase {
             assertNotNull(resourceService.readConnObject(
                     RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), groupTO.getKey()));
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -499,11 +504,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void deprovisionUnlinked() throws IOException {
-        GroupTO groupTO = getSampleTO("deprovision");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("deprovision");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -540,7 +546,7 @@ public class GroupITCase extends AbstractITCase {
                 assertNotNull(e);
             }
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -555,9 +561,8 @@ public class GroupITCase extends AbstractITCase {
         schemaService.create(SchemaType.PLAIN, badge);
 
         // 2. create a group *without* an attribute for that schema: it works
-        GroupTO groupTO = getSampleTO("lastGroup");
-        assertFalse(groupTO.getPlainAttr(badge.getKey()).isPresent());
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getSample("lastGroup");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertFalse(groupTO.getPlainAttr(badge.getKey()).isPresent());
 
@@ -625,9 +630,9 @@ public class GroupITCase extends AbstractITCase {
     public void uDynMembership() {
         assertTrue(userService.read("c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships().isEmpty());
 
-        GroupTO group = getBasicSampleTO("uDynMembership");
-        group.setUDynMembershipCond("cool==true");
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = getBasicSample("uDynMembership");
+        groupCR.setUDynMembershipCond("cool==true");
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
         final String groupKey = group.getKey();
 
@@ -650,9 +655,9 @@ public class GroupITCase extends AbstractITCase {
         String fiql = SyncopeClient.getAnyObjectSearchConditionBuilder("PRINTER").is("location").notNullValue().query();
 
         // 1. create group with a given aDynMembership condition
-        GroupTO group = getBasicSampleTO("aDynMembership");
-        group.getADynMembershipConds().put("PRINTER", fiql);
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = getBasicSample("aDynMembership");
+        groupCR.getADynMembershipConds().put("PRINTER", fiql);
+        GroupTO group = createGroup(groupCR).getEntity();
         assertEquals(fiql, group.getADynMembershipConds().get("PRINTER"));
 
         group = groupService.read(group.getKey());
@@ -660,9 +665,9 @@ public class GroupITCase extends AbstractITCase {
         assertEquals(fiql, group.getADynMembershipConds().get("PRINTER"));
 
         // verify that the condition is dynamically applied
-        AnyObjectTO newAny = AnyObjectITCase.getSampleTO("aDynMembership");
-        newAny.getResources().clear();
-        newAny = createAnyObject(newAny).getEntity();
+        AnyObjectCR newAnyCR = AnyObjectITCase.getSample("aDynMembership");
+        newAnyCR.getResources().clear();
+        AnyObjectTO newAny = createAnyObject(newAnyCR).getEntity();
         assertNotNull(newAny.getPlainAttr("location"));
         List<MembershipTO> memberships = anyObjectService.read(
                 "fc6dbc3a-6c07-4965-8781-921e7401a4a5").getDynMemberships();
@@ -711,18 +716,17 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void aDynMembershipCount() {
         // Create a new printer as a dynamic member of a new group
-        GroupTO group = getBasicSampleTO("aDynamicMembership");
+        GroupCR groupCR = getBasicSample("aDynamicMembership");
         String fiql = SyncopeClient.getAnyObjectSearchConditionBuilder("PRINTER").is("location").equalTo("home").query();
-        group.getADynMembershipConds().put("PRINTER", fiql);
-        group = createGroup(group).getEntity();
+        groupCR.getADynMembershipConds().put("PRINTER", fiql);
+        GroupTO group = createGroup(groupCR).getEntity();
 
-        AnyObjectTO printer = new AnyObjectTO();
-        printer.setRealm(SyncopeConstants.ROOT_REALM);
-        printer.setName("Printer_" + getUUIDString());
-        printer.setType("PRINTER");
-        AttrTO location = new AttrTO.Builder().schema("location").value("home").build();
-        printer.getPlainAttrs().add(location);
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = new AnyObjectCR();
+        printerCR.setRealm(SyncopeConstants.ROOT_REALM);
+        printerCR.setName("Printer_" + getUUIDString());
+        printerCR.setType("PRINTER");
+        printerCR.getPlainAttrs().add(new AttrTO.Builder().schema("location").value("home").build());
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
         assertEquals(0, group.getStaticAnyObjectMembershipCount());
@@ -735,17 +739,15 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void aStaticMembershipCount() {
         // Create a new printer as a static member of a new group
-        GroupTO group = getBasicSampleTO("aStaticMembership");
-        group = createGroup(group).getEntity();
-
-        AnyObjectTO printer = new AnyObjectTO();
-        printer.setRealm(SyncopeConstants.ROOT_REALM);
-        printer.setName("Printer_" + getUUIDString());
-        printer.setType("PRINTER");
-        MembershipTO membership = new MembershipTO();
-        membership.setGroupKey(group.getKey());
-        printer.getMemberships().add(membership);
-        printer = createAnyObject(printer).getEntity();
+        GroupCR groupCR = getBasicSample("aStaticMembership");
+        GroupTO group = createGroup(groupCR).getEntity();
+
+        AnyObjectCR printerCR = new AnyObjectCR();
+        printerCR.setRealm(SyncopeConstants.ROOT_REALM);
+        printerCR.setName("Printer_" + getUUIDString());
+        printerCR.setType("PRINTER");
+        printerCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
         assertEquals(0, group.getDynamicAnyObjectMembershipCount());
@@ -771,16 +773,16 @@ public class GroupITCase extends AbstractITCase {
 
         try {
             // 1. create succeeds
-            GroupTO group = getSampleTO("syncope714");
-            group.getPlainAttrs().add(attrTO("title", "first"));
-            group.getResources().add(RESOURCE_NAME_LDAP);
+            GroupCR groupCR = getSample("syncope714");
+            groupCR.getPlainAttrs().add(attrTO("title", "first"));
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-            ProvisioningResult<GroupTO> result = createGroup(group);
+            ProvisioningResult<GroupTO> result = createGroup(groupCR);
             assertNotNull(result);
             assertEquals(1, result.getPropagationStatuses().size());
             assertEquals(RESOURCE_NAME_LDAP, result.getPropagationStatuses().get(0).getResource());
             assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-            group = result.getEntity();
+            GroupTO group = result.getEntity();
 
             // 2. update succeeds
             GroupUR groupUR = new GroupUR();
@@ -850,10 +852,10 @@ public class GroupITCase extends AbstractITCase {
         typeExtension.setAnyType(AnyTypeKind.USER.name());
         typeExtension.getAuxClasses().add("csv");
 
-        GroupTO groupTO = getBasicSampleTO("typeExtensions");
-        groupTO.getTypeExtensions().add(typeExtension);
+        GroupCR groupCR = getBasicSample("typeExtensions");
+        groupCR.getTypeExtensions().add(typeExtension);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertEquals(1, groupTO.getTypeExtensions().size());
         assertEquals(1, groupTO.getTypeExtension(AnyTypeKind.USER.name()).get().getAuxClasses().size());
@@ -879,13 +881,13 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void provisionMembers() throws InterruptedException {
         // 1. create group without resources
-        GroupTO groupTO = getBasicSampleTO("forProvision");
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getBasicSample("forProvision");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
 
         // 2. create user with such group assigned
-        UserTO userTO = UserITCase.getUniqueSampleTO("forProvision@syncope.apache.org");
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("forProvision@syncope.apache.org");
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        UserTO userTO = createUser(userCR).getEntity();
 
         // 3. modify the group by assiging the LDAP resource
         GroupUR groupUR = new GroupUR();
@@ -941,12 +943,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void issue178() {
-        GroupTO groupTO = new GroupTO();
+        GroupCR groupCR = new GroupCR();
         String groupName = "torename" + getUUIDString();
-        groupTO.setName(groupName);
-        groupTO.setRealm("/");
+        groupCR.setName(groupName);
+        groupCR.setRealm("/");
 
-        GroupTO actual = createGroup(groupTO).getEntity();
+        GroupTO actual = createGroup(groupCR).getEntity();
 
         assertNotNull(actual);
         assertEquals(groupName, actual.getName());
@@ -967,16 +969,17 @@ public class GroupITCase extends AbstractITCase {
         DerSchemaTO modified = SerializationUtils.clone(orig);
         modified.setExpression("icon + '_' + show");
 
-        GroupTO groupTO = GroupITCase.getSampleTO("lastGroup");
+        GroupCR groupCR = GroupITCase.getSample("lastGroup");
+        GroupTO groupTO = null;
         try {
             schemaService.update(SchemaType.DERIVED, modified);
 
             // 0. create group
-            groupTO.getPlainAttrs().add(attrTO("icon", "anIcon"));
-            groupTO.getPlainAttrs().add(attrTO("show", "true"));
-            groupTO.getResources().clear();
+            groupCR.getPlainAttrs().add(attrTO("icon", "anIcon"));
+            groupCR.getPlainAttrs().add(attrTO("show", "true"));
+            groupCR.getResources().clear();
 
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             // 1. create new LDAP resource having ConnObjectKey mapped to a derived attribute
@@ -1054,7 +1057,7 @@ public class GroupITCase extends AbstractITCase {
             assertEquals(1, entries);
         } finally {
             schemaService.update(SchemaType.DERIVED, orig);
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
             resourceService.delete("new-ldap");
@@ -1080,10 +1083,10 @@ public class GroupITCase extends AbstractITCase {
         anyTypeClassService.update(minimalGroup);
 
         // 2. create group, provide valid input value
-        GroupTO groupTO = GroupITCase.getBasicSampleTO("syncope717");
-        groupTO.getPlainAttrs().add(attrTO(doubleSchemaName, "11.23"));
+        GroupCR groupCR = GroupITCase.getBasicSample("syncope717");
+        groupCR.getPlainAttrs().add(attrTO(doubleSchemaName, "11.23"));
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertEquals("11.23", groupTO.getPlainAttr(doubleSchemaName).get().getValues().get(0));
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
index bea6fba..6a2bd53 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
@@ -29,8 +29,10 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -65,10 +67,10 @@ public class MembershipITCase extends AbstractITCase {
 
     @Test
     public void misc() {
-        UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-        user.setRealm("/even/two");
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
-        user.getPlainAttrs().remove(user.getPlainAttr("ctype").get());
+        UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+        userCR.setRealm("/even/two");
+        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        userCR.getPlainAttrs().removeIf(attr -> "ctype".equals(attr.getSchema()));
 
         // the group 034740a9-fa10-453b-af37-dc7897e98fb1 has USER type extensions for 'csv' and 'other' 
         // any type classes
@@ -78,11 +80,11 @@ public class MembershipITCase extends AbstractITCase {
         // 'fullname' is in 'minimal user', so it is not allowed for this membership
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("fullname").value("discarded").build());
 
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
         // user creation fails because of fullname
         try {
-            createUser(user);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
@@ -91,16 +93,17 @@ public class MembershipITCase extends AbstractITCase {
 
         // remove fullname and try again
         membership.getPlainAttrs().remove(membership.getPlainAttr("fullname").get());
+        UserTO userTO = null;
         try {
-            user = createUser(user).getEntity();
+            userTO = createUser(userCR).getEntity();
 
             // 1. verify that 'aLong' is correctly populated for user
-            assertEquals(1, user.getPlainAttr("aLong").get().getValues().size());
-            assertEquals("1976", user.getPlainAttr("aLong").get().getValues().get(0));
+            assertEquals(1, userTO.getPlainAttr("aLong").get().getValues().size());
+            assertEquals("1976", userTO.getPlainAttr("aLong").get().getValues().get(0));
 
             // 2. verify that 'aLong' is correctly populated for user's membership
-            assertEquals(1, user.getMemberships().size());
-            membership = user.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
+            assertEquals(1, userCR.getMemberships().size());
+            membership = userTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
             assertNotNull(membership);
             assertEquals(1, membership.getPlainAttr("aLong").get().getValues().size());
             assertEquals("1977", membership.getPlainAttr("aLong").get().getValues().get(0));
@@ -111,28 +114,28 @@ public class MembershipITCase extends AbstractITCase {
 
             // update user - change some values and add new membership attribute
             UserUR userUR = new UserUR();
-            userUR.setKey(user.getKey());
+            userUR.setKey(userTO.getKey());
 
             userUR.getPlainAttrs().add(new AttrPatch.Builder().
                     attrTO(new AttrTO.Builder().schema("aLong").value("1977").build()).build());
 
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().group(membership.getGroupKey()).build();
+            MembershipUR membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).build();
             membershipPatch.getPlainAttrs().add(
                     new AttrTO.Builder().schema("aLong").value("1976").build());
             membershipPatch.getPlainAttrs().add(
                     new AttrTO.Builder().schema("ctype").value("membership type").build());
             userUR.getMemberships().add(membershipPatch);
 
-            user = updateUser(userUR).getEntity();
+            userTO = updateUser(userUR).getEntity();
 
             // 4. verify that 'aLong' is correctly populated for user
-            assertEquals(1, user.getPlainAttr("aLong").get().getValues().size());
-            assertEquals("1977", user.getPlainAttr("aLong").get().getValues().get(0));
-            assertFalse(user.getPlainAttr("ctype").isPresent());
+            assertEquals(1, userTO.getPlainAttr("aLong").get().getValues().size());
+            assertEquals("1977", userTO.getPlainAttr("aLong").get().getValues().get(0));
+            assertFalse(userTO.getPlainAttr("ctype").isPresent());
 
             // 5. verify that 'aLong' is correctly populated for user's membership
-            assertEquals(1, user.getMemberships().size());
-            membership = user.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
+            assertEquals(1, userCR.getMemberships().size());
+            membership = userTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
             assertNotNull(membership);
             assertEquals(1, membership.getPlainAttr("aLong").get().getValues().size());
             assertEquals("1976", membership.getPlainAttr("aLong").get().getValues().get(0));
@@ -142,33 +145,33 @@ public class MembershipITCase extends AbstractITCase {
 
             // finally remove membership
             userUR = new UserUR();
-            userUR.setKey(user.getKey());
+            userUR.setKey(userTO.getKey());
 
-            membershipPatch = new MembershipPatch.Builder().group(membership.getGroupKey()).
+            membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).
                     operation(PatchOperation.DELETE).build();
             userUR.getMemberships().add(membershipPatch);
 
-            user = updateUser(userUR).getEntity();
+            userTO = updateUser(userUR).getEntity();
 
-            assertTrue(user.getMemberships().isEmpty());
+            assertTrue(userTO.getMemberships().isEmpty());
         } finally {
-            if (user.getKey() != null) {
-                userService.delete(user.getKey());
+            if (userTO != null) {
+                userService.delete(userTO.getKey());
             }
         }
     }
 
     @Test
     public void deleteUserWithMembership() {
-        UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-        user.setRealm("/even/two");
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+        userCR.setRealm("/even/two");
+        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
 
         MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1977").build());
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user.getKey());
 
         userService.delete(user.getKey());
@@ -182,19 +185,19 @@ public class MembershipITCase extends AbstractITCase {
         typeExtension.getAuxClasses().add("csv");
         typeExtension.getAuxClasses().add("other");
 
-        GroupTO groupTO = GroupITCase.getBasicSampleTO("typeExt");
-        groupTO.getTypeExtensions().add(typeExtension);
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = GroupITCase.getBasicSample("typeExt");
+        groupCR.getTypeExtensions().add(typeExtension);
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // pre: create user with membership to such group
-        UserTO user = UserITCase.getUniqueSampleTO("typeExt@apache.org");
+        UserCR userCR = UserITCase.getUniqueSample("typeExt@apache.org");
 
         MembershipTO membership = new MembershipTO.Builder().group(groupTO.getKey()).build();
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1454").build());
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
 
         // verify that 'aLong' is correctly populated for user's membership
         assertEquals(1, user.getMemberships().size());
@@ -238,17 +241,18 @@ public class MembershipITCase extends AbstractITCase {
             assertNotNull(newResource);
 
             // 1. create user with new resource assigned
-            UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-            user.setRealm("/even/two");
-            user.getPlainAttrs().remove(user.getPlainAttr("ctype").get());
-            user.getResources().clear();
-            user.getResources().add(newResource.getKey());
+            UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+            userCR.setRealm("/even/two");
+            UserTO user;
+            userCR.getPlainAttrs().removeIf(attr -> "ctype".equals(attr.getSchema()));
+            userCR.getResources().clear();
+            userCR.getResources().add(newResource.getKey());
 
             MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
             membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("5432").build());
-            user.getMemberships().add(membership);
+            userCR.getMemberships().add(membership);
 
-            user = createUser(user).getEntity();
+            user = createUser(userCR).getEntity();
             assertNotNull(user);
 
             // 2. verify that user was found on resource
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
index 8703d22..927ba4b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
@@ -35,6 +35,7 @@ import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.client.lib.SyncopeClientFactoryBean;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.ConnInstanceTO;
 import org.apache.syncope.common.lib.to.ItemTO;
 import org.apache.syncope.common.lib.to.MappingTO;
@@ -133,15 +134,15 @@ public class MultitenancyITCase extends AbstractITCase {
     public void createUser() {
         assertNull(adminClient.getService(RealmService.class).list().get(0).getPasswordPolicy());
 
-        UserTO user = new UserTO();
-        user.setRealm(SyncopeConstants.ROOT_REALM);
-        user.setUsername(getUUIDString());
-        user.setPassword("password");
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setUsername(getUUIDString());
+        userCR.setPassword("password");
 
-        Response response = adminClient.getService(UserService.class).create(user, true);
+        Response response = adminClient.getService(UserService.class).create(userCR);
         assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
 
-        user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
+        UserTO user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
         }).getEntity();
         assertNotNull(user);
     }
@@ -260,7 +261,7 @@ public class MultitenancyITCase extends AbstractITCase {
         try {
             new SyncopeClientFactoryBean().setAddress(ADDRESS).setDomain("NotExisting").create().
                     getService(UserSelfService.class).
-                    create(UserITCase.getUniqueSampleTO("syncope1377@syncope.apache.org"), true);
+                    create(UserITCase.getUniqueSample("syncope1377@syncope.apache.org"));
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.NotFound, e.getType());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
index 62dc977..fa68c05 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
@@ -27,6 +27,7 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.lib.SyncopeClient;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.NotificationTaskTO;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -265,10 +266,10 @@ public class NotificationTaskITCase extends AbstractNotificationTaskITCase {
         assertEquals(recipientsProvider.getKey(), notification.getRecipientsProvider());
 
         // 2. create group
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName(groupName);
-        groupTO.setRealm("/even/two");
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName(groupName);
+        groupCR.setRealm("/even/two");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 3. verify
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
index 5621c24..2b2fb84 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
@@ -32,7 +32,7 @@ import java.util.Locale;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
@@ -47,6 +47,7 @@ import org.apache.syncope.common.rest.api.beans.SchemaQuery;
 import org.apache.syncope.fit.AbstractITCase;
 import org.junit.jupiter.api.Test;
 import org.apache.cxf.helpers.IOUtils;
+import org.apache.syncope.common.lib.request.UserCR;
 
 public class PlainSchemaITCase extends AbstractITCase {
 
@@ -178,9 +179,9 @@ public class PlainSchemaITCase extends AbstractITCase {
 
         createSchema(SchemaType.PLAIN, schemaTOjson2);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("test@syncope.apache.org");
+        UserCR userCR = UserITCase.getUniqueSample("test@syncope.apache.org");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -315,11 +316,11 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue258@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
+        UserCR userCR = UserITCase.getUniqueSample("issue258@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         schemaTO.setType(AttrSchemaType.Long);
@@ -344,14 +345,14 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue259@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1"));
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("issue259@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1"));
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR req = new UserUR.Builder().key(userTO.getKey()).
-                membership(new MembershipPatch.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
+                membership(new MembershipUR.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
 
         UserTO newUserTO = updateUser(req).getEntity();
         assertNotNull(newUserTO);
@@ -370,10 +371,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue260@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("issue260@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         schemaTO.setUniqueConstraint(false);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
index 30e49af..f07a546 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
@@ -32,7 +32,9 @@ import java.util.Optional;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.syncope.client.lib.batch.BatchRequest;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.TaskTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -96,9 +98,9 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
     @Test
     public void batch() throws IOException {
         // create user with testdb resource
-        UserTO userTO = UserITCase.getUniqueSampleTO("taskBatch@apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("taskBatch@apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO userTO = createUser(userCR).getEntity();
 
         List<PropagationTaskTO> tasks = new ArrayList<>(
                 taskService.<PropagationTaskTO>search(new TaskQuery.Builder(TaskType.PROPAGATION).
@@ -139,11 +141,12 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
             resourceService.update(resource);
 
             // 1. create printer on external resource
-            AnyObjectTO anyObjectTO = AnyObjectITCase.getSampleTO("propagationJEXLTransformer");
-            String originalLocation = anyObjectTO.getPlainAttr("location").get().getValues().get(0);
+            AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("propagationJEXLTransformer");
+            String originalLocation = anyObjectCR.getPlainAttrs().stream().
+                    filter(attr -> "location".equals(attr.getSchema())).findFirst().get().getValues().get(0);
             assertFalse(originalLocation.endsWith(suffix));
 
-            anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+            AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
             assertNotNull(anyObjectTO);
 
             // 2. verify that JEXL MappingItemTransformer was applied during propagation
@@ -179,11 +182,11 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
         ldap = createResource(ldap);
 
         try {
-            UserTO user = UserITCase.getUniqueSampleTO("privilege@syncope.apache.org");
-            user.getResources().add(ldap.getKey());
-            user.getRoles().add("Other");
+            UserCR userCR = UserITCase.getUniqueSample("privilege@syncope.apache.org");
+            userCR.getResources().add(ldap.getKey());
+            userCR.getRoles().add("Other");
 
-            ProvisioningResult<UserTO> result = createUser(user);
+            ProvisioningResult<UserTO> result = createUser(userCR);
             assertEquals(1, result.getPropagationStatuses().size());
             assertNotNull(result.getPropagationStatuses().get(0).getAfterObj());
 
@@ -245,10 +248,10 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
     @Test
     public void issueSYNCOPE1288() {
         // create a new user
-        UserTO userTO = UserITCase.getUniqueSampleTO("xxxyyy@xxx.xxx");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = UserITCase.getUniqueSample("xxxyyy@xxx.xxx");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // generate some PropagationTasks
@@ -312,5 +315,4 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
 
         assertTrue(orderedTasks.getResult().equals(unorderedTasks.getResult()));
     }
-
 }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
index bb8a25c..1b850eb 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
@@ -52,6 +52,10 @@ import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.PullPolicyTO;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.TaskTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -214,20 +218,20 @@ public class PullTaskITCase extends AbstractTaskITCase {
         // -----------------------------
         // Create a new user ... it should be updated applying pull policy
         // -----------------------------
-        UserTO inUserTO = new UserTO();
-        inUserTO.setRealm(SyncopeConstants.ROOT_REALM);
-        inUserTO.setPassword("password123");
+        UserCR inUserRC = new UserCR();
+        inUserRC.setRealm(SyncopeConstants.ROOT_REALM);
+        inUserRC.setPassword("password123");
         String userName = "test9";
-        inUserTO.setUsername(userName);
-        inUserTO.getPlainAttrs().add(attrTO("firstname", "nome9"));
-        inUserTO.getPlainAttrs().add(attrTO("surname", "cognome"));
-        inUserTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        inUserTO.getPlainAttrs().add(attrTO("fullname", "nome cognome"));
-        inUserTO.getPlainAttrs().add(attrTO("userId", "puccini@syncope.apache.org"));
-        inUserTO.getPlainAttrs().add(attrTO("email", "puccini@syncope.apache.org"));
-        inUserTO.getAuxClasses().add("csv");
-
-        inUserTO = createUser(inUserTO).getEntity();
+        inUserRC.setUsername(userName);
+        inUserRC.getPlainAttrs().add(attrTO("firstname", "nome9"));
+        inUserRC.getPlainAttrs().add(attrTO("surname", "cognome"));
+        inUserRC.getPlainAttrs().add(attrTO("ctype", "a type"));
+        inUserRC.getPlainAttrs().add(attrTO("fullname", "nome cognome"));
+        inUserRC.getPlainAttrs().add(attrTO("userId", "puccini@syncope.apache.org"));
+        inUserRC.getPlainAttrs().add(attrTO("email", "puccini@syncope.apache.org"));
+        inUserRC.getAuxClasses().add("csv");
+
+        UserTO inUserTO = createUser(inUserRC).getEntity();
         assertNotNull(inUserTO);
         assertFalse(inUserTO.getResources().contains(RESOURCE_NAME_CSV));
 
@@ -399,11 +403,11 @@ public class PullTaskITCase extends AbstractTaskITCase {
         // Check for SYNCOPE-1343
         assertEquals("odd", matchingUsers.getResult().get(0).getPlainAttr("title").get().getValues().get(0));
 
-        GroupTO groupTO = matchingGroups.getResult().iterator().next();
+        GroupTO groupTO = matchingGroups.getResult().get(0);
         assertNotNull(groupTO);
         assertEquals("testLDAPGroup", groupTO.getName());
         assertEquals("true", groupTO.getPlainAttr("show").get().getValues().get(0));
-        assertEquals(matchingUsers.getResult().iterator().next().getKey(), groupTO.getUserOwner());
+        assertEquals(matchingUsers.getResult().get(0).getKey(), groupTO.getUserOwner());
         assertNull(groupTO.getGroupOwner());
         // SYNCOPE-1343, set value title to null on LDAP
         ConnObjectTO userConnObject = resourceService.readConnObject(
@@ -518,13 +522,12 @@ public class PullTaskITCase extends AbstractTaskITCase {
                     UUID.randomUUID().toString(), "Mysterious Printer", "Nowhere", true, new Date());
 
             // 1. create printer on external resource
-            AnyObjectTO anyObjectTO = AnyObjectITCase.getSampleTO("pull");
+            AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("pull");
+            AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
+            assertNotNull(anyObjectTO);
             String originalLocation = anyObjectTO.getPlainAttr("location").get().getValues().get(0);
             assertFalse(originalLocation.startsWith(prefix));
 
-            anyObjectTO = createAnyObject(anyObjectTO).getEntity();
-            assertNotNull(anyObjectTO);
-
             // 2. verify that PrefixMappingItemTransformer was applied during propagation
             // (location starts with given prefix on external resource)
             ConnObjectTO connObjectTO = resourceService.
@@ -766,22 +769,23 @@ public class PullTaskITCase extends AbstractTaskITCase {
             assertTrue(remediation.isPresent());
             assertEquals(AnyTypeKind.USER.name(), remediation.get().getAnyType());
             assertEquals(ResourceOperation.CREATE, remediation.get().getOperation());
-            assertNotNull(remediation.get().getAnyTOPayload());
+            assertNotNull(remediation.get().getAnyCRPayload());
             assertNull(remediation.get().getAnyURPayload());
             assertNull(remediation.get().getKeyPayload());
             assertTrue(remediation.get().getError().contains("RequiredValuesMissing [userId]"));
 
             // 4. remedy by copying the email value to userId
-            UserTO user = (UserTO) remediation.get().getAnyTOPayload();
-            user.getResources().clear();
+            AnyCR userCR = remediation.get().getAnyCRPayload();
+            userCR.getResources().clear();
 
-            String email = user.getPlainAttr("email").get().getValues().get(0);
-            user.getPlainAttrs().add(new AttrTO.Builder().schema("userId").value(email).build());
+            String email = userCR.getPlainAttrs().stream().
+                    filter(attr -> "email".equals(attr.getSchema())).findFirst().get().getValues().get(0);
+            userCR.getPlainAttrs().add(new AttrTO.Builder().schema("userId").value(email).build());
 
-            remediationService.remedy(remediation.get().getKey(), user);
+            remediationService.remedy(remediation.get().getKey(), userCR);
 
             // 5. user is now found
-            user = userService.read("pullFromLDAP");
+            UserTO user = userService.read("pullFromLDAP");
             assertNotNull(user);
             assertEquals(email, user.getPlainAttr("userId").get().getValues().get(0));
 
@@ -802,25 +806,25 @@ public class PullTaskITCase extends AbstractTaskITCase {
         //-----------------------------
         // Create a new user ... it should be updated applying pull policy
         //-----------------------------
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword("password123");
-        userTO.setUsername("testuser2");
-
-        userTO.getPlainAttrs().add(attrTO("firstname", "testuser2"));
-        userTO.getPlainAttrs().add(attrTO("surname", "testuser2"));
-        userTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        userTO.getPlainAttrs().add(attrTO("fullname", "a type"));
-        userTO.getPlainAttrs().add(attrTO("userId", "testuser2@syncope.apache.org"));
-        userTO.getPlainAttrs().add(attrTO("email", "testuser2@syncope.apache.org"));
-
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION2);
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
-
-        userTO.getMemberships().add(
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setPassword("password123");
+        userCR.setUsername("testuser2");
+
+        userCR.getPlainAttrs().add(attrTO("firstname", "testuser2"));
+        userCR.getPlainAttrs().add(attrTO("surname", "testuser2"));
+        userCR.getPlainAttrs().add(attrTO("ctype", "a type"));
+        userCR.getPlainAttrs().add(attrTO("fullname", "a type"));
+        userCR.getPlainAttrs().add(attrTO("userId", "testuser2@syncope.apache.org"));
+        userCR.getPlainAttrs().add(attrTO("email", "testuser2@syncope.apache.org"));
+
+        userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION2);
+        userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
+
+        userCR.getMemberships().add(
                 new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals("testuser2", userTO.getUsername());
         assertEquals(1, userTO.getMemberships().size());
@@ -941,17 +945,17 @@ public class PullTaskITCase extends AbstractTaskITCase {
         Response response = taskService.create(TaskType.PULL, task);
         task = getObject(response.getLocation(), TaskService.class, PullTaskTO.class);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("s258_1@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        UserCR userCR = UserITCase.getUniqueSample("s258_1@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        createUser(userTO);
+        createUser(userCR);
 
-        userTO = UserITCase.getUniqueSampleTO("s258_2@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        userCR = UserITCase.getUniqueSample("s258_2@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         // change email in order to unmatch the second user
         UserUR userUR = new UserUR();
@@ -975,11 +979,11 @@ public class PullTaskITCase extends AbstractTaskITCase {
         removeTestUsers();
 
         // create user with testdb resource
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope272@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        UserCR userCR = UserITCase.getUniqueSample("syncope272@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
-        userTO = result.getEntity();
+        ProvisioningResult<UserTO> result = createUser(userCR);
+        UserTO userTO = result.getEntity();
         try {
             assertNotNull(userTO);
             assertEquals(1, result.getPropagationStatuses().size());
@@ -1001,16 +1005,16 @@ public class PullTaskITCase extends AbstractTaskITCase {
 
     @Test
     public void issueSYNCOPE307() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("s307@apache.org");
-        userTO.setUsername("test0");
-        userTO.getPlainAttr("firstname").get().getValues().clear();
-        userTO.getPlainAttr("firstname").get().getValues().add("nome0");
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("s307@apache.org");
+        userCR.setUsername("test0");
+        userCR.getPlainAttrs().removeIf(attr -> "firstname".equals(attr.getSchema()));
+        userCR.getPlainAttrs().add(attrTO("firstname", "nome0"));
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         userTO = userService.read(userTO.getKey());
@@ -1046,10 +1050,10 @@ public class PullTaskITCase extends AbstractTaskITCase {
     @Test
     public void issueSYNCOPE313DB() throws Exception {
         // 1. create user in DB
-        UserTO user = UserITCase.getUniqueSampleTO("syncope313-db@syncope.apache.org");
-        user.setPassword("security123");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope313-db@syncope.apache.org");
+        userCR.setPassword("security123");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertFalse(user.getResources().isEmpty());
 
@@ -1118,10 +1122,10 @@ public class PullTaskITCase extends AbstractTaskITCase {
         try {
             // 1. create user in LDAP
             String oldCleanPassword = "security123";
-            user = UserITCase.getUniqueSampleTO("syncope313-ldap@syncope.apache.org");
-            user.setPassword(oldCleanPassword);
-            user.getResources().add(RESOURCE_NAME_LDAP);
-            user = createUser(user).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("syncope313-ldap@syncope.apache.org");
+            userCR.setPassword(oldCleanPassword);
+            userCR.getResources().add(RESOURCE_NAME_LDAP);
+            user = createUser(userCR).getEntity();
             assertNotNull(user);
             assertFalse(user.getResources().isEmpty());
 
@@ -1213,9 +1217,9 @@ public class PullTaskITCase extends AbstractTaskITCase {
         GroupTO group = null;
         try {
             // 1. create group with resource for propagation
-            propagationGroup = GroupITCase.getBasicSampleTO("SYNCOPE1062");
-            propagationGroup.getResources().add(RESOURCE_NAME_DBPULL);
-            propagationGroup = createGroup(propagationGroup).getEntity();
+            GroupCR propagationGroupCR = GroupITCase.getBasicSample("SYNCOPE1062");
+            propagationGroupCR.getResources().add(RESOURCE_NAME_DBPULL);
+            propagationGroup = createGroup(propagationGroupCR).getEntity();
 
             // 2. create pull task for another resource, with user template assigning the group above
             pullTask = new PullTaskTO();
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
index da4570b..4988a8b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
@@ -33,6 +33,7 @@ import javax.sql.DataSource;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.PushTaskTO;
@@ -365,14 +366,14 @@ public class PushTaskITCase extends AbstractTaskITCase {
         anyTypeClassService.create(typeClass);
 
         // create a new sample group
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("all" + getUUIDString());
-        groupTO.setRealm("/even");
-        groupTO.getAuxClasses().add(typeClass.getKey());
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("all" + getUUIDString());
+        groupCR.setRealm("/even");
+        groupCR.getAuxClasses().add(typeClass.getKey());
 
-        groupTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "all"));
+        groupCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "all"));
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         String resourceName = "resource-ldap-grouponly";
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
index 523ef51..a0326a3 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
@@ -44,6 +44,7 @@ import org.apache.syncope.client.lib.BasicAuthenticationHandler;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.client.lib.SyncopeClientFactoryBean;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
 import org.apache.syncope.common.lib.request.UserUR;
@@ -102,16 +103,16 @@ public class RESTITCase extends AbstractITCase {
         GroupService noContentService = noContentclient.prefer(
                 noContentclient.getService(GroupService.class), Preference.RETURN_NO_CONTENT);
 
-        GroupTO group = GroupITCase.getSampleTO("noContent");
+        GroupCR groupCR = GroupITCase.getSample("noContent");
 
-        Response response = noContentService.create(group);
+        Response response = noContentService.create(groupCR);
         assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
         assertEquals(Preference.RETURN_NO_CONTENT.toString(), response.getHeaderString(RESTHeaders.PREFERENCE_APPLIED));
         assertEquals(
                 StringUtils.EMPTY,
                 IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8));
 
-        group = getObject(response.getLocation(), GroupService.class, GroupTO.class);
+        GroupTO group = getObject(response.getLocation(), GroupService.class, GroupTO.class);
         assertNotNull(group);
 
         GroupUR groupUR = new GroupUR();
@@ -135,7 +136,7 @@ public class RESTITCase extends AbstractITCase {
 
     @Test
     public void ifMatch() {
-        UserTO userTO = userService.create(UserITCase.getUniqueSampleTO("ifmatch@syncope.apache.org"), true).
+        UserTO userTO = userService.create(UserITCase.getUniqueSample("ifmatch@syncope.apache.org")).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
         assertNotNull(userTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
index c8fd044..4374459 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
@@ -26,6 +26,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.util.Date;
 import javax.sql.DataSource;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.PullTaskTO;
@@ -49,9 +50,9 @@ public class ReconciliationITCase extends AbstractITCase {
     @Test
     public void push() {
         // 1. create printer, with no resources
-        AnyObjectTO printer = AnyObjectITCase.getSampleTO("reconciliation");
-        printer.getResources().clear();
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = AnyObjectITCase.getSample("reconciliation");
+        printerCR.getResources().clear();
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
         assertNotNull(printer.getKey());
 
         // 2. verify no printer with that name is on the external resource's db
@@ -97,9 +98,9 @@ public class ReconciliationITCase extends AbstractITCase {
     @Test
     public void pull() {
         // 1. create printer, with no resources
-        AnyObjectTO printer = AnyObjectITCase.getSampleTO("reconciliation");
-        printer.getResources().clear();
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = AnyObjectITCase.getSample("reconciliation");
+        printerCR.getResources().clear();
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
         assertNotNull(printer.getKey());
         assertNotEquals("Nowhere", printer.getPlainAttr("location").get().getValues().get(0));
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
index 2515264..8e92368 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
@@ -40,6 +40,8 @@ import org.apache.commons.lang3.SerializationUtils;
 import org.apache.syncope.client.console.commons.ConnIdSpecialName;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ItemTO;
@@ -406,16 +408,18 @@ public class ResourceITCase extends AbstractITCase {
         ResourceTO resource = resourceService.read(RESOURCE_NAME_DBSCRIPTED);
         resource.setKey(resource.getKey() + getUUIDString());
 
-        AnyObjectTO anyObject = AnyObjectITCase.getSampleTO("syncToken");
-        anyObject.getResources().clear();
-        anyObject.getResources().add(resource.getKey());
+        AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("syncToken");
+        anyObjectCR.getResources().clear();
+        anyObjectCR.getResources().add(resource.getKey());
+
+        AnyObjectTO anyObject = null;
         try {
             // create a new resource
             resource = createResource(resource);
             assertNull(resource.getProvision("PRINTER").get().getSyncToken());
 
             // create some object on the new resource
-            anyObject = createAnyObject(anyObject).getEntity();
+            anyObject = createAnyObject(anyObjectCR).getEntity();
 
             // update sync token
             resourceService.setLatestSyncToken(resource.getKey(), "PRINTER");
@@ -429,7 +433,7 @@ public class ResourceITCase extends AbstractITCase {
             resource = resourceService.read(resource.getKey());
             assertNull(resource.getProvision("PRINTER").get().getSyncToken());
         } finally {
-            if (anyObject.getKey() != null) {
+            if (anyObject != null) {
                 anyObjectService.delete(anyObject.getKey());
             }
             resourceService.delete(resource.getKey());
@@ -517,9 +521,9 @@ public class ResourceITCase extends AbstractITCase {
     public void listConnObjects() {
         List<String> groupKeys = new ArrayList<>();
         for (int i = 0; i < 10; i++) {
-            GroupTO group = GroupITCase.getSampleTO("group");
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getSample("group");
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             groupKeys.add(group.getKey());
         }
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
index 3994005..27f691a 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
@@ -321,7 +321,7 @@ public class SCIMITCase extends AbstractITCase {
         assertEquals("additional", additional.getDisplayName());
 
         // gt
-        UserTO newUser = userService.create(UserITCase.getUniqueSampleTO("scimsearch@syncope.apache.org"), true).
+        UserTO newUser = userService.create(UserITCase.getUniqueSample("scimsearch@syncope.apache.org")).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
index e803378..840da6e 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
@@ -28,9 +28,12 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.MembershipUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
@@ -133,9 +136,9 @@ public class SearchITCase extends AbstractITCase {
 
     @Test
     public void searchByDynGroup() {
-        GroupTO group = GroupITCase.getBasicSampleTO("dynMembership");
-        group.setUDynMembershipCond("cool==true");
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = GroupITCase.getBasicSample("dynMembership");
+        groupCR.setUDynMembershipCond("cool==true");
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
 
         if (ElasticsearchDetector.isElasticSearchEnabled(syncopeService)) {
@@ -373,11 +376,11 @@ public class SearchITCase extends AbstractITCase {
     @Test
     public void searchBySecurityAnswer() {
         String securityAnswer = RandomStringUtils.randomAlphanumeric(10);
-        UserTO userTO = UserITCase.getUniqueSampleTO("securityAnswer@syncope.apache.org");
-        userTO.setSecurityQuestion("887028ea-66fc-41e7-b397-620d7ea6dfbb");
-        userTO.setSecurityAnswer(securityAnswer);
+        UserCR userCR = UserITCase.getUniqueSample("securityAnswer@syncope.apache.org");
+        userCR.setSecurityQuestion("887028ea-66fc-41e7-b397-620d7ea6dfbb");
+        userCR.setSecurityAnswer(securityAnswer);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO.getSecurityQuestion());
 
         PagedResult<UserTO> matchingUsers = userService.search(
@@ -477,18 +480,18 @@ public class SearchITCase extends AbstractITCase {
 
         String serviceKey = null;
         try {
-            AnyObjectTO anyObjectTO = new AnyObjectTO();
-            anyObjectTO.setName("one");
-            anyObjectTO.setRealm(SyncopeConstants.ROOT_REALM);
-            anyObjectTO.setType(service.getKey());
-            anyObjectTO.getMemberships().add(
+            AnyObjectCR anyObjectCR = new AnyObjectCR();
+            anyObjectCR.setName("one");
+            anyObjectCR.setRealm(SyncopeConstants.ROOT_REALM);
+            anyObjectCR.setType(service.getKey());
+            anyObjectCR.getMemberships().add(
                     new MembershipTO.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
-            serviceKey = createAnyObject(anyObjectTO).getEntity().getKey();
+            serviceKey = createAnyObject(anyObjectCR).getEntity().getKey();
 
             AnyObjectUR anyObjectUR = new AnyObjectUR();
             anyObjectUR.setKey("fc6dbc3a-6c07-4965-8781-921e7401a4a5");
-            anyObjectUR.getMemberships().add(
-                    new MembershipPatch.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
+            anyObjectUR.getMemberships().add(new MembershipUR.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").
+                    build());
             updateAnyObject(anyObjectUR);
 
             PagedResult<AnyObjectTO> matching = anyObjectService.search(new AnyQuery.Builder().fiql(
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
index ceb82a3..e5d3d37 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
@@ -51,7 +51,7 @@ import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.ResourceDR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
@@ -59,6 +59,7 @@ import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.AccountPolicyTO;
 import org.apache.syncope.common.lib.policy.HaveIBeenPwnedPasswordRuleConf;
 import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.ImplementationTO;
@@ -102,26 +103,23 @@ public class UserITCase extends AbstractITCase {
         return Boolean.parseBoolean(connObjectTO.getAttr(attrName).get().getValues().get(0));
     }
 
-    public static UserTO getUniqueSampleTO(final String email) {
-        return getSampleTO(getUUIDString() + email);
+    public static UserCR getUniqueSample(final String email) {
+        return getSample(getUUIDString() + email);
     }
 
-    public static UserTO getSampleTO(final String email) {
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword("password123");
-        userTO.setUsername(email);
-
-        userTO.getPlainAttrs().add(attrTO("fullname", email));
-        userTO.getPlainAttrs().add(attrTO("firstname", email));
-        userTO.getPlainAttrs().add(attrTO("surname", "surname"));
-        userTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        userTO.getPlainAttrs().add(attrTO("userId", email));
-        userTO.getPlainAttrs().add(attrTO("email", email));
-        userTO.getPlainAttrs().add(
-                attrTO("loginDate", DateFormatUtils.ISO_8601_EXTENDED_DATETIME_FORMAT.format(new Date())));
-
-        return userTO;
+    public static UserCR getSample(final String email) {
+        return new UserCR.Builder().
+                realm(SyncopeConstants.ROOT_REALM).
+                password("password123").
+                username(email).
+                plainAttr(attrTO("fullname", email)).
+                plainAttr(attrTO("firstname", email)).
+                plainAttr(attrTO("surname", "surname")).
+                plainAttr(attrTO("ctype", "a type")).
+                plainAttr(attrTO("userId", email)).
+                plainAttr(attrTO("email", email)).
+                plainAttr(attrTO("loginDate", DateFormatUtils.ISO_8601_EXTENDED_DATETIME_FORMAT.format(new Date()))).
+                build();
     }
 
     @Test
@@ -134,11 +132,11 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void createUserWithNoPropagation() {
         // create a new user
-        UserTO userTO = getUniqueSampleTO("xxx@xxx.xxx");
-        userTO.setPassword("password123");
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION);
+        UserCR req = getUniqueSample("xxx@xxx.xxx");
+        req.setPassword("password123");
+        req.getResources().add(RESOURCE_NAME_NOPROPAGATION);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(req).getEntity();
 
         // get the propagation task just created
         PagedResult<PropagationTaskTO> tasks = taskService.search(new TaskQuery.Builder(TaskType.PROPAGATION).
@@ -154,28 +152,28 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void enforceMandatoryCondition() {
-        UserTO userTO = getUniqueSampleTO("enforce@apache.org");
-        userTO.getResources().add(RESOURCE_NAME_WS2);
-        userTO.setPassword("newPassword12");
+        UserCR userCR = getUniqueSample("enforce@apache.org");
+        userCR.getResources().add(RESOURCE_NAME_WS2);
+        userCR.setPassword("newPassword12");
 
         AttrTO type = null;
-        for (AttrTO attr : userTO.getPlainAttrs()) {
+        for (AttrTO attr : userCR.getPlainAttrs()) {
             if ("ctype".equals(attr.getSchema())) {
                 type = attr;
             }
         }
         assertNotNull(type);
-        userTO.getPlainAttrs().remove(type);
+        userCR.getPlainAttrs().remove(type);
 
         try {
-            userTO = createUser(userTO).getEntity();
+            createUser(userCR).getEntity();
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
         }
 
-        userTO.getPlainAttrs().add(type);
-        userTO = createUser(userTO).getEntity();
+        userCR.getPlainAttrs().add(type);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
     }
 
@@ -191,20 +189,20 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(resourceTO);
 
         try {
-            UserTO userTO = getUniqueSampleTO("syncope222@apache.org");
-            userTO.getResources().add(resourceTO.getKey());
-            userTO.setPassword("newPassword12");
+            UserCR userCR = getUniqueSample("syncope222@apache.org");
+            userCR.getResources().add(resourceTO.getKey());
+            userCR.setPassword("newPassword12");
 
             try {
-                userTO = createUser(userTO).getEntity();
+                createUser(userCR).getEntity();
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
             }
 
-            userTO.getAuxClasses().add("csv");
+            userCR.getAuxClasses().add("csv");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
             assertEquals(Collections.singleton(resourceTO.getKey()), userTO.getResources());
         } finally {
@@ -214,9 +212,9 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void createUserWithDbPropagation() {
-        UserTO userTO = getUniqueSampleTO("yyy@yyy.yyy");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        UserCR userCR = getUniqueSample("yyy@yyy.yyy");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
@@ -225,56 +223,56 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void createWithInvalidPassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidpasswd@syncope.apache.org");
-            userTO.setPassword("pass");
-            createUser(userTO);
+            UserCR userCR = getSample("invalidpasswd@syncope.apache.org");
+            userCR.setPassword("pass");
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidUsername() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidusername@syncope.apache.org");
-            userTO.setUsername("us");
-            userTO.setRealm("/odd");
+            UserCR userCR = getSample("invalidusername@syncope.apache.org");
+            userCR.setUsername("us");
+            userCR.setRealm("/odd");
 
-            createUser(userTO);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidPasswordByRes() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidPwdByRes@passwd.com");
+            UserCR userCR = getSample("invalidPwdByRes@passwd.com");
 
             // configured to be minLength=16
-            userTO.setPassword("password1");
-            userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION);
-            createUser(userTO);
+            userCR.setPassword("password1");
+            userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidPasswordByGroup() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidPwdByGroup@passwd.com");
+            UserCR userCR = getSample("invalidPwdByGroup@passwd.com");
 
             // configured to be minLength=16
-            userTO.setPassword("password1");
+            userCR.setPassword("password1");
 
-            userTO.getMemberships().add(new MembershipTO.Builder().
+            userCR.getMemberships().add(new MembershipTO.Builder().
                     group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-            createUser(userTO);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithException() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO newUserTO = new UserTO();
-            newUserTO.getPlainAttrs().add(attrTO("userId", "userId@nowhere.org"));
-            createUser(newUserTO);
+            UserCR userCR = new UserCR();
+            userCR.getPlainAttrs().add(attrTO("userId", "userId@nowhere.org"));
+            createUser(userCR);
         });
     }
 
@@ -292,35 +290,35 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(taskTO);
         int maxTaskExecutions = taskTO.getExecutions().size();
 
-        UserTO userTO = getUniqueSampleTO("a.b@c.com");
+        UserCR userCR = getUniqueSample("a.b@c.com");
 
         // add a membership
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // add an attribute with a non-existing schema: must be ignored
         AttrTO attrWithInvalidSchemaTO = attrTO("invalid schema", "a value");
-        userTO.getPlainAttrs().add(attrWithInvalidSchemaTO);
+        userCR.getPlainAttrs().add(attrWithInvalidSchemaTO);
 
         // add an attribute with null value: must be ignored
-        userTO.getPlainAttrs().add(attrTO("activationDate", null));
+        userCR.getPlainAttrs().add(attrTO("activationDate", null));
 
         // 1. create user
-        UserTO newUserTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
-        assertNotNull(newUserTO);
+        assertNotNull(userTO);
 
         // issue SYNCOPE-15
-        assertNotNull(newUserTO.getCreationDate());
-        assertNotNull(newUserTO.getCreator());
-        assertNotNull(newUserTO.getLastChangeDate());
-        assertNotNull(newUserTO.getLastModifier());
-        assertTrue(newUserTO.getLastChangeDate().getTime() - newUserTO.getCreationDate().getTime() < 3000);
+        assertNotNull(userTO.getCreationDate());
+        assertNotNull(userTO.getCreator());
+        assertNotNull(userTO.getLastChangeDate());
+        assertNotNull(userTO.getLastModifier());
+        assertTrue(userTO.getLastChangeDate().getTime() - userTO.getCreationDate().getTime() < 3000);
 
-        assertFalse(newUserTO.getPlainAttrs().contains(attrWithInvalidSchemaTO));
+        assertFalse(userTO.getPlainAttrs().contains(attrWithInvalidSchemaTO));
 
         // check for changePwdDate
-        assertNotNull(newUserTO.getCreationDate());
+        assertNotNull(userTO.getCreationDate());
 
         // get the new task list
         tasks = taskService.search(new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build());
@@ -343,27 +341,27 @@ public class UserITCase extends AbstractITCase {
         // 3. verify password
         try {
             Pair<Map<String, Set<String>>, UserTO> self =
-                    clientFactory.create(newUserTO.getUsername(), "password123").self();
+                    clientFactory.create(userTO.getUsername(), "password123").self();
             assertNotNull(self);
         } catch (AccessControlException e) {
             fail("Credentials should be valid and not cause AccessControlException");
         }
 
         try {
-            clientFactory.create(newUserTO.getUsername(), "passwordXX").getService(UserSelfService.class);
+            clientFactory.create(userTO.getUsername(), "passwordXX").getService(UserSelfService.class);
             fail("Credentials are invalid, thus request should raise AccessControlException");
         } catch (AccessControlException e) {
             assertNotNull(e);
         }
 
         // 4. try (and fail) to create another user with same (unique) values
-        userTO = getSampleTO(userTO.getUsername());
+        userCR = getSample(userTO.getUsername());
         AttrTO userIdAttr = userTO.getPlainAttr("userId").get();
         userIdAttr.getValues().clear();
         userIdAttr.getValues().add("a.b@c.com");
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.EntityExists, e.getType());
@@ -372,30 +370,32 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void createWithRequiredValueMissing() {
-        UserTO userTO = getUniqueSampleTO("a.b@c.it");
+        UserCR userCR = getUniqueSample("a.b@c.it");
 
-        AttrTO type = userTO.getPlainAttr("ctype").get();
-        userTO.getPlainAttrs().remove(type);
+        AttrTO type = userCR.getPlainAttrs().stream().
+                filter(attr -> "ctype".equals(attr.getSchema())).findFirst().get();
+        userCR.getPlainAttrs().remove(type);
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user without type (mandatory by UserSchema)
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
         }
 
-        userTO.getPlainAttrs().add(attrTO("ctype", "F"));
+        userCR.getPlainAttrs().add(attrTO("ctype", "F"));
 
-        AttrTO surname = userTO.getPlainAttr("surname").get();
-        userTO.getPlainAttrs().remove(surname);
+        AttrTO surname = userCR.getPlainAttrs().stream().
+                filter(attr -> "surname".equals(attr.getSchema())).findFirst().get();
+        userCR.getPlainAttrs().remove(surname);
 
         // 2. create user without surname (mandatory when type == 'F')
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
@@ -410,12 +410,12 @@ public class UserITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        UserTO userTO = getSampleTO("qqgf.z@nn.com");
+        UserCR userCR = getSample("qqgf.z@nn.com");
 
         // specify a propagation
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         String key = userTO.getKey();
 
@@ -438,12 +438,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deleteByUsername() {
-        UserTO userTO = getSampleTO("delete.by.username@apache.org");
+        UserCR userCR = getSample("delete.by.username@apache.org");
 
         // specify a propagation
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         String key = userTO.getKey();
         userTO = userService.read(key);
@@ -501,10 +501,9 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void updateWithoutPassword() {
-        UserTO userTO = getUniqueSampleTO("updatewithout@password.com");
-
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("updatewithout@password.com");
 
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR.Builder().key(userTO.getKey()).
@@ -521,9 +520,9 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void updateInvalidPassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("updateinvalid@password.com");
+            UserCR userCR = getSample("updateinvalid@password.com");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             UserUR userUR = new UserUR();
@@ -537,10 +536,10 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void updateSamePassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getUniqueSampleTO("updatesame@password.com");
-            userTO.setRealm("/even/two");
+            UserCR userCR = getUniqueSample("updatesame@password.com");
+            userCR.setRealm("/even/two");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             UserUR userUR = new UserUR();
@@ -553,12 +552,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        UserTO userTO = getUniqueSampleTO("g.h@t.com");
+        UserCR userCR = getUniqueSample("g.h@t.com");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertFalse(userTO.getDerAttrs().isEmpty());
         assertEquals(1, userTO.getMemberships().size());
@@ -573,9 +572,9 @@ public class UserITCase extends AbstractITCase {
         String newFullName = getUUIDString() + "g.h@t.com";
         userUR.getPlainAttrs().add(attrAddReplacePatch("fullname", newFullName));
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                 group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -614,10 +613,10 @@ public class UserITCase extends AbstractITCase {
                 new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()).getTotalCount();
         assertFalse(beforeTasks <= 0);
 
-        UserTO userTO = getUniqueSampleTO("pwdonly@t.com");
-        userTO.getMemberships().add(new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        UserCR userCR = getUniqueSample("pwdonly@t.com");
+        userCR.getMemberships().add(new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
@@ -649,14 +648,14 @@ public class UserITCase extends AbstractITCase {
         // --------------------------------------
         // Create operation
         // --------------------------------------
-        UserTO userTO = getUniqueSampleTO("t@p.mode");
+        UserCR userCR = getUniqueSample("t@p.mode");
 
         // add a membership
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // get the new task list
@@ -715,12 +714,12 @@ public class UserITCase extends AbstractITCase {
     public void createActivate() {
         assumeTrue(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService));
 
-        UserTO userTO = getUniqueSampleTO("createActivate@syncope.apache.org");
+        UserCR userCR = getUniqueSample("createActivate@syncope.apache.org");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("268fed79-f440-4390-9435-b273768eb5d6").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertNotNull(userTO);
         assertNotNull(userTO.getToken());
@@ -742,12 +741,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void suspendReactivate() {
-        UserTO userTO = getUniqueSampleTO("suspendReactivate@syncope.apache.org");
+        UserCR userCR = getUniqueSample("suspendReactivate@syncope.apache.org");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertNotNull(userTO);
         assertEquals(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService)
@@ -779,12 +778,12 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(ldap);
 
         // Create user with reference to resources
-        UserTO userTO = getUniqueSampleTO("suspreactonresource@syncope.apache.org");
-        userTO.getMemberships().clear();
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("suspreactonresource@syncope.apache.org");
+        userCR.getMemberships().clear();
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService)
                 ? "active"
@@ -842,11 +841,11 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void updateMultivalueAttribute() {
-        UserTO userTO = getUniqueSampleTO("multivalue@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getVirAttrs().clear();
+        UserCR userCR = getUniqueSample("multivalue@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getVirAttrs().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         AttrTO loginDate = userTO.getPlainAttr("loginDate").get();
@@ -887,12 +886,12 @@ public class UserITCase extends AbstractITCase {
         SyncopeClient asyncClient = clientFactory.create(ADMIN_UNAME, ADMIN_PWD);
         UserService asyncService = asyncClient.nullPriorityAsync(asyncClient.getService(UserService.class), true);
 
-        UserTO user = getUniqueSampleTO("async@syncope.apache.org");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user.getResources().add(RESOURCE_NAME_TESTDB2);
-        user.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = getUniqueSample("async@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB2);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        ProvisioningResult<UserTO> result = asyncService.create(user, true).readEntity(
+        ProvisioningResult<UserTO> result = asyncService.create(userCR).readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
         });
         assertNotNull(result);
@@ -919,19 +918,19 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void groupAttrPropagation() {
-        UserTO userTO = getUniqueSampleTO("checkGroupAttrPropagation@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
+        UserCR userCR = getUniqueSample("checkGroupAttrPropagation@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
 
-        userTO.getAuxClasses().add("csv");
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("37d15e4c-cdc1-460b-a591-8505c8133806").build());
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertNotNull(userTO.getDerAttr("csvuserid"));
 
@@ -985,28 +984,28 @@ public class UserITCase extends AbstractITCase {
         realmService.update(realm);
 
         try {
-            UserTO user = getUniqueSampleTO("custompolicyrules@syncope.apache.org");
-            user.setRealm(realm.getFullPath());
+            UserCR userCR = getUniqueSample("custompolicyrules@syncope.apache.org");
+            userCR.setRealm(realm.getFullPath());
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword"));
             }
 
-            user.setPassword(user.getPassword() + "XXX");
+            userCR.setPassword(userCR.getPassword() + "XXX");
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidUsername"));
             }
 
-            user.setUsername("YYY" + user.getUsername());
-            user = createUser(user).getEntity();
-            assertNotNull(user);
+            userCR.setUsername("YYY" + userCR.getUsername());
+            UserTO userTO = createUser(userCR).getEntity();
+            assertNotNull(userTO);
         } finally {
             realm.setAccountPolicy(oldAccountPolicy);
             realm.setPasswordPolicy(oldPasswordPolicy);
@@ -1019,13 +1018,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void mappingPurpose() {
-        UserTO userTO = getUniqueSampleTO("mpurpose@apache.org");
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("mpurpose@apache.org");
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         ConnObjectTO connObjectTO =
@@ -1037,8 +1036,8 @@ public class UserITCase extends AbstractITCase {
     public void batch() throws IOException {
         List<String> users = new ArrayList<>();
         for (int i = 0; i < 10; i++) {
-            UserTO userTO = getUniqueSampleTO("batch_" + i + "@apache.org");
-            users.add(String.valueOf(createUser(userTO).getEntity().getKey()));
+            UserCR userCR = getUniqueSample("batch_" + i + "@apache.org");
+            users.add(createUser(userCR).getEntity().getKey());
         }
 
         // check for a fail
@@ -1092,14 +1091,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void unlink() throws IOException {
-        UserTO userTO = getUniqueSampleTO("unlink@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("unlink@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1117,13 +1116,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void link() throws IOException {
-        UserTO userTO = getUniqueSampleTO("link@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("link@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1153,14 +1152,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void unassign() throws IOException {
-        UserTO userTO = getUniqueSampleTO("unassign@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("unassign@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1183,13 +1182,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void assign() throws IOException {
-        UserTO userTO = getUniqueSampleTO("assign@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("assign@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1213,14 +1212,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deprovision() throws IOException {
-        UserTO userTO = getUniqueSampleTO("deprovision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("deprovision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1243,13 +1242,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void provision() throws IOException {
-        UserTO userTO = getUniqueSampleTO("provision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("provision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1273,13 +1272,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deprovisionUnlinked() throws IOException {
-        UserTO userTO = getUniqueSampleTO("provision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("provision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1319,18 +1318,18 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void restResource() {
-        UserTO userTO = getUniqueSampleTO("rest@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add("rest-target-resource");
+        UserCR userCR = getUniqueSample("rest@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add("rest-target-resource");
 
         // 1. create
-        ProvisioningResult<UserTO> result = userService.create(userTO, true).readEntity(
+        ProvisioningResult<UserTO> result = userService.create(userCR).readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
         });
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
         assertEquals("rest-target-resource", result.getPropagationStatuses().get(0).getResource());
-        assertEquals("surname", userTO.getPlainAttr("surname").get().getValues().get(0));
+        assertEquals("surname", result.getEntity().getPlainAttr("surname").get().getValues().get(0));
 
         // verify user exists on the backend REST service
         WebClient webClient = WebClient.create(
@@ -1390,18 +1389,18 @@ public class UserITCase extends AbstractITCase {
         realm.setPasswordPolicy(pwdPolicy.getKey());
         realmService.create(SyncopeConstants.ROOT_REALM, realm);
 
-        UserTO user = getUniqueSampleTO("hibp@syncope.apache.org");
-        user.setRealm("/hibp");
-        user.setPassword("password");
+        UserCR userCR = getUniqueSample("hibp@syncope.apache.org");
+        userCR.setRealm("/hibp");
+        userCR.setPassword("password");
         try {
-            createUser(user);
+            createUser(userCR);
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
             assertEquals("InvalidPassword: Password pwned", e.getElements().iterator().next());
         }
 
-        user.setPassword("1" + RandomStringUtils.randomAlphanumeric(10));
-        user = createUser(user).getEntity();
-        assertNotNull(user.getKey());
+        userCR.setPassword("1" + RandomStringUtils.randomAlphanumeric(10));
+        UserTO userTO = createUser(userCR).getEntity();
+        assertNotNull(userTO.getKey());
     }
 }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
index d3b6463..4ac01df 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
@@ -46,13 +46,15 @@ import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf;
 import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -97,17 +99,17 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issue186() {
         // 1. create an user with strict mandatory attributes only
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "issue186@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", userId));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", userId));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().isEmpty());
 
@@ -151,10 +153,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue213() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue213@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        UserCR userCR = UserITCase.getUniqueSample("issue213@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(1, userTO.getResources().size());
 
@@ -182,7 +184,7 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue234() {
-        UserTO inUserTO = UserITCase.getUniqueSampleTO("issue234@syncope.apache.org");
+        UserCR inUserTO = UserITCase.getUniqueSample("issue234@syncope.apache.org");
         inUserTO.getResources().add(RESOURCE_NAME_LDAP);
 
         UserTO userTO = createUser(inUserTO).getEntity();
@@ -200,11 +202,11 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue280() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue280@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
+        UserCR userCR = UserITCase.getUniqueSample("issue280@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -229,12 +231,12 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue281() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue281@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        UserCR userCR = UserITCase.getUniqueSample("issue281@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
 
         List<PropagationStatus> propagations = result.getPropagationStatuses();
@@ -248,7 +250,7 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue288() {
-        UserTO userTO = UserITCase.getSampleTO("issue288@syncope.apache.org");
+        UserCR userTO = UserITCase.getSample("issue288@syncope.apache.org");
         userTO.getPlainAttrs().add(attrTO("aLong", "STRING"));
 
         try {
@@ -261,20 +263,20 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE108() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope108@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("syncope108@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("0626100b-a4ba-4e00-9971-86fad52a6216").build());
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("ba9ed509-b1f5-48ab-a334-c8530a6422dc").build());
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(2, userTO.getMemberships().size());
         assertEquals(1, userTO.getResources().size());
@@ -289,7 +291,7 @@ public class UserIssuesITCase extends AbstractITCase {
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().
+        userUR.getMemberships().add(new MembershipUR.Builder().
                 operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -324,7 +326,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userUR = new UserUR();
         userUR.setKey(userTO.getKey());
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().
+        userUR.getMemberships().add(new MembershipUR.Builder().
                 operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -343,16 +345,16 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE185() {
         // 1. create user with LDAP resource, succesfully propagated
-        UserTO userTO = UserITCase.getSampleTO("syncope185@syncope.apache.org");
-        userTO.getVirAttrs().clear();
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = UserITCase.getSample("syncope185@syncope.apache.org");
+        userCR.getVirAttrs().clear();
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertFalse(result.getPropagationStatuses().isEmpty());
         assertEquals(RESOURCE_NAME_LDAP, result.getPropagationStatuses().get(0).getResource());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         // 2. delete this user
         userService.delete(userTO.getKey());
@@ -376,11 +378,11 @@ public class UserIssuesITCase extends AbstractITCase {
         AttrTO newCA = configurationService.get(defaultCA.getSchema());
         assertEquals(defaultCA, newCA);
 
-        UserTO userTO = UserITCase.getSampleTO("syncope51@syncope.apache.org");
-        userTO.setPassword("password");
+        UserCR userCR = UserITCase.getSample("syncope51@syncope.apache.org");
+        userCR.setPassword("password");
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("Create user should not succeed");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.NotFound, e.getType());
@@ -399,17 +401,17 @@ public class UserIssuesITCase extends AbstractITCase {
         // ----------------------------------
         // create user and check virtual attribute value propagation
         // ----------------------------------
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope267@apache.org");
-        userTO.getVirAttrs().add(attrTO("virtualdata", "virtualvalue"));
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_DBVIRATTR);
+        UserCR userCR = UserITCase.getUniqueSample("syncope267@apache.org");
+        userCR.getVirAttrs().add(attrTO("virtualdata", "virtualvalue"));
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_DBVIRATTR);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertFalse(result.getPropagationStatuses().isEmpty());
         assertEquals(RESOURCE_NAME_DBVIRATTR, result.getPropagationStatuses().get(0).getResource());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         ConnObjectTO connObjectTO =
                 resourceService.readConnObject(RESOURCE_NAME_DBVIRATTR, AnyTypeKind.USER.name(), userTO.getKey());
@@ -426,10 +428,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE266() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope266@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope266@apache.org");
+        userCR.getResources().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -445,10 +447,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE279() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope279@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_TIMEOUT);
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        UserCR userCR = UserITCase.getUniqueSample("syncope279@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_TIMEOUT);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertEquals(RESOURCE_NAME_TIMEOUT, result.getPropagationStatuses().get(0).getResource());
         assertNotNull(result.getPropagationStatuses().get(0).getFailureReason());
         assertEquals(ExecStatus.FAILURE, result.getPropagationStatuses().get(0).getStatus());
@@ -457,13 +459,13 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE122() {
         // 1. create user on testdb and testdb2
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope122@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope122@apache.org");
+        userCR.getResources().clear();
 
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO.getResources().add(RESOURCE_NAME_TESTDB2);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_TESTDB));
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_TESTDB2));
@@ -476,7 +478,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDbAttr);
         assertNotNull(pwdOnTestDbAttr.getValues());
         assertFalse(pwdOnTestDbAttr.getValues().isEmpty());
-        String pwdOnTestDb = pwdOnTestDbAttr.getValues().iterator().next();
+        String pwdOnTestDb = pwdOnTestDbAttr.getValues().get(0);
 
         ConnObjectTO userOnDb2 = resourceService.readConnObject(
                 RESOURCE_NAME_TESTDB2, AnyTypeKind.USER.name(), userTO.getKey());
@@ -484,7 +486,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDb2Attr);
         assertNotNull(pwdOnTestDb2Attr.getValues());
         assertFalse(pwdOnTestDb2Attr.getValues().isEmpty());
-        String pwdOnTestDb2 = pwdOnTestDb2Attr.getValues().iterator().next();
+        String pwdOnTestDb2 = pwdOnTestDb2Attr.getValues().get(0);
 
         // 2. request to change password only on testdb (no Syncope, no testdb2)
         UserUR userUR = new UserUR();
@@ -498,7 +500,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 3a. Chech that only a single propagation took place
         assertNotNull(result.getPropagationStatuses());
         assertEquals(1, result.getPropagationStatuses().size());
-        assertEquals(RESOURCE_NAME_TESTDB, result.getPropagationStatuses().iterator().next().getResource());
+        assertEquals(RESOURCE_NAME_TESTDB, result.getPropagationStatuses().get(0).getResource());
 
         // 3b. verify that password hasn't changed on Syncope
         assertEquals(pwdOnSyncope, userTO.getPassword());
@@ -509,7 +511,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDbAttrAfter);
         assertNotNull(pwdOnTestDbAttrAfter.getValues());
         assertFalse(pwdOnTestDbAttrAfter.getValues().isEmpty());
-        assertNotEquals(pwdOnTestDb, pwdOnTestDbAttrAfter.getValues().iterator().next());
+        assertNotEquals(pwdOnTestDb, pwdOnTestDbAttrAfter.getValues().get(0));
 
         // 3d. verify that password hasn't changed on testdb2
         userOnDb2 = resourceService.readConnObject(RESOURCE_NAME_TESTDB2, AnyTypeKind.USER.name(), userTO.getKey());
@@ -517,7 +519,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDb2AttrAfter);
         assertNotNull(pwdOnTestDb2AttrAfter.getValues());
         assertFalse(pwdOnTestDb2AttrAfter.getValues().isEmpty());
-        assertEquals(pwdOnTestDb2, pwdOnTestDb2AttrAfter.getValues().iterator().next());
+        assertEquals(pwdOnTestDb2, pwdOnTestDb2AttrAfter.getValues().get(0));
     }
 
     @Test
@@ -533,10 +535,10 @@ public class UserIssuesITCase extends AbstractITCase {
         UserTO userTO = null;
         try {
             // 3. create user with no resources
-            userTO = UserITCase.getUniqueSampleTO("syncope136_AES@apache.org");
-            userTO.getResources().clear();
+            UserCR userCR = UserITCase.getUniqueSample("syncope136_AES@apache.org");
+            userCR.getResources().clear();
 
-            userTO = createUser(userTO).getEntity();
+            userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 4. update user, assign a propagation priority resource but don't provide any password
@@ -555,7 +557,7 @@ public class UserIssuesITCase extends AbstractITCase {
             List<PropagationStatus> props = result.getPropagationStatuses();
             assertNotNull(props);
             assertEquals(1, props.size());
-            PropagationStatus prop = props.iterator().next();
+            PropagationStatus prop = props.get(0);
             assertNotNull(prop);
             assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
             assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -573,9 +575,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE136Random() {
         // 1. create user with no resources
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope136_Random@apache.org");
-        userTO.getResources().clear();
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope136_Random@apache.org");
+        userCR.getResources().clear();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. update user, assign a propagation priority resource but don't provide any password
@@ -592,7 +594,7 @@ public class UserIssuesITCase extends AbstractITCase {
         List<PropagationStatus> props = result.getPropagationStatuses();
         assertNotNull(props);
         assertEquals(1, props.size());
-        PropagationStatus prop = props.iterator().next();
+        PropagationStatus prop = props.get(0);
         assertNotNull(prop);
         assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
         assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -628,20 +630,20 @@ public class UserIssuesITCase extends AbstractITCase {
         resourceService.update(ldap);
 
         // 1. create group with LDAP resource
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("SYNCOPE354-" + getUUIDString());
-        groupTO.setRealm("/");
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("SYNCOPE354-" + getUUIDString());
+        groupCR.setRealm("/");
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 2. create user with LDAP resource and membership of the above group
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope354@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope354@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.USER.name(), userTO.getKey()));
 
@@ -655,7 +657,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 4. remove membership
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.DELETE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.DELETE).
                 group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -684,22 +686,22 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE357() throws IOException {
         // 1. create group with LDAP resource
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("SYNCOPE357-" + getUUIDString());
-        groupTO.setRealm("/");
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("SYNCOPE357-" + getUUIDString());
+        groupCR.setRealm("/");
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 2. create user with membership of the above group
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope357@syncope.apache.org");
-        userTO.getPlainAttrs().add(attrTO("obscure", "valueToBeObscured"));
-        userTO.getPlainAttrs().add(attrTO("photo", Base64.getEncoder().encodeToString(
+        UserCR userCR = UserITCase.getUniqueSample("syncope357@syncope.apache.org");
+        userCR.getPlainAttrs().add(attrTO("obscure", "valueToBeObscured"));
+        userCR.getPlainAttrs().add(attrTO("photo", Base64.getEncoder().encodeToString(
                 IOUtils.readBytesFromStream(getClass().getResourceAsStream("/favicon.jpg")))));
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
         assertNotNull(userTO.getPlainAttr("obscure"));
         assertNotNull(userTO.getPlainAttr("photo"));
@@ -730,9 +732,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE383() {
         // 1. create user without resources
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope383@apache.org");
-        userTO.getResources().clear();
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope383@apache.org");
+        userCR.getResources().clear();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. assign resource without specifying a new pwd and check propagation failure
@@ -764,17 +766,17 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE402() {
         // 1. create an user with strict mandatory attributes only
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "syncope402@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", userId));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", userId));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().isEmpty());
 
@@ -816,16 +818,16 @@ public class UserIssuesITCase extends AbstractITCase {
         }
         assertNotNull(logicActions);
 
-        RealmTO realm = realmService.list("/even/two").iterator().next();
+        RealmTO realm = realmService.list("/even/two").get(0);
         assertNotNull(realm);
         realm.getActions().add(logicActions.getKey());
         realmService.update(realm);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope420@syncope.apache.org");
-        userTO.setRealm(realm.getFullPath());
-        userTO.getPlainAttrs().add(attrTO("makeItDouble", "3"));
+        UserCR userCR = UserITCase.getUniqueSample("syncope420@syncope.apache.org");
+        userCR.setRealm(realm.getFullPath());
+        userCR.getPlainAttrs().add(attrTO("makeItDouble", "3"));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertEquals("6", userTO.getPlainAttr("makeItDouble").get().getValues().get(0));
 
         UserUR userUR = new UserUR();
@@ -838,8 +840,8 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE426() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope426@syncope.apache.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope426@syncope.apache.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -853,9 +855,10 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE435() {
         // 1. create user without password
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope435@syncope.apache.org");
-        userTO.setPassword(null);
-        userTO = createUser(userTO, false).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope435@syncope.apache.org");
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. try to update user by subscribing a resource - works but propagation is not even attempted
@@ -876,9 +879,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE454() throws NamingException {
         // 1. create user with LDAP resource (with 'Generate password if missing' enabled)
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope454@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope454@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. read resource configuration for LDAP binding
@@ -909,13 +912,13 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE493() {
         // 1.  create user and check that firstname is not propagated on resource with mapping for firstname set to NONE
-        UserTO userTO = UserITCase.getUniqueSampleTO("493@test.org");
-        userTO.getResources().add(RESOURCE_NAME_WS1);
-        ProvisioningResult<UserTO> result = createUser(userTO);
-        assertNotNull(userTO);
+        UserCR userCR = UserITCase.getUniqueSample("493@test.org");
+        userCR.getResources().add(RESOURCE_NAME_WS1);
+        ProvisioningResult<UserTO> result = createUser(userCR);
+        assertNotNull(result);
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         ConnObjectTO actual =
                 resourceService.readConnObject(RESOURCE_NAME_WS1, AnyTypeKind.USER.name(), userTO.getKey());
@@ -981,9 +984,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE505DB() throws Exception {
         // 1. create user
-        UserTO user = UserITCase.getUniqueSampleTO("syncope505-db@syncope.apache.org");
-        user.setPassword("security123");
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope505-db@syncope.apache.org");
+        userCR.setPassword("security123");
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertTrue(user.getResources().isEmpty());
 
@@ -1031,9 +1034,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE505LDAP() throws Exception {
         // 1. create user
-        UserTO user = UserITCase.getUniqueSampleTO("syncope505-ldap@syncope.apache.org");
-        user.setPassword("security123");
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope505-ldap@syncope.apache.org");
+        userCR.setPassword("security123");
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertTrue(user.getResources().isEmpty());
 
@@ -1086,28 +1089,30 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE391() {
         // 1. create user on Syncope with null password
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword(null);
+        UserCR userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
 
-        userTO = createUser(userTO, false).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertNull(userTO.getPassword());
 
         // 2. create existing user on csv and check that password on Syncope is null and that password on resource
         // doesn't change
-        userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword(null);
-        userTO.setUsername("syncope391@syncope.apache.org");
-        userTO.getPlainAttrs().add(attrTO("fullname", "fullname"));
-        userTO.getPlainAttrs().add(attrTO("firstname", "nome0"));
-        userTO.getPlainAttrs().add(attrTO("surname", "cognome0"));
-        userTO.getPlainAttrs().add(attrTO("userId", "syncope391@syncope.apache.org"));
-        userTO.getPlainAttrs().add(attrTO("email", "syncope391@syncope.apache.org"));
-
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-        userTO = createUser(userTO, false).getEntity();
+        userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
+        userCR.setUsername("syncope391@syncope.apache.org");
+        userCR.getPlainAttrs().add(attrTO("fullname", "fullname"));
+        userCR.getPlainAttrs().add(attrTO("firstname", "nome0"));
+        userCR.getPlainAttrs().add(attrTO("surname", "cognome0"));
+        userCR.getPlainAttrs().add(attrTO("userId", "syncope391@syncope.apache.org"));
+        userCR.getPlainAttrs().add(attrTO("email", "syncope391@syncope.apache.org"));
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         ConnObjectTO connObjectTO =
@@ -1120,13 +1125,14 @@ public class UserIssuesITCase extends AbstractITCase {
 
         // 3. create user with not null password and propagate onto resource-csv, specify not to save password on
         // Syncope local storage
-        userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword("passwordTESTNULL1");
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-        userTO = createUser(userTO, false).getEntity();
+        userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword("passwordTESTNULL1");
+        userCR.setStorePassword(false);
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         connObjectTO =
@@ -1140,14 +1146,14 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNull(userTO.getPassword());
 
         // 4. create user and propagate password on resource-csv and on Syncope local storage
-        userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword("passwordTESTNULL1");
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword("passwordTESTNULL1");
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
         // storePassword true by default
-        userTO = createUser(userTO).getEntity();
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         connObjectTO = resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), userTO.getKey());
@@ -1170,13 +1176,14 @@ public class UserIssuesITCase extends AbstractITCase {
             csv = resourceService.read(RESOURCE_NAME_CSV);
             assertEquals("55e5de0b-c79c-4e66-adda-251b6fb8579a", csv.getPasswordPolicy());
 
-            userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-            userTO.setPassword(null);
-            userTO.getVirAttrs().clear();
-            userTO.getAuxClasses().add("csv");
+            userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+            userCR.setPassword(null);
+            userCR.setStorePassword(false);
+            userCR.getVirAttrs().clear();
+            userCR.getAuxClasses().add("csv");
+            userCR.getResources().add(RESOURCE_NAME_CSV);
 
-            userTO.getResources().add(RESOURCE_NAME_CSV);
-            createUser(userTO, false);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
@@ -1190,18 +1197,18 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE647() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope647@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("syncope647@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getAuxClasses().add("generic membership");
-        userTO.getPlainAttrs().add(attrTO("postalAddress", "postalAddress"));
+        userCR.getAuxClasses().add("generic membership");
+        userCR.getPlainAttrs().add(attrTO("postalAddress", "postalAddress"));
 
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(actual.getDerAttr("csvuserid"));
 
@@ -1247,19 +1254,19 @@ public class UserIssuesITCase extends AbstractITCase {
         realmService.update(realm);
 
         try {
-            UserTO user = UserITCase.getUniqueSampleTO("syncope626@syncope.apache.org");
-            user.setRealm(realm.getFullPath());
-            user.setPassword(user.getUsername());
+            UserCR userCR = UserITCase.getUniqueSample("syncope626@syncope.apache.org");
+            userCR.setRealm(realm.getFullPath());
+            userCR.setPassword(userCR.getUsername());
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword"));
             }
 
-            user.setPassword("password123");
-            user = createUser(user).getEntity();
+            userCR.setPassword("password123");
+            UserTO user = createUser(userCR).getEntity();
             assertNotNull(user);
         } finally {
             realm.setPasswordPolicy(oldPasswordPolicy);
@@ -1282,22 +1289,22 @@ public class UserIssuesITCase extends AbstractITCase {
 
         try {
             // 3. create group with LDAP resource assigned
-            GroupTO group = GroupITCase.getBasicSampleTO("syncope686");
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getBasicSample("syncope686");
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             assertNotNull(group);
 
             // 4. create user with no resources
-            UserTO userTO = UserITCase.getUniqueSampleTO("syncope686@apache.org");
-            userTO.getResources().clear();
+            UserCR userCR = UserITCase.getUniqueSample("syncope686@apache.org");
+            userCR.getResources().clear();
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 5. update user with the new group, and don't provide any password
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
-            userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+            userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                     group(group.getKey()).build());
 
             ProvisioningResult<UserTO> result = updateUser(userUR);
@@ -1307,7 +1314,7 @@ public class UserIssuesITCase extends AbstractITCase {
             List<PropagationStatus> props = result.getPropagationStatuses();
             assertNotNull(props);
             assertEquals(1, props.size());
-            PropagationStatus prop = props.iterator().next();
+            PropagationStatus prop = props.get(0);
             assertNotNull(prop);
             assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
             assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -1321,24 +1328,24 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE710() {
         // 1. create groups for indirect resource assignment
-        GroupTO ldapGroup = GroupITCase.getBasicSampleTO("syncope710.ldap");
-        ldapGroup.getResources().add(RESOURCE_NAME_LDAP);
-        ldapGroup = createGroup(ldapGroup).getEntity();
+        GroupCR ldapGroupCR = GroupITCase.getBasicSample("syncope710.ldap");
+        ldapGroupCR.getResources().add(RESOURCE_NAME_LDAP);
+        GroupTO ldapGroup = createGroup(ldapGroupCR).getEntity();
 
-        GroupTO dbGroup = GroupITCase.getBasicSampleTO("syncope710.db");
-        dbGroup.getResources().add(RESOURCE_NAME_TESTDB);
-        dbGroup = createGroup(dbGroup).getEntity();
+        GroupCR dbGroupCR = GroupITCase.getBasicSample("syncope710.db");
+        dbGroupCR.getResources().add(RESOURCE_NAME_TESTDB);
+        GroupTO dbGroup = createGroup(dbGroupCR).getEntity();
 
         // 2. create user with memberships for the groups created above
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope710@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getMemberships().add(new MembershipTO.Builder().group(ldapGroup.getKey()).build());
-        userTO.getMemberships().add(new MembershipTO.Builder().group(dbGroup.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope710@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getMemberships().add(new MembershipTO.Builder().group(ldapGroup.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder().group(dbGroup.getKey()).build());
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertEquals(2, result.getPropagationStatuses().size());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         // 3. request to propagate password only to db
         UserUR userUR = new UserUR();
@@ -1354,19 +1361,19 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE881() {
         // 1. create group and assign LDAP
-        GroupTO group = GroupITCase.getSampleTO("syncope881G");
-        group.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
+        GroupCR groupCR = GroupITCase.getSample("syncope881G");
+        groupCR.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
 
-        group = createGroup(group).getEntity();
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), group.getKey()));
 
         // 2. create user and assign such group
-        UserTO user = UserITCase.getUniqueSampleTO("syncope881U@apache.org");
-        user.getMemberships().clear();
-        user.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope881U@apache.org");
+        userCR.getMemberships().clear();
+        userCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
 
         // 3. verify that user is in LDAP
@@ -1388,23 +1395,25 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE1099() {
         // 1. create group with dynamic condition and resource
-        GroupTO group = GroupITCase.getSampleTO("syncope1099G");
-        group.getResources().clear();
-        group.getResources().add(RESOURCE_NAME_TESTDB);
-        group.setUDynMembershipCond("firstname==issueSYNCOPE1099");
+        GroupCR groupCR = GroupITCase.getSample("syncope1099G");
+        groupCR.getResources().clear();
+        groupCR.getResources().add(RESOURCE_NAME_TESTDB);
+        groupCR.setUDynMembershipCond("firstname==issueSYNCOPE1099");
 
-        group = createGroup(group).getEntity();
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
 
         // 2. create user matching the condition above
-        UserTO user = UserITCase.getUniqueSampleTO("syncope1099U@apache.org");
-        user.getPlainAttr("firstname").get().getValues().set(0, "issueSYNCOPE1099");
+        UserCR userCR = UserITCase.getUniqueSample("syncope1099U@apache.org");
+        userCR.getPlainAttrs().stream().
+                filter(attr -> "firstname".equals(attr.getSchema())).findFirst().get().
+                getValues().set(0, "issueSYNCOPE1099");
 
-        ProvisioningResult<UserTO> created = createUser(user);
+        ProvisioningResult<UserTO> created = createUser(userCR);
         assertNotNull(created);
 
         // 3. verify that dynamic membership is set and that resource is consequently assigned
-        user = created.getEntity();
+        UserTO user = created.getEntity();
         String groupKey = group.getKey();
         assertTrue(user.getDynMemberships().stream().anyMatch(m -> m.getGroupKey().equals(groupKey)));
         assertTrue(user.getResources().contains(RESOURCE_NAME_TESTDB));
@@ -1416,8 +1425,8 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE1166() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope1166@apache.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope1166@apache.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -1445,18 +1454,18 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE1206() {
         // 1. create group with dynamic user condition 'cool==true'
-        GroupTO dynGroup = GroupITCase.getSampleTO("syncope1206");
-        dynGroup.setUDynMembershipCond(
+        GroupCR dynGroupCR = GroupITCase.getSample("syncope1206");
+        dynGroupCR.setUDynMembershipCond(
                 SyncopeClient.getUserSearchConditionBuilder().is("cool").equalTo("true").query());
-        dynGroup = createGroup(dynGroup).getEntity();
+        GroupTO dynGroup = createGroup(dynGroupCR).getEntity();
         assertNotNull(dynGroup);
         assertTrue(dynGroup.getResources().contains(RESOURCE_NAME_LDAP));
 
         // 2. create user (no value for cool, no dynamic membership, no propagation to LDAP)
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope1206@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope1206@apache.org");
+        userCR.getResources().clear();
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertTrue(result.getPropagationStatuses().isEmpty());
 
         // 3. update user to match the dynamic condition: expect propagation to LDAP
@@ -1489,10 +1498,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
         try {
             // 2. create user under /even/two to get password policy with history length 1
-            UserTO userTO = UserITCase.getUniqueSampleTO("syncope1337@apache.org");
-            userTO.setPassword("Password123");
-            userTO.setRealm("/even/two");
-            userTO = createUser(userTO).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("syncope1337@apache.org");
+            userCR.setPassword("Password123");
+            userCR.setRealm("/even/two");
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 3. attempt to set the same password value: fails
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
index 77a01ae..dd5b907 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
@@ -60,7 +60,7 @@ public class UserRequestITCase extends AbstractITCase {
     public void twoLevelsApproval() {
         assumeTrue(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService));
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("twoLevelsApproval@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("twoLevelsApproval@tirasa.net")).getEntity();
         assertNotNull(user);
         assertFalse(user.getMembership("ebf97068-aa4b-4a85-9f01-680e8c4cf227").isPresent());
 
@@ -144,7 +144,7 @@ public class UserRequestITCase extends AbstractITCase {
                 userRequestService.getForms(new UserRequestFormQuery.Builder().build());
         int preForms = forms.getTotalCount();
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("twoLevelsApproval@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("twoLevelsApproval@tirasa.net")).getEntity();
         assertNotNull(user);
         assertFalse(user.getMembership("ebf97068-aa4b-4a85-9f01-680e8c4cf227").isPresent());
 
@@ -178,7 +178,7 @@ public class UserRequestITCase extends AbstractITCase {
                 userRequestService.getForms(new UserRequestFormQuery.Builder().build());
         int preForms = forms.getTotalCount();
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("userSelection@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("userSelection@tirasa.net")).getEntity();
         assertNotNull(user);
         List<RelationshipTO> relationships = userService.read(user.getKey()).getRelationships();
         assertTrue(relationships.isEmpty());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
index 8b33f8c..90ba42b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
@@ -41,10 +41,11 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
... 537 lines suppressed ...