You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2018/12/11 16:58:18 UTC

[syncope] branch master updated (366f56a -> 56d67c5)

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git.


    from 366f56a  Upgrading cargo-maven2-plugin
     new 90d1d93  [SYNCOPE-1410] Now using [User,Group,AnyObject]CR instead of [\1]TO for create
     new 56d67c5  [SYNCOPE-1410] More robust Builders

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../console/panels/RemediationDirectoryPanel.java  |  28 +-
 .../client/console/rest/AnyObjectRestClient.java   |   5 +-
 .../client/console/rest/GroupRestClient.java       |   5 +-
 .../client/console/rest/RemediationRestClient.java |   7 +-
 .../client/console/rest/UserRestClient.java        |   5 +-
 .../console/status/AnyStatusDirectoryPanel.java    |   6 +-
 .../client/console/status/ChangePasswordModal.java |   2 +-
 .../status/ResourceStatusDirectoryPanel.java       |   3 +-
 .../wizards/any/AnyObjectWizardBuilder.java        |   7 +-
 .../console/wizards/any/GroupWizardBuilder.java    |   7 +-
 .../syncope/client/console/wizards/any/Groups.java |   4 +-
 .../console/wizards/any/UserWizardBuilder.java     |   8 +-
 .../console/implementations/MyPullActions.groovy   |  26 +-
 .../client/enduser/resources/GroupResource.java    |   4 +-
 .../enduser/resources/UserSelfCreateResource.java  |  31 +-
 .../enduser/resources/UserSelfUpdateResource.java  |  16 +-
 .../client/enduser/util/ValidationTest.java        |   4 +-
 .../apache/syncope/common/lib/AnyOperations.java   |  94 ++--
 .../apache/syncope/common/lib/EntityTOUtils.java   |  88 ++++
 .../syncope/common/lib/request/AbstractPatch.java  |   2 +-
 .../common/lib/request/{AnyUR.java => AnyCR.java}  | 125 +++---
 .../AnyObjectTO.java => request/AnyObjectCR.java}  |  92 +++-
 .../syncope/common/lib/request/AnyObjectUR.java    |  24 +-
 .../apache/syncope/common/lib/request/AnyUR.java   |  16 +-
 .../syncope/common/lib/request/AttrPatch.java      |  11 +-
 .../lib/request/{GroupUR.java => GroupCR.java}     |  70 ++-
 .../apache/syncope/common/lib/request/GroupUR.java |   4 +
 .../{MembershipPatch.java => MembershipUR.java}    |  20 +-
 ...{RelationshipPatch.java => RelationshipUR.java} |  20 +-
 .../lib/request/{UserUR.java => UserCR.java}       | 152 ++++---
 .../apache/syncope/common/lib/request/UserUR.java  |  24 +-
 .../common/lib/to/AbstractAnnotatedBean.java       |   5 -
 .../apache/syncope/common/lib/to/AnyObjectTO.java  |   1 -
 .../org/apache/syncope/common/lib/to/AnyTO.java    |  14 +-
 .../org/apache/syncope/common/lib/to/AttrTO.java   |   3 +-
 .../AttributableReqEntity.java}                    |  13 +-
 .../org/apache/syncope/common/lib/to/GroupTO.java  |   4 -
 .../apache/syncope/common/lib/to/MembershipTO.java |  38 +-
 .../syncope/common/lib/to/RemediationTO.java       |  11 +-
 .../org/apache/syncope/common/lib/to/UserTO.java   |   9 -
 .../syncope/common/lib/types/AnyTypeKind.java      |  29 +-
 .../syncope/common/lib/AnyOperationsTest.java      |   8 +-
 .../org/apache/syncope/common/lib/JAXBTest.java    |   2 +-
 .../org/apache/syncope/common/lib/JSONTest.java    |   6 +-
 .../common/rest/api/service/AnyObjectService.java  |   5 +-
 .../common/rest/api/service/GroupService.java      |   5 +-
 .../rest/api/service/RemediationService.java       |   6 +-
 .../common/rest/api/service/UserSelfService.java   |   8 +-
 .../common/rest/api/service/UserService.java       |  10 +-
 .../syncope/core/logic/AbstractAnyLogic.java       |  46 +-
 .../apache/syncope/core/logic/AnyObjectLogic.java  |   7 +-
 .../org/apache/syncope/core/logic/GroupLogic.java  |   7 +-
 .../syncope/core/logic/ReconciliationLogic.java    |   8 +-
 .../syncope/core/logic/RemediationLogic.java       |  16 +-
 .../org/apache/syncope/core/logic/UserLogic.java   |  23 +-
 .../core/persistence/api/entity/AnyUtils.java      |   5 +-
 .../core/persistence/api/entity/Remediation.java   |   8 +-
 .../core/persistence/jpa/entity/JPAAnyUtils.java   |  37 +-
 .../persistence/jpa/entity/JPARemediation.java     |  10 +-
 .../validation/entity/RemediationValidator.java    |   2 +-
 .../api/AnyObjectProvisioningManager.java          |   5 +-
 .../provisioning/api/GroupProvisioningManager.java |   6 +-
 .../core/provisioning/api/LogicActions.java        |   5 +-
 .../core/provisioning/api/ProvisioningManager.java |  14 +-
 .../provisioning/api/UserProvisioningManager.java  |   8 +-
 .../provisioning/api/data/AnyObjectDataBinder.java |   3 +-
 .../provisioning/api/data/GroupDataBinder.java     |   3 +-
 .../core/provisioning/api/data/UserDataBinder.java |   3 +-
 .../provisioning/api/pushpull/PullActions.java     |  47 +-
 .../java/DefaultAnyObjectProvisioningManager.java  |  12 +-
 .../java/DefaultGroupProvisioningManager.java      |  18 +-
 .../java/DefaultUserProvisioningManager.java       |  23 +-
 .../core/provisioning/java/MappingManagerImpl.java |   6 +-
 .../java/data/AbstractAnyDataBinder.java           |  29 +-
 .../java/data/AnyObjectDataBinderImpl.java         |  31 +-
 .../java/data/ConfigurationDataBinderImpl.java     |   3 +-
 .../java/data/GroupDataBinderImpl.java             |  33 +-
 .../java/data/RemediationDataBinderImpl.java       |   4 +-
 .../provisioning/java/data/UserDataBinderImpl.java |  41 +-
 .../provisioning/java/job/SetUMembershipsJob.java  |  20 +-
 .../java/pushpull/AbstractPullResultHandler.java   |  37 +-
 .../java/pushpull/DBPasswordPullActions.java       |  12 +-
 .../DefaultAnyObjectPullResultHandler.java         |  15 +-
 .../pushpull/DefaultGroupPullResultHandler.java    |  15 +-
 .../pushpull/DefaultUserPullResultHandler.java     |  15 +-
 .../java/pushpull/LDAPMembershipPullActions.java   |   4 +-
 .../java/pushpull/LDAPPasswordPullActions.java     |  12 +-
 .../provisioning/java/utils/ConnObjectUtils.java   |  61 +--
 .../provisioning/java/utils/TemplateUtils.java     |  63 ++-
 .../core/provisioning/java/MailTemplateTest.java   |   8 +-
 .../core/rest/cxf/service/AbstractAnyService.java  |   9 +-
 .../rest/cxf/service/AnyObjectServiceImpl.java     |  12 +-
 .../core/rest/cxf/service/GroupServiceImpl.java    |  11 +-
 .../rest/cxf/service/RemediationServiceImpl.java   |   6 +-
 .../core/rest/cxf/service/UserSelfServiceImpl.java |   5 +-
 .../core/rest/cxf/service/UserServiceImpl.java     |  11 +-
 .../workflow/api/AnyObjectWorkflowAdapter.java     |   6 +-
 .../core/workflow/api/GroupWorkflowAdapter.java    |   6 +-
 .../core/workflow/api/UserWorkflowAdapter.java     |  13 +-
 .../java/AbstractAnyObjectWorkflowAdapter.java     |   8 +-
 .../java/AbstractGroupWorkflowAdapter.java         |   8 +-
 .../workflow/java/AbstractUserWorkflowAdapter.java |  15 +-
 .../java/DefaultAnyObjectWorkflowAdapter.java      |   6 +-
 .../workflow/java/DefaultGroupWorkflowAdapter.java |   6 +-
 .../workflow/java/DefaultUserWorkflowAdapter.java  |   9 +-
 .../camel/CamelAnyObjectProvisioningManager.java   |  10 +-
 .../camel/CamelGroupProvisioningManager.java       |  10 +-
 .../camel/CamelUserProvisioningManager.java        |  19 +-
 .../camel/producer/CreateProducer.java             |  26 +-
 .../camel/producer/SuspendProducer.java            |   6 +-
 .../src/main/resources/userRoutes.xml              |   2 +-
 .../core/flowable/impl/FlowableRuntimeUtils.java   |   4 +-
 .../flowable/impl/FlowableUserWorkflowAdapter.java |  20 +-
 .../core/flowable/impl/FlowableWorkflowUtils.java  |   2 -
 .../apache/syncope/core/flowable/task/Create.java  |   7 +-
 .../syncope/core/flowable/task/PasswordReset.java  |   2 +-
 .../syncope/core/logic/UserWorkflowTaskLogic.java  |   2 +-
 .../syncope/ext/oidcclient/agent/CodeConsumer.java |   3 +-
 .../syncope/core/logic/oidc/OIDCUserManager.java   |  23 +-
 .../core/provisioning/api/OIDCProviderActions.java |   4 +-
 .../java/DefaultOIDCProviderActions.java           |  48 --
 .../ext/saml2lsp/agent/AssertionConsumer.java      |   3 +-
 .../syncope/core/logic/saml2/SAML2UserManager.java |  23 +-
 .../core/provisioning/api/SAML2IdPActions.java     |   3 +-
 .../apache/syncope/core/logic/SCIMDataBinder.java  | 111 ++---
 .../syncope/core/logic/scim/SCIMConfManager.java   |   3 +-
 .../ext/scimv2/cxf/service/AbstractService.java    |   5 +-
 .../ext/scimv2/cxf/service/GroupServiceImpl.java   |  25 +-
 .../ext/scimv2/cxf/service/UserServiceImpl.java    |   2 +-
 .../reference/flowable/AssignDirectorGroup.java    |   5 +-
 .../reference/flowable/CreateARelationship.java    |   7 +-
 .../fit/core/reference/TestPullActions.java        |  36 +-
 .../org/apache/syncope/fit/AbstractITCase.java     |  32 +-
 .../apache/syncope/fit/core/AnyObjectITCase.java   |  60 ++-
 .../syncope/fit/core/AuthenticationITCase.java     |  68 +--
 .../org/apache/syncope/fit/core/BatchITCase.java   |  39 +-
 .../apache/syncope/fit/core/CamelRouteITCase.java  |  29 +-
 .../syncope/fit/core/ConfigurationITCase.java      |   4 +-
 .../apache/syncope/fit/core/DynRealmITCase.java    |  34 +-
 .../syncope/fit/core/ExceptionMapperITCase.java    |  28 +-
 .../org/apache/syncope/fit/core/GroupITCase.java   | 245 ++++++-----
 .../apache/syncope/fit/core/MembershipITCase.java  | 122 +++---
 .../syncope/fit/core/MultitenancyITCase.java       |  15 +-
 .../syncope/fit/core/NotificationTaskITCase.java   |   9 +-
 .../apache/syncope/fit/core/PlainSchemaITCase.java |  67 +--
 .../syncope/fit/core/PropagationTaskITCase.java    |  35 +-
 .../apache/syncope/fit/core/PullTaskITCase.java    | 154 +++----
 .../apache/syncope/fit/core/PushTaskITCase.java    |  13 +-
 .../org/apache/syncope/fit/core/RESTITCase.java    |   9 +-
 .../syncope/fit/core/ReconciliationITCase.java     |  13 +-
 .../apache/syncope/fit/core/ResourceITCase.java    |  20 +-
 .../org/apache/syncope/fit/core/SCIMITCase.java    |   2 +-
 .../org/apache/syncope/fit/core/SearchITCase.java  |  43 +-
 .../org/apache/syncope/fit/core/UserITCase.java    | 466 ++++++++++----------
 .../apache/syncope/fit/core/UserIssuesITCase.java  | 488 +++++++++++----------
 .../apache/syncope/fit/core/UserRequestITCase.java |   6 +-
 .../apache/syncope/fit/core/UserSelfITCase.java    |  86 ++--
 .../org/apache/syncope/fit/core/VirAttrITCase.java | 160 +++----
 .../test/resources/DoubleValueLogicActions.groovy  |   4 +-
 159 files changed, 2448 insertions(+), 2157 deletions(-)
 copy common/lib/src/main/java/org/apache/syncope/common/lib/request/{AnyUR.java => AnyCR.java} (72%)
 copy common/lib/src/main/java/org/apache/syncope/common/lib/{to/AnyObjectTO.java => request/AnyObjectCR.java} (59%)
 copy common/lib/src/main/java/org/apache/syncope/common/lib/request/{GroupUR.java => GroupCR.java} (74%)
 rename common/lib/src/main/java/org/apache/syncope/common/lib/request/{MembershipPatch.java => MembershipUR.java} (91%)
 rename common/lib/src/main/java/org/apache/syncope/common/lib/request/{RelationshipPatch.java => RelationshipUR.java} (85%)
 copy common/lib/src/main/java/org/apache/syncope/common/lib/request/{UserUR.java => UserCR.java} (56%)
 rename common/lib/src/main/java/org/apache/syncope/common/lib/{request/AttributableUR.java => to/AttributableReqEntity.java} (78%)
 delete mode 100644 ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java


[syncope] 02/02: [SYNCOPE-1410] More robust Builders

Posted by il...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git

commit 56d67c50509174eb114eb49e53b73aef60fefe8f
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Tue Dec 11 17:58:02 2018 +0100

    [SYNCOPE-1410] More robust Builders
---
 .../client/console/status/ChangePasswordModal.java |  2 +-
 .../syncope/client/console/wizards/any/Groups.java |  4 +-
 .../enduser/resources/UserSelfCreateResource.java  | 18 +++--
 .../enduser/resources/UserSelfUpdateResource.java  | 16 ++---
 .../client/enduser/util/ValidationTest.java        |  4 +-
 .../apache/syncope/common/lib/AnyOperations.java   | 80 +++++++++-------------
 .../apache/syncope/common/lib/request/AnyCR.java   | 12 ++--
 .../syncope/common/lib/request/AnyObjectCR.java    |  7 +-
 .../syncope/common/lib/request/AnyObjectUR.java    |  4 ++
 .../apache/syncope/common/lib/request/AnyUR.java   | 12 ++--
 .../syncope/common/lib/request/AttrPatch.java      | 11 ++-
 .../apache/syncope/common/lib/request/GroupCR.java | 10 +--
 .../apache/syncope/common/lib/request/GroupUR.java |  4 ++
 .../syncope/common/lib/request/MembershipUR.java   | 10 +--
 .../syncope/common/lib/request/RelationshipUR.java | 10 +--
 .../apache/syncope/common/lib/request/UserCR.java  | 10 +--
 .../apache/syncope/common/lib/request/UserUR.java  |  4 ++
 .../org/apache/syncope/common/lib/to/AttrTO.java   |  3 +-
 .../apache/syncope/common/lib/to/MembershipTO.java | 38 ++++++++--
 .../syncope/common/lib/AnyOperationsTest.java      |  8 +--
 .../org/apache/syncope/common/lib/JAXBTest.java    |  2 +-
 .../org/apache/syncope/common/lib/JSONTest.java    |  5 +-
 .../syncope/core/logic/ReconciliationLogic.java    |  8 +--
 .../java/DefaultGroupProvisioningManager.java      |  2 +-
 .../core/provisioning/java/MappingManagerImpl.java |  6 +-
 .../java/data/AbstractAnyDataBinder.java           | 20 +++---
 .../java/data/AnyObjectDataBinderImpl.java         | 10 ++-
 .../java/data/ConfigurationDataBinderImpl.java     |  3 +-
 .../provisioning/java/data/UserDataBinderImpl.java | 10 ++-
 .../provisioning/java/job/SetUMembershipsJob.java  | 16 ++---
 .../core/provisioning/java/MailTemplateTest.java   |  8 +--
 .../core/rest/cxf/service/AbstractAnyService.java  |  4 +-
 .../rest/cxf/service/AnyObjectServiceImpl.java     |  2 +-
 .../core/rest/cxf/service/GroupServiceImpl.java    |  2 +-
 .../core/rest/cxf/service/UserServiceImpl.java     |  2 +-
 .../camel/producer/SuspendProducer.java            |  6 +-
 .../syncope/core/flowable/task/PasswordReset.java  |  2 +-
 .../syncope/core/logic/UserWorkflowTaskLogic.java  |  2 +-
 .../syncope/ext/oidcclient/agent/CodeConsumer.java |  3 +-
 .../syncope/core/logic/oidc/OIDCUserManager.java   |  2 +-
 .../ext/saml2lsp/agent/AssertionConsumer.java      |  3 +-
 .../syncope/core/logic/saml2/SAML2UserManager.java |  2 +-
 .../apache/syncope/core/logic/SCIMDataBinder.java  | 22 +++---
 .../syncope/core/logic/scim/SCIMConfManager.java   |  3 +-
 .../ext/scimv2/cxf/service/GroupServiceImpl.java   | 21 +++---
 .../reference/flowable/AssignDirectorGroup.java    |  3 +-
 .../reference/flowable/CreateARelationship.java    |  5 +-
 .../fit/core/reference/TestPullActions.java        |  3 +-
 .../org/apache/syncope/fit/AbstractITCase.java     |  7 +-
 .../apache/syncope/fit/core/AnyObjectITCase.java   |  7 +-
 .../syncope/fit/core/AuthenticationITCase.java     |  3 +-
 .../syncope/fit/core/ConfigurationITCase.java      |  4 +-
 .../apache/syncope/fit/core/DynRealmITCase.java    |  2 +-
 .../org/apache/syncope/fit/core/GroupITCase.java   | 46 ++++++-------
 .../apache/syncope/fit/core/MembershipITCase.java  | 34 ++++-----
 .../apache/syncope/fit/core/PlainSchemaITCase.java | 36 +++++-----
 .../syncope/fit/core/PropagationTaskITCase.java    |  9 ++-
 .../apache/syncope/fit/core/PullTaskITCase.java    | 16 ++---
 .../org/apache/syncope/fit/core/SearchITCase.java  | 20 +++---
 .../org/apache/syncope/fit/core/UserITCase.java    | 77 +++++++++------------
 .../apache/syncope/fit/core/UserIssuesITCase.java  | 53 +++++++-------
 .../apache/syncope/fit/core/UserSelfITCase.java    | 16 ++---
 .../org/apache/syncope/fit/core/VirAttrITCase.java |  7 +-
 63 files changed, 366 insertions(+), 415 deletions(-)

diff --git a/client/console/src/main/java/org/apache/syncope/client/console/status/ChangePasswordModal.java b/client/console/src/main/java/org/apache/syncope/client/console/status/ChangePasswordModal.java
index 247f8c4..254fb89 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/status/ChangePasswordModal.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/status/ChangePasswordModal.java
@@ -86,7 +86,7 @@ public class ChangePasswordModal extends AbstractModalPanel<AnyWrapper<UserTO>>
                     }
                 }
 
-                UserUR req = new UserUR.Builder().key(inner.getKey()).
+                UserUR req = new UserUR.Builder(inner.getKey()).
                         password(new PasswordPatch.Builder().
                                 value(inner.getPassword()).onSyncope(isOnSyncope).resources(resources).build()).
                         build();
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
index 67d7d12..8333782 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
@@ -159,9 +159,7 @@ public class Groups extends WizardStep implements ICondition {
                                     new SortParam<>("name", true),
                                     null)).stream().map(input -> {
 
-                                return new MembershipTO.Builder().
-                                        group(input.getKey(), input.getName()).
-                                        build();
+                                return new MembershipTO.Builder(input.getKey()).groupName(input.getName()).build();
                             }).collect(Collectors.toList());
                 }
             }).hideLabel().setOutputMarkupId(true));
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
index 41be448..5fdb0b6 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
@@ -90,14 +90,14 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     userTO.getPlainAttrs().stream().
                             filter(attr -> (attr.getSchema().
                             contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                            forEachOrdered(attr -> {
+                            forEach(attr -> {
                                 String[] simpleAttrs = attr.getSchema().split(
                                         SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                                 MembershipTO membership = userTO.getMemberships().stream().
                                         filter(memb -> simpleAttrs[0].equals(memb.getGroupName())).
                                         findFirst().orElse(null);
                                 if (membership == null) {
-                                    membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                    membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                     userTO.getMemberships().add(membership);
                                 }
 
@@ -112,7 +112,7 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     SyncopeEnduserSession.get().getDatePlainSchemas().stream().map(plainSchema -> {
                         millisToDate(userTO.getPlainAttrs(), plainSchema);
                         return plainSchema;
-                    }).forEachOrdered(plainSchema -> {
+                    }).forEach(plainSchema -> {
                         userTO.getMemberships().forEach(membership -> {
                             millisToDate(membership.getPlainAttrs(), plainSchema);
                         });
@@ -122,14 +122,14 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     userTO.getDerAttrs().stream().
                             filter(attr -> (attr.getSchema().
                             contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                            forEachOrdered(attr -> {
+                            forEach(attr -> {
                                 String[] simpleAttrs = attr.getSchema().split(
                                         SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                                 MembershipTO membership = userTO.getMemberships().stream().
                                         filter(memb -> simpleAttrs[0].equals(memb.getGroupName())).
                                         findFirst().orElse(null);
                                 if (membership == null) {
-                                    membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                    membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                     userTO.getMemberships().add(membership);
                                 }
 
@@ -144,14 +144,14 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     userTO.getVirAttrs().stream().
                             filter(attr -> (attr.getSchema().
                             contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                            forEachOrdered(attr -> {
+                            forEach(attr -> {
                                 String[] simpleAttrs = attr.getSchema().split(
                                         SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                                 MembershipTO membership = userTO.getMemberships().stream().
                                         filter(memb -> simpleAttrs[0].equals(memb.getGroupName())).
                                         findFirst().orElse(null);
                                 if (membership == null) {
-                                    membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                    membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                     userTO.getMemberships().add(membership);
                                 }
 
@@ -166,9 +166,7 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     LOG.trace("Received user self registration request is: [{}]", userTO);
 
                     // adapt request and create user
-                    UserCR req = new UserCR.Builder().
-                            realm(userTO.getRealm()).
-                            username(userTO.getUsername()).
+                    UserCR req = new UserCR.Builder(userTO.getRealm(), userTO.getUsername()).
                             password(userTO.getPassword()).
                             mustChangePassword(userTO.isMustChangePassword()).
                             securityQuestion(userTO.getSecurityQuestion()).
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfUpdateResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfUpdateResource.java
index 98bb010..1adbdf5 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfUpdateResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfUpdateResource.java
@@ -75,14 +75,14 @@ public class UserSelfUpdateResource extends BaseUserSelfResource {
                 Set<AttrTO> membAttrs = new HashSet<>();
                 userTO.getPlainAttrs().stream().
                         filter(attr -> (attr.getSchema().contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                        forEachOrdered((attr) -> {
+                        forEach(attr -> {
                             String[] simpleAttrs = attr.getSchema().split(
                                     SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                             MembershipTO membership = userTO.getMemberships().stream().
                                     filter(item -> simpleAttrs[0].equals(item.getGroupName())).
                                     findFirst().orElse(null);
                             if (membership == null) {
-                                membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                 userTO.getMemberships().add(membership);
                             }
                             AttrTO clone = SerializationUtils.clone(attr);
@@ -97,7 +97,7 @@ public class UserSelfUpdateResource extends BaseUserSelfResource {
                         map(plainSchema -> {
                             millisToDate(userTO.getPlainAttrs(), plainSchema);
                             return plainSchema;
-                        }).forEachOrdered(plainSchema -> {
+                        }).forEach(plainSchema -> {
                     userTO.getMemberships().forEach(membership -> {
                         millisToDate(membership.getPlainAttrs(), plainSchema);
                     });
@@ -106,14 +106,14 @@ public class UserSelfUpdateResource extends BaseUserSelfResource {
                 membAttrs.clear();
                 userTO.getDerAttrs().stream().
                         filter(attr -> (attr.getSchema().contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                        forEachOrdered(attr -> {
+                        forEach(attr -> {
                             String[] simpleAttrs = attr.getSchema().split(
                                     SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                             MembershipTO membership = userTO.getMemberships().stream().
                                     filter(item -> simpleAttrs[0].equals(item.getGroupName())).
                                     findFirst().orElse(null);
                             if (membership == null) {
-                                membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                 userTO.getMemberships().add(membership);
                             }
                             AttrTO clone = SerializationUtils.clone(attr);
@@ -126,14 +126,14 @@ public class UserSelfUpdateResource extends BaseUserSelfResource {
                 membAttrs.clear();
                 userTO.getVirAttrs().stream().
                         filter(attr -> (attr.getSchema().contains(SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR))).
-                        forEachOrdered((attr) -> {
+                        forEach((attr) -> {
                             String[] simpleAttrs = attr.getSchema().split(
                                     SyncopeEnduserConstants.MEMBERSHIP_ATTR_SEPARATOR);
                             MembershipTO membership = userTO.getMemberships().stream().
                                     filter(item -> simpleAttrs[0].equals(item.getGroupName())).
                                     findFirst().orElse(null);
                             if (membership == null) {
-                                membership = new MembershipTO.Builder().group(null, simpleAttrs[0]).build();
+                                membership = new MembershipTO.Builder(null).groupName(simpleAttrs[0]).build();
                                 userTO.getMemberships().add(membership);
 
                             }
@@ -212,7 +212,7 @@ public class UserSelfUpdateResource extends BaseUserSelfResource {
                 EntityTOUtils.buildAttrMap(userTOAttrs);
         selfTOAttrs.stream().
                 filter(selfTOAttr -> (!userTOAttrsMap.containsKey(selfTOAttr.getSchema()))).
-                forEachOrdered(selfTOAttr -> {
+                forEach(selfTOAttr -> {
                     userTOAttrs.add(selfTOAttr);
                 });
     }
diff --git a/client/enduser/src/test/java/org/apache/syncope/client/enduser/util/ValidationTest.java b/client/enduser/src/test/java/org/apache/syncope/client/enduser/util/ValidationTest.java
index 1fdd91e..7790af7 100644
--- a/client/enduser/src/test/java/org/apache/syncope/client/enduser/util/ValidationTest.java
+++ b/client/enduser/src/test/java/org/apache/syncope/client/enduser/util/ValidationTest.java
@@ -36,8 +36,8 @@ import org.springframework.core.io.ClassPathResource;
 
 public class ValidationTest {
 
-    private AttrTO attrTO(String schemaKey, String... values) {
-        return new AttrTO.Builder().schema(schemaKey).values(values).build();
+    private AttrTO attrTO(final String schemaKey, final String... values) {
+        return new AttrTO.Builder(schemaKey).values(values).build();
     }
 
     @Test
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
index 0f9cb00..fc9e834 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
@@ -114,9 +114,8 @@ public final class AnyOperations {
         if (!incremental) {
             originalAttrs.keySet().stream().filter(attr -> !updatedAttrs.containsKey(attr)).
                     forEach(schema -> {
-                        result.getPlainAttrs().add(new AttrPatch.Builder().
+                        result.getPlainAttrs().add(new AttrPatch.Builder(new AttrTO.Builder(schema).build()).
                                 operation(PatchOperation.DELETE).
-                                attrTO(new AttrTO.Builder().schema(schema).build()).
                                 build());
                     });
         }
@@ -124,16 +123,14 @@ public final class AnyOperations {
         updatedAttrs.values().forEach(attrTO -> {
             if (isEmpty(attrTO)) {
                 if (!incremental) {
-                    result.getPlainAttrs().add(new AttrPatch.Builder().
+                    result.getPlainAttrs().add(new AttrPatch.Builder(new AttrTO.Builder(attrTO.getSchema()).build()).
                             operation(PatchOperation.DELETE).
-                            attrTO(new AttrTO.Builder().schema(attrTO.getSchema()).build()).
                             build());
                 }
             } else if (!originalAttrs.containsKey(attrTO.getSchema())
                     || !originalAttrs.get(attrTO.getSchema()).getValues().equals(attrTO.getValues())) {
 
-                AttrPatch patch = new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).attrTO(attrTO).
-                        build();
+                AttrPatch patch = new AttrPatch.Builder(attrTO).operation(PatchOperation.ADD_REPLACE).build();
                 if (!patch.isEmpty()) {
                     result.getPlainAttrs().add(patch);
                 }
@@ -188,18 +185,16 @@ public final class AnyOperations {
 
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
-                forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipUR.Builder().
-                            operation(PatchOperation.ADD_REPLACE).
-                            relationshipTO(entry.getValue()).build());
+                forEach(entry -> {
+                    result.getRelationships().add(new RelationshipUR.Builder(entry.getValue()).
+                            operation(PatchOperation.ADD_REPLACE).build());
                 });
 
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipUR.Builder().
-                                operation(PatchOperation.DELETE).
-                                relationshipTO(originalRels.get(key)).build());
+                        result.getRelationships().add(new RelationshipUR.Builder(originalRels.get(key)).
+                                operation(PatchOperation.DELETE).build());
                     });
         }
 
@@ -208,8 +203,8 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipUR membershipPatch = new MembershipUR.Builder().
-                    operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
+            MembershipUR membershipPatch = new MembershipUR.Builder(value.getGroupKey()).
+                    operation(PatchOperation.ADD_REPLACE).build();
 
             diff(value, membershipPatch);
 
@@ -223,8 +218,8 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipUR.Builder().
-                                operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
+                        result.getMemberships().add(new MembershipUR.Builder(originalMembs.get(key).getGroupKey()).
+                                operation(PatchOperation.DELETE).build());
                     });
         }
 
@@ -310,18 +305,16 @@ public final class AnyOperations {
 
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
-                forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipUR.Builder().
-                            operation(PatchOperation.ADD_REPLACE).
-                            relationshipTO(entry.getValue()).build());
+                forEach(entry -> {
+                    result.getRelationships().add(new RelationshipUR.Builder(entry.getValue()).
+                            operation(PatchOperation.ADD_REPLACE).build());
                 });
 
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipUR.Builder().
-                                operation(PatchOperation.DELETE).
-                                relationshipTO(originalRels.get(key)).build());
+                        result.getRelationships().add(new RelationshipUR.Builder(originalRels.get(key)).
+                                operation(PatchOperation.DELETE).build());
                     });
         }
 
@@ -330,8 +323,8 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipUR membershipPatch = new MembershipUR.Builder().
-                    operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
+            MembershipUR membershipPatch = new MembershipUR.Builder(value.getGroupKey()).
+                    operation(PatchOperation.ADD_REPLACE).build();
 
             diff(value, membershipPatch);
 
@@ -345,8 +338,8 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipUR.Builder().
-                                operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
+                        result.getMemberships().add(new MembershipUR.Builder(originalMembs.get(key).getGroupKey()).
+                                operation(PatchOperation.DELETE).build());
                     });
         }
 
@@ -531,14 +524,12 @@ public final class AnyOperations {
                                 findFirst().ifPresent(memb -> result.getMemberships().remove(memb));
 
                         if (membPatch.getOperation() == PatchOperation.ADD_REPLACE) {
-                            MembershipTO newMembershipTO =
-                                    new MembershipTO.Builder().group(membPatch.getGroup()).build();
-
-                            // 3. plain attributes
-                            newMembershipTO.getPlainAttrs().addAll(membPatch.getPlainAttrs());
-
-                            // 4. virtual attributes
-                            newMembershipTO.getVirAttrs().addAll(membPatch.getVirAttrs());
+                            MembershipTO newMembershipTO = new MembershipTO.Builder(membPatch.getGroup()).
+                                    // 3. plain attributes
+                                    plainAttrs(membPatch.getPlainAttrs()).
+                                    // 4. virtual attributes
+                                    virAttrs(membPatch.getVirAttrs()).
+                                    build();
 
                             result.getMemberships().add(newMembershipTO);
                         }
@@ -586,14 +577,12 @@ public final class AnyOperations {
                                 findFirst().ifPresent(memb -> result.getMemberships().remove(memb));
 
                         if (membPatch.getOperation() == PatchOperation.ADD_REPLACE) {
-                            MembershipTO newMembershipTO =
-                                    new MembershipTO.Builder().group(membPatch.getGroup()).build();
-
-                            // 3. plain attributes
-                            newMembershipTO.getPlainAttrs().addAll(membPatch.getPlainAttrs());
-
-                            // 4. virtual attributes
-                            newMembershipTO.getVirAttrs().addAll(membPatch.getVirAttrs());
+                            MembershipTO newMembershipTO = new MembershipTO.Builder(membPatch.getGroup()).
+                                    // 3. plain attributes
+                                    plainAttrs(membPatch.getPlainAttrs()).
+                                    // 4. virtual attributes
+                                    virAttrs(membPatch.getVirAttrs()).
+                                    build();
 
                             result.getMemberships().add(newMembershipTO);
                         }
@@ -625,9 +614,8 @@ public final class AnyOperations {
     public static void cleanEmptyAttrs(final AnyTO anyTO, final AnyUR anyUR) {
         anyUR.getPlainAttrs().addAll(anyTO.getPlainAttrs().stream().
                 filter(plainAttrTO -> isEmpty(plainAttrTO)).
-                map(plainAttrTO -> new AttrPatch.Builder().
+                map(plainAttrTO -> new AttrPatch.Builder(new AttrTO.Builder(plainAttrTO.getSchema()).build()).
                 operation(PatchOperation.DELETE).
-                attrTO(new AttrTO.Builder().schema(plainAttrTO.getSchema()).build()).
                 build()).collect(Collectors.toSet()));
     }
 
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
index 49efeb1..9141e2a 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
@@ -53,9 +53,13 @@ public abstract class AnyCR implements Serializable, AttributableReqEntity {
 
         protected R instance;
 
+        Builder(final String realm) {
+            getInstance().setRealm(realm);
+        }
+
         protected abstract R newInstance();
 
-        protected R getInstance() {
+        protected final R getInstance() {
             if (instance == null) {
                 instance = newInstance();
             }
@@ -63,12 +67,6 @@ public abstract class AnyCR implements Serializable, AttributableReqEntity {
         }
 
         @SuppressWarnings("unchecked")
-        public B realm(final String realm) {
-            getInstance().setRealm(realm);
-            return (B) this;
-        }
-
-        @SuppressWarnings("unchecked")
         public B auxClass(final String auxClass) {
             getInstance().getAuxClasses().add(auxClass);
             return (B) this;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
index a833034..ad8363e 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
@@ -53,13 +53,10 @@ public class AnyObjectCR extends AnyCR implements GroupableRelatableTO {
             return new AnyObjectCR();
         }
 
-        public Builder(final String type) {
+        public Builder(final String realm, final String type, final String name) {
+            super(realm);
             getInstance().setType(type);
-        }
-
-        public Builder name(final String name) {
             getInstance().setName(name);
-            return this;
         }
 
         public Builder relationship(final RelationshipTO relationship) {
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
index 1f7cdbf..577a870 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
@@ -40,6 +40,10 @@ public class AnyObjectUR extends AnyUR {
 
     public static class Builder extends AnyUR.Builder<AnyObjectUR, Builder> {
 
+        public Builder(final String key) {
+            super(key);
+        }
+
         @Override
         protected AnyObjectUR newInstance() {
             return new AnyObjectUR();
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
index 52a6b3f..fd42151 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
@@ -51,9 +51,13 @@ public abstract class AnyUR implements Serializable {
 
         protected R instance;
 
+        Builder(final String key) {
+            getInstance().setKey(key);
+        }
+
         protected abstract R newInstance();
 
-        protected R getInstance() {
+        protected final R getInstance() {
             if (instance == null) {
                 instance = newInstance();
             }
@@ -61,12 +65,6 @@ public abstract class AnyUR implements Serializable {
         }
 
         @SuppressWarnings("unchecked")
-        public B key(final String key) {
-            getInstance().setKey(key);
-            return (B) this;
-        }
-
-        @SuppressWarnings("unchecked")
         public B realm(final StringReplacePatchItem realm) {
             getInstance().setRealm(realm);
             return (B) this;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttrPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttrPatch.java
index 033ad87..bc874ce 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttrPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttrPatch.java
@@ -33,16 +33,15 @@ public class AttrPatch extends AbstractPatch {
 
     public static class Builder extends AbstractPatch.Builder<AttrPatch, Builder> {
 
+        public Builder(final AttrTO attrTO) {
+            super();
+            getInstance().setAttrTO(attrTO);
+        }
+
         @Override
         protected AttrPatch newInstance() {
             return new AttrPatch();
         }
-
-        public Builder attrTO(final AttrTO attrTO) {
-            getInstance().setAttrTO(attrTO);
-            return this;
-        }
-
     }
 
     private AttrTO attrTO;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
index 8830e1c..911d5e5 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
@@ -47,16 +47,16 @@ public class GroupCR extends AnyCR {
 
     public static class Builder extends AnyCR.Builder<GroupCR, Builder> {
 
+        public Builder(final String realm, final String name) {
+            super(realm);
+            getInstance().setName(name);
+        }
+
         @Override
         protected GroupCR newInstance() {
             return new GroupCR();
         }
 
-        public Builder name(final String name) {
-            getInstance().setName(name);
-            return this;
-        }
-
         public Builder userOwner(final String userOwner) {
             getInstance().setUserOwner(userOwner);
             return this;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupUR.java
index a3b3b65..c24318c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupUR.java
@@ -47,6 +47,10 @@ public class GroupUR extends AnyUR {
 
     public static class Builder extends AnyUR.Builder<GroupUR, Builder> {
 
+        public Builder(final String key) {
+            super(key);
+        }
+
         @Override
         protected GroupUR newInstance() {
             return new GroupUR();
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
index dde21be..bfb0503 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
@@ -39,16 +39,16 @@ public class MembershipUR extends AbstractPatch {
 
     public static class Builder extends AbstractPatch.Builder<MembershipUR, Builder> {
 
+        public Builder(final String group) {
+            super();
+            getInstance().setGroup(group);
+        }
+
         @Override
         protected MembershipUR newInstance() {
             return new MembershipUR();
         }
 
-        public Builder group(final String group) {
-            getInstance().setGroup(group);
-            return this;
-        }
-
         public Builder plainAttr(final AttrTO plainAttr) {
             getInstance().getPlainAttrs().add(plainAttr);
             return this;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
index d193fe8..4e14d3b 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
@@ -32,15 +32,15 @@ public class RelationshipUR extends AbstractPatch {
 
     public static class Builder extends AbstractPatch.Builder<RelationshipUR, Builder> {
 
+        public Builder(final RelationshipTO relationshipTO) {
+            super();
+            getInstance().setRelationshipTO(relationshipTO);
+        }
+
         @Override
         protected RelationshipUR newInstance() {
             return new RelationshipUR();
         }
-
-        public Builder relationshipTO(final RelationshipTO relationshipTO) {
-            getInstance().setRelationshipTO(relationshipTO);
-            return this;
-        }
     }
 
     private RelationshipTO relationshipTO;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
index 38929fa..0e76d67 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
@@ -50,16 +50,16 @@ public class UserCR extends AnyCR implements GroupableRelatableTO {
 
     public static class Builder extends AnyCR.Builder<UserCR, Builder> {
 
+        public Builder(final String realm, final String username) {
+            super(realm);
+            getInstance().setUsername(username);
+        }
+
         @Override
         protected UserCR newInstance() {
             return new UserCR();
         }
 
-        public Builder username(final String username) {
-            getInstance().setUsername(username);
-            return this;
-        }
-
         public Builder password(final String password) {
             getInstance().setPassword(password);
             return this;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
index bc5f854..5a42f8c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
@@ -40,6 +40,10 @@ public class UserUR extends AnyUR {
 
     public static class Builder extends AnyUR.Builder<UserUR, Builder> {
 
+        public Builder(final String key) {
+            super(key);
+        }
+
         @Override
         protected UserUR newInstance() {
             return new UserUR();
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttrTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttrTO.java
index 570d91f..5348e7e 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttrTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttrTO.java
@@ -42,9 +42,8 @@ public class AttrTO implements Serializable {
 
         private final AttrTO instance = new AttrTO();
 
-        public Builder schema(final String schema) {
+        public Builder(final String schema) {
             instance.setSchema(schema);
-            return this;
         }
 
         public Builder value(final String value) {
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/MembershipTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/MembershipTO.java
index 7696c08..1946964 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/MembershipTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/MembershipTO.java
@@ -21,6 +21,8 @@ package org.apache.syncope.common.lib.to;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import java.io.Serializable;
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
@@ -41,17 +43,45 @@ public class MembershipTO implements Serializable, AttributableTO {
 
         private final MembershipTO instance = new MembershipTO();
 
-        public Builder group(final String groupKey) {
+        public Builder(final String groupKey) {
             instance.setGroupKey(groupKey);
-            return this;
         }
 
-        public Builder group(final String groupKey, final String groupName) {
-            instance.setGroupKey(groupKey);
+        public Builder groupName(final String groupName) {
             instance.setGroupName(groupName);
             return this;
         }
 
+        public Builder plainAttr(final AttrTO plainAttr) {
+            instance.getPlainAttrs().add(plainAttr);
+            return this;
+        }
+
+        public Builder plainAttrs(final AttrTO... plainAttrs) {
+            instance.getPlainAttrs().addAll(Arrays.asList(plainAttrs));
+            return this;
+        }
+
+        public Builder plainAttrs(final Collection<AttrTO> plainAttrs) {
+            instance.getPlainAttrs().addAll(plainAttrs);
+            return this;
+        }
+
+        public Builder virAttr(final AttrTO virAttr) {
+            instance.getVirAttrs().add(virAttr);
+            return this;
+        }
+
+        public Builder virAttrs(final Collection<AttrTO> virAttrs) {
+            instance.getVirAttrs().addAll(virAttrs);
+            return this;
+        }
+
+        public Builder virAttrs(final AttrTO... virAttrs) {
+            instance.getVirAttrs().addAll(Arrays.asList(virAttrs));
+            return this;
+        }
+
         public MembershipTO build() {
             return instance;
         }
diff --git a/common/lib/src/test/java/org/apache/syncope/common/lib/AnyOperationsTest.java b/common/lib/src/test/java/org/apache/syncope/common/lib/AnyOperationsTest.java
index 41393d4..c69d179 100644
--- a/common/lib/src/test/java/org/apache/syncope/common/lib/AnyOperationsTest.java
+++ b/common/lib/src/test/java/org/apache/syncope/common/lib/AnyOperationsTest.java
@@ -33,13 +33,13 @@ public class AnyOperationsTest {
     public void mindiff() {
         AnyObjectTO oldOne = new AnyObjectTO();
         oldOne.setName("name");
-        oldOne.getPlainAttrs().add(new AttrTO.Builder().schema("plain").value("oldValue").build());
-        oldOne.getPlainAttrs().add(new AttrTO.Builder().schema("encrypted").value("oldValue").build());
+        oldOne.getPlainAttrs().add(new AttrTO.Builder("plain").value("oldValue").build());
+        oldOne.getPlainAttrs().add(new AttrTO.Builder("encrypted").value("oldValue").build());
 
         AnyObjectTO newOne = new AnyObjectTO();
         newOne.setName("name");
-        newOne.getPlainAttrs().add(new AttrTO.Builder().schema("plain").value("newValue").build());
-        newOne.getPlainAttrs().add(new AttrTO.Builder().schema("encrypted").value("oldValue").build());
+        newOne.getPlainAttrs().add(new AttrTO.Builder("plain").value("newValue").build());
+        newOne.getPlainAttrs().add(new AttrTO.Builder("encrypted").value("oldValue").build());
 
         AnyObjectUR diff = AnyOperations.diff(newOne, oldOne, true);
         assertEquals(1, diff.getPlainAttrs().size());
diff --git a/common/lib/src/test/java/org/apache/syncope/common/lib/JAXBTest.java b/common/lib/src/test/java/org/apache/syncope/common/lib/JAXBTest.java
index a63d558..4e6109c 100644
--- a/common/lib/src/test/java/org/apache/syncope/common/lib/JAXBTest.java
+++ b/common/lib/src/test/java/org/apache/syncope/common/lib/JAXBTest.java
@@ -63,7 +63,7 @@ public class JAXBTest {
         GroupTO group = new GroupTO();
         group.setName(UUID.randomUUID().toString());
         group.setRealm(SyncopeConstants.ROOT_REALM);
-        group.getVirAttrs().add(new AttrTO.Builder().schema("rvirtualdata").value("rvirtualvalue").build());
+        group.getVirAttrs().add(new AttrTO.Builder("rvirtualdata").value("rvirtualvalue").build());
         group.getADynMembershipConds().put("USER", "username==a*");
 
         ProvisioningResult<GroupTO> original = new ProvisioningResult<>();
diff --git a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
index 780fc30..fb9ac17 100644
--- a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
+++ b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
@@ -84,7 +84,7 @@ public class JSONTest {
         GroupTO group = new GroupTO();
         group.setName(UUID.randomUUID().toString());
         group.setRealm(SyncopeConstants.ROOT_REALM);
-        group.getVirAttrs().add(new AttrTO.Builder().schema("rvirtualdata").value("rvirtualvalue").build());
+        group.getVirAttrs().add(new AttrTO.Builder("rvirtualdata").value("rvirtualvalue").build());
         group.getADynMembershipConds().put("USER", "username==a*");
 
         ProvisioningResult<GroupTO> original = new ProvisioningResult<>();
@@ -100,7 +100,8 @@ public class JSONTest {
         StringWriter writer = new StringWriter();
         mapper.writeValue(writer, original);
 
-        ProvisioningResult<GroupTO> actual = mapper.readValue(writer.toString(), new TypeReference<ProvisioningResult<GroupTO>>() {
+        ProvisioningResult<GroupTO> actual = mapper.readValue(writer.toString(),
+                new TypeReference<ProvisioningResult<GroupTO>>() {
         });
         assertEquals(original, actual);
     }
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java
index 36c594b..ab36bdc 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java
@@ -117,10 +117,10 @@ public class ReconciliationLogic extends AbstractTransactionalLogic<EntityTO> {
 
         ConnObjectTO connObjectTO = ConnObjectUtils.getConnObjectTO(attrs.getRight());
         if (attrs.getLeft() != null) {
-            connObjectTO.getAttrs().add(new AttrTO.Builder().
-                    schema(connObjectKey.getExtAttrName()).value(attrs.getLeft()).build());
-            connObjectTO.getAttrs().add(new AttrTO.Builder().
-                    schema(Uid.NAME).value(attrs.getLeft()).build());
+            connObjectTO.getAttrs().add(new AttrTO.Builder(connObjectKey.getExtAttrName()).
+                    value(attrs.getLeft()).build());
+            connObjectTO.getAttrs().add(new AttrTO.Builder(Uid.NAME).
+                    value(attrs.getLeft()).build());
         }
 
         return connObjectTO;
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
index 6b14f25..febaffe 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
@@ -94,7 +94,7 @@ public class DefaultGroupProvisioningManager implements GroupProvisioningManager
         WorkflowResult<String> created = gwfAdapter.create(groupCR);
 
         // see ConnObjectUtils#getAnyTOFromConnObject for GroupOwnerSchema
-        groupCR.getPlainAttrs().stream().filter(attr -> StringUtils.EMPTY.equals(attr.getSchema())).findFirst().
+        groupCR.getPlainAttr(StringUtils.EMPTY).
                 ifPresent(groupOwner -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().get(0)));
 
         List<PropagationTaskInfo> tasks = propagationManager.getCreateTasks(
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/MappingManagerImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/MappingManagerImpl.java
index 33077fe..b246830 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/MappingManagerImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/MappingManagerImpl.java
@@ -802,7 +802,7 @@ public class MappingManagerImpl implements MappingManager {
                         anyTO.getPlainAttrs().add(attrTO);
                     } else {
                         MembershipTO membership = groupableTO.getMembership(group.getKey()).orElseGet(() -> {
-                            MembershipTO newMemb = new MembershipTO.Builder().group(group.getKey()).build();
+                            MembershipTO newMemb = new MembershipTO.Builder(group.getKey()).build();
                             groupableTO.getMemberships().add(newMemb);
                             return newMemb;
                         });
@@ -818,7 +818,7 @@ public class MappingManagerImpl implements MappingManager {
                         anyTO.getDerAttrs().add(attrTO);
                     } else {
                         MembershipTO membership = groupableTO.getMembership(group.getKey()).orElseGet(() -> {
-                            MembershipTO newMemb = new MembershipTO.Builder().group(group.getKey()).build();
+                            MembershipTO newMemb = new MembershipTO.Builder(group.getKey()).build();
                             groupableTO.getMemberships().add(newMemb);
                             return newMemb;
                         });
@@ -841,7 +841,7 @@ public class MappingManagerImpl implements MappingManager {
                         anyTO.getVirAttrs().add(attrTO);
                     } else {
                         MembershipTO membership = groupableTO.getMembership(group.getKey()).orElseGet(() -> {
-                            MembershipTO newMemb = new MembershipTO.Builder().group(group.getKey()).build();
+                            MembershipTO newMemb = new MembershipTO.Builder(group.getKey()).build();
                             groupableTO.getMemberships().add(newMemb);
                             return newMemb;
                         });
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
index c33e9db..5612a49 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
@@ -553,17 +553,16 @@ abstract class AbstractAnyDataBinder {
         anyTO.getAuxClasses().addAll(auxClasses.stream().map(Entity::getKey).collect(Collectors.toList()));
 
         plainAttrs.forEach(plainAttr -> {
-            anyTO.getPlainAttrs().add(new AttrTO.Builder().
-                    schema(plainAttr.getSchema().getKey()).
+            anyTO.getPlainAttrs().add(new AttrTO.Builder(plainAttr.getSchema().getKey()).
                     values(plainAttr.getValuesAsStrings()).build());
         });
 
         derAttrs.forEach((schema, value) -> {
-            anyTO.getDerAttrs().add(new AttrTO.Builder().schema(schema.getKey()).value(value).build());
+            anyTO.getDerAttrs().add(new AttrTO.Builder(schema.getKey()).value(value).build());
         });
 
         virAttrs.forEach((schema, values) -> {
-            anyTO.getVirAttrs().add(new AttrTO.Builder().schema(schema.getKey()).values(values).build());
+            anyTO.getVirAttrs().add(new AttrTO.Builder(schema.getKey()).values(values).build());
         });
 
         anyTO.getResources().addAll(resources.stream().map(Entity::getKey).collect(Collectors.toSet()));
@@ -581,27 +580,24 @@ abstract class AbstractAnyDataBinder {
             final Map<VirSchema, List<String>> virAttrs,
             final Membership<? extends Any<?>> membership) {
 
-        MembershipTO membershipTO = new MembershipTO.Builder().
-                group(membership.getRightEnd().getKey(), membership.getRightEnd().getName()).
+        MembershipTO membershipTO = new MembershipTO.Builder(membership.getRightEnd().getKey()).
+                groupName(membership.getRightEnd().getName()).
                 build();
 
         plainAttrs.forEach(plainAttr -> {
-            membershipTO.getPlainAttrs().add(new AttrTO.Builder().
-                    schema(plainAttr.getSchema().getKey()).
+            membershipTO.getPlainAttrs().add(new AttrTO.Builder(plainAttr.getSchema().getKey()).
                     values(plainAttr.getValuesAsStrings()).
                     build());
         });
 
         derAttrs.forEach((schema, value) -> {
-            membershipTO.getDerAttrs().add(new AttrTO.Builder().
-                    schema(schema.getKey()).
+            membershipTO.getDerAttrs().add(new AttrTO.Builder(schema.getKey()).
                     value(value).
                     build());
         });
 
         virAttrs.forEach((schema, values) -> {
-            membershipTO.getVirAttrs().add(new AttrTO.Builder().
-                    schema(schema.getKey()).
+            membershipTO.getVirAttrs().add(new AttrTO.Builder(schema.getKey()).
                     values(values).
                     build());
         });
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
index 02325d6..9c5634f 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
@@ -121,11 +121,9 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
 
             // dynamic memberships
             anyObjectTO.getDynMemberships().addAll(
-                    anyObjectDAO.findDynGroups(anyObject.getKey()).stream().map(group -> {
-                        return new MembershipTO.Builder().
-                                group(group.getKey(), group.getName()).
-                                build();
-                    }).collect(Collectors.toList()));
+                    anyObjectDAO.findDynGroups(anyObject.getKey()).stream().
+                            map(group -> new MembershipTO.Builder(group.getKey()).groupName(group.getName()).build()).
+                            collect(Collectors.toList()));
         }
 
         return anyObjectTO;
@@ -387,7 +385,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
                                 newAttr.setSchema(schema);
                                 anyObject.add(newAttr);
 
-                                AttrPatch patch = new AttrPatch.Builder().attrTO(attrTO).build();
+                                AttrPatch patch = new AttrPatch.Builder(attrTO).build();
                                 processAttrPatch(
                                         anyObject, patch, schema, newAttr, anyUtils,
                                         resources, propByRes, invalidValues);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConfigurationDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConfigurationDataBinderImpl.java
index fbe700d..c0db08f 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConfigurationDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConfigurationDataBinderImpl.java
@@ -53,8 +53,7 @@ public class ConfigurationDataBinderImpl extends AbstractAnyDataBinder implement
 
     @Override
     public AttrTO getAttrTO(final CPlainAttr attr) {
-        return new AttrTO.Builder().
-                schema(attr.getSchema().getKey()).
+        return new AttrTO.Builder(attr.getSchema().getKey()).
                 values(attr.getValuesAsStrings()).
                 build();
     }
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
index 79e7e03..1bc5265 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
@@ -460,7 +460,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
                                 attr.setSchema(schema);
                                 user.add(attr);
 
-                                AttrPatch patch = new AttrPatch.Builder().attrTO(attrTO).build();
+                                AttrPatch patch = new AttrPatch.Builder(attrTO).build();
                                 processAttrPatch(
                                         user, patch, schema, attr, anyUtils,
                                         resources, propByRes, invalidValues);
@@ -630,11 +630,9 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
 
             // dynamic memberships
             userTO.getDynMemberships().addAll(
-                    userDAO.findDynGroups(user.getKey()).stream().map(group -> {
-                        return new MembershipTO.Builder().
-                                group(group.getKey(), group.getName()).
-                                build();
-                    }).collect(Collectors.toList()));
+                    userDAO.findDynGroups(user.getKey()).stream().
+                            map(group -> new MembershipTO.Builder(group.getKey()).groupName(group.getName()).build()).
+                            collect(Collectors.toList()));
         }
 
         return userTO;
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
index 4fca9f2..7e044de 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
@@ -74,10 +74,9 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> before = membershipsBefore.get(user);
                         if (before == null || !before.contains(group)) {
-                            userUR.getMemberships().add(new MembershipUR.Builder().
-                                            operation(PatchOperation.ADD_REPLACE).
-                                            group(group).
-                                            build());
+                            userUR.getMemberships().add(new MembershipUR.Builder(group).
+                                    operation(PatchOperation.ADD_REPLACE).
+                                    build());
                         }
                     });
                 });
@@ -86,7 +85,7 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     UserUR userUR = updateReqs.stream().
                             filter(req -> user.equals(req.getKey())).findFirst().
                             orElseGet(() -> {
-                                UserUR req = new UserUR.Builder().key(user).build();
+                                UserUR req = new UserUR.Builder(user).build();
                                 updateReqs.add(req);
                                 return req;
                             });
@@ -94,10 +93,9 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> after = membershipsAfter.get(user);
                         if (after == null || !after.contains(group)) {
-                            userUR.getMemberships().add(new MembershipUR.Builder().
-                                            operation(PatchOperation.DELETE).
-                                            group(group).
-                                            build());
+                            userUR.getMemberships().add(new MembershipUR.Builder(group).
+                                    operation(PatchOperation.DELETE).
+                                    build());
                         }
                     });
                 });
diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/MailTemplateTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/MailTemplateTest.java
index ea1f551..494d824 100644
--- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/MailTemplateTest.java
+++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/MailTemplateTest.java
@@ -99,10 +99,10 @@ public class MailTemplateTest extends AbstractTest {
         String username = "test" + UUID.randomUUID().toString();
         UserTO user = new UserTO();
         user.setUsername(username);
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("firstname").value("John").build());
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("surname").value("Doe").build());
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("email").value("john.doe@syncope.apache.org").build());
-        user.getMemberships().add(new MembershipTO.Builder().group(UUID.randomUUID().toString(), "a group").build());
+        user.getPlainAttrs().add(new AttrTO.Builder("firstname").value("John").build());
+        user.getPlainAttrs().add(new AttrTO.Builder("surname").value("Doe").build());
+        user.getPlainAttrs().add(new AttrTO.Builder("email").value("john.doe@syncope.apache.org").build());
+        user.getMemberships().add(new MembershipTO.Builder(UUID.randomUUID().toString()).groupName("a group").build());
         ctx.put("user", user);
 
         String token = "token " + UUID.randomUUID().toString();
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
index 3277109..19a4862 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
@@ -174,7 +174,7 @@ public abstract class AbstractAnyService<TO extends AnyTO, CR extends AnyCR, UR
                 break;
 
             case PLAIN:
-                updateReq.getPlainAttrs().add(new AttrPatch.Builder().operation(operation).attrTO(attrTO).build());
+                updateReq.getPlainAttrs().add(new AttrPatch.Builder(attrTO).operation(operation).build());
                 break;
 
             case DERIVED:
@@ -196,7 +196,7 @@ public abstract class AbstractAnyService<TO extends AnyTO, CR extends AnyCR, UR
         addUpdateOrReplaceAttr(
                 getActualKey(getAnyDAO(), key),
                 schemaType,
-                new AttrTO.Builder().schema(schema).build(),
+                new AttrTO.Builder(schema).build(),
                 PatchOperation.DELETE);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
index 7660562..2b1f4cf 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
@@ -59,7 +59,7 @@ public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObj
 
     @Override
     protected AnyObjectUR newUpdateReq(final String key) {
-        return new AnyObjectUR.Builder().key(key).build();
+        return new AnyObjectUR.Builder(key).build();
     }
 
     @Override
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
index 855dd87..eedafba 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
@@ -55,7 +55,7 @@ public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupCR, Group
 
     @Override
     protected GroupUR newUpdateReq(final String key) {
-        return new GroupUR.Builder().key(key).build();
+        return new GroupUR.Builder(key).build();
     }
 
     @Override
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
index 79d4023..6daf501 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
@@ -54,7 +54,7 @@ public class UserServiceImpl extends AbstractAnyService<UserTO, UserCR, UserUR>
 
     @Override
     protected UserUR newUpdateReq(final String key) {
-        return new UserUR.Builder().key(key).build();
+        return new UserUR.Builder(key).build();
     }
 
     @Override
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/SuspendProducer.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/SuspendProducer.java
index 646fe36..74b11f7 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/SuspendProducer.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/SuspendProducer.java
@@ -42,13 +42,13 @@ public class SuspendProducer extends AbstractProducer {
                     (Pair<WorkflowResult<String>, Boolean>) exchange.getIn().getBody();
 
             // propagate suspension if and only if it is required by policy
-            if (updated != null && updated.getValue()) {
-                UserUR userUR = new UserUR.Builder().key(updated.getKey().getResult()).build();
+            if (updated != null && updated.getRight()) {
+                UserUR userUR = new UserUR.Builder(updated.getLeft().getResult()).build();
 
                 List<PropagationTaskInfo> taskInfos = getPropagationManager().getUserUpdateTasks(
                         new WorkflowResult<>(
                                 Pair.of(userUR, Boolean.FALSE),
-                                updated.getKey().getPropByRes(), updated.getKey().getPerformedTasks()));
+                                updated.getLeft().getPropByRes(), updated.getLeft().getPerformedTasks()));
                 getPropagationTaskExecutor().execute(taskInfos, false);
             }
         }
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/PasswordReset.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/PasswordReset.java
index 2d431f2..55ded95 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/PasswordReset.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/PasswordReset.java
@@ -51,7 +51,7 @@ public class PasswordReset extends FlowableServiceTask {
 
         user.removeToken();
 
-        UserUR req = new UserUR.Builder().key(user.getKey()).
+        UserUR req = new UserUR.Builder(user.getKey()).
                 password(new PasswordPatch.Builder().
                         onSyncope(true).
                         resources(userDAO.findAllResourceKeys(user.getKey())).
diff --git a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserWorkflowTaskLogic.java b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserWorkflowTaskLogic.java
index 5e5fbcf..77decd6 100644
--- a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserWorkflowTaskLogic.java
+++ b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserWorkflowTaskLogic.java
@@ -69,7 +69,7 @@ public class UserWorkflowTaskLogic extends AbstractTransactionalLogic<EntityTO>
     public UserTO executeNextTask(final WorkflowTaskExecInput workflowTaskExecInput) {
         WorkflowResult<String> updated = wfTaskManager.executeNextTask(workflowTaskExecInput);
 
-        UserUR userUR = new UserUR.Builder().key(updated.getResult()).build();
+        UserUR userUR = new UserUR.Builder(updated.getResult()).build();
 
         List<PropagationTaskInfo> taskInfos = propagationManager.getUserUpdateTasks(new WorkflowResult<>(
                 Pair.<UserUR, Boolean>of(userUR, null),
diff --git a/ext/oidcclient/agent/src/main/java/org/apache/syncope/ext/oidcclient/agent/CodeConsumer.java b/ext/oidcclient/agent/src/main/java/org/apache/syncope/ext/oidcclient/agent/CodeConsumer.java
index 7bb26c1..d793582 100644
--- a/ext/oidcclient/agent/src/main/java/org/apache/syncope/ext/oidcclient/agent/CodeConsumer.java
+++ b/ext/oidcclient/agent/src/main/java/org/apache/syncope/ext/oidcclient/agent/CodeConsumer.java
@@ -66,8 +66,7 @@ public class CodeConsumer extends HttpServlet {
                         authorizationCode,
                         request.getSession().getAttribute(OIDCConstants.OP).toString());
                 if (responseTO.isSelfReg()) {
-                    responseTO.getAttrs().add(
-                            new AttrTO.Builder().schema("username").values(responseTO.getUsername()).build());
+                    responseTO.getAttrs().add(new AttrTO.Builder("username").values(responseTO.getUsername()).build());
                     request.getSession(true).
                             setAttribute(Constants.OIDCCLIENT_USER_ATTRS, MAPPER.writeValueAsString(responseTO.
                                     getAttrs()));
diff --git a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
index 2df0dfd..f30fb80 100644
--- a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
+++ b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
@@ -225,7 +225,7 @@ public class OIDCUserManager {
                         if (attr.isPresent()) {
                             attr.get().getValues().clear();
                         } else {
-                            attr = Optional.of(new AttrTO.Builder().schema(intAttrName.getSchemaName()).build());
+                            attr = Optional.of(new AttrTO.Builder(intAttrName.getSchemaName()).build());
                             userTO.getPlainAttrs().add(attr.get());
                         }
                         attr.get().getValues().addAll(values);
diff --git a/ext/saml2sp/agent/src/main/java/org/apache/syncope/ext/saml2lsp/agent/AssertionConsumer.java b/ext/saml2sp/agent/src/main/java/org/apache/syncope/ext/saml2lsp/agent/AssertionConsumer.java
index aae650b..78d071c 100644
--- a/ext/saml2sp/agent/src/main/java/org/apache/syncope/ext/saml2lsp/agent/AssertionConsumer.java
+++ b/ext/saml2sp/agent/src/main/java/org/apache/syncope/ext/saml2lsp/agent/AssertionConsumer.java
@@ -56,8 +56,7 @@ public class AssertionConsumer extends AbstractSAML2SPServlet {
                             request.getInputStream()));
 
             if (responseTO.isSelfReg()) {
-                responseTO.getAttrs().add(
-                        new AttrTO.Builder().schema("username").values(responseTO.getUsername()).build());
+                responseTO.getAttrs().add(new AttrTO.Builder("username").values(responseTO.getUsername()).build());
                 request.getSession(true).
                         setAttribute(Constants.SAML2SP_USER_ATTRS, MAPPER.writeValueAsString(responseTO.getAttrs()));
 
diff --git a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
index 7cc36e2..ff27083 100644
--- a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
+++ b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
@@ -239,7 +239,7 @@ public class SAML2UserManager {
                         if (attr.isPresent()) {
                             attr.get().getValues().clear();
                         } else {
-                            attr = Optional.of(new AttrTO.Builder().schema(intAttrName.getSchemaName()).build());
+                            attr = Optional.of(new AttrTO.Builder(intAttrName.getSchemaName()).build());
                             userTO.getPlainAttrs().add(attr.get());
                         }
                         attr.get().getValues().addAll(values);
diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
index bf122d5..cc67e72 100644
--- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
+++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
@@ -162,7 +162,7 @@ public class SCIMDataBinder {
         attrs.putAll(EntityTOUtils.buildAttrMap(userTO.getPlainAttrs()));
         attrs.putAll(EntityTOUtils.buildAttrMap(userTO.getDerAttrs()));
         attrs.putAll(EntityTOUtils.buildAttrMap(userTO.getVirAttrs()));
-        attrs.put("username", new AttrTO.Builder().schema("username").value(userTO.getUsername()).build());
+        attrs.put("username", new AttrTO.Builder("username").value(userTO.getUsername()).build());
 
         if (conf.getUserConf() != null) {
             if (output(attributes, excludedAttributes, "name") && conf.getUserConf().getName() != null) {
@@ -433,7 +433,7 @@ public class SCIMDataBinder {
                 confs.stream().
                         filter(object -> value.getType().equals(object.getType().name())).findFirst().
                         ifPresent(conf -> attrs.add(
-                        new AttrTO.Builder().schema(conf.getValue()).value(value.getValue()).build()));
+                        new AttrTO.Builder(conf.getValue()).value(value.getValue()).build()));
             }
         });
     }
@@ -597,7 +597,7 @@ public class SCIMDataBinder {
         }
 
         userTO.getMemberships().addAll(user.getGroups().stream().
-                map(group -> new MembershipTO.Builder().group(group.getValue()).build()).
+                map(group -> new MembershipTO.Builder(group.getValue()).build()).
                 collect(Collectors.toList()));
 
         userTO.getRoles().addAll(user.getRoles().stream().
@@ -609,15 +609,9 @@ public class SCIMDataBinder {
 
     public UserCR toUserCR(final SCIMUser user) {
         UserTO userTO = toUserTO(user);
-
-        return new UserCR.Builder().
-                username(userTO.getUsername()).
-                password(userTO.getPassword()).
-                realm(userTO.getRealm()).
-                plainAttrs(userTO.getPlainAttrs()).
-                memberships(userTO.getMemberships()).
-                roles(userTO.getRoles()).
-                build();
+        UserCR userCR = new UserCR();
+        EntityTOUtils.toAnyCR(userTO, userCR);
+        return userCR;
     }
 
     private void setAttribute(final UserTO userTO, final String schema, final String value) {
@@ -627,7 +621,7 @@ public class SCIMDataBinder {
                 break;
 
             default:
-                userTO.getPlainAttrs().add(new AttrTO.Builder().schema(schema).value(value).build());
+                userTO.getPlainAttrs().add(new AttrTO.Builder(schema).value(value).build());
         }
     }
 
@@ -695,6 +689,6 @@ public class SCIMDataBinder {
             throw new BadRequestException(ErrorType.invalidValue);
         }
 
-        return new GroupCR.Builder().realm(SyncopeConstants.ROOT_REALM).name(group.getDisplayName()).build();
+        return new GroupCR.Builder(SyncopeConstants.ROOT_REALM, group.getDisplayName()).build();
     }
 }
diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java
index 02ba142..08ddf21 100644
--- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java
+++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java
@@ -89,8 +89,7 @@ public class SCIMConfManager {
         conf.setGeneralConf(new SCIMGeneralConf());
         conf.getGeneralConf().setLastChangeDate(new Date());
 
-        configurationLogic.set(new AttrTO.Builder().
-                schema(SCIMConf.KEY).
+        configurationLogic.set(new AttrTO.Builder(SCIMConf.KEY).
                 value(Base64.getEncoder().encodeToString(POJOHelper.serialize(conf).getBytes())).
                 build());
     }
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
index 0a7a747..cd7ceb3 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
@@ -57,10 +57,9 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
 
         // then assign members
         group.getMembers().forEach(member -> {
-            UserUR req = new UserUR.Builder().
-                    key(member.getValue()).
-                    membership(new MembershipUR.Builder().
-                            operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
+            UserUR req = new UserUR.Builder(member.getValue()).
+                    membership(new MembershipUR.Builder(result.getEntity().getKey()).
+                            operation(PatchOperation.ADD_REPLACE).build()).
                     build();
             try {
                 userLogic().update(req, false);
@@ -136,10 +135,9 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
             afterMembers.add(member.getValue());
 
             if (!beforeMembers.contains(member.getValue())) {
-                UserUR req = new UserUR.Builder().
-                        key(member.getValue()).
-                        membership(new MembershipUR.Builder().
-                                operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
+                UserUR req = new UserUR.Builder(member.getValue()).
+                        membership(new MembershipUR.Builder(result.getEntity().getKey()).
+                                operation(PatchOperation.ADD_REPLACE).build()).
                         build();
                 try {
                     userLogic().update(req, false);
@@ -151,10 +149,9 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
         });
         // remove unconfirmed members
         beforeMembers.stream().filter(member -> !afterMembers.contains(member)).forEach(user -> {
-            UserUR req = new UserUR.Builder().
-                    key(user).
-                    membership(new MembershipUR.Builder().
-                            operation(PatchOperation.DELETE).group(result.getEntity().getKey()).build()).
+            UserUR req = new UserUR.Builder(user).
+                    membership(new MembershipUR.Builder(result.getEntity().getKey()).
+                            operation(PatchOperation.DELETE).build()).
                     build();
             try {
                 userLogic().update(req, false);
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
index a2fb529..f7dc233 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
@@ -50,8 +50,7 @@ public class AssignDirectorGroup extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getMemberships().add(new MembershipUR.Builder().
-                    group("ebf97068-aa4b-4a85-9f01-680e8c4cf227").build());
+            userUR.getMemberships().add(new MembershipUR.Builder("ebf97068-aa4b-4a85-9f01-680e8c4cf227").build());
 
             PropagationByResource propByRes = dataBinder.update(user, userUR);
 
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
index 1944255..20bfe19 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
@@ -53,9 +53,8 @@ public class CreateARelationship extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getRelationships().add(new RelationshipUR.Builder().
-                    relationshipTO(new RelationshipTO.Builder().
-                            otherEnd("PRINTER", printer).type("neighborhood").build()).
+            userUR.getRelationships().add(new RelationshipUR.Builder(new RelationshipTO.Builder().
+                    otherEnd("PRINTER", printer).type("neighborhood").build()).
                     build());
 
             PropagationByResource propByRes = dataBinder.update(user, userUR);
diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
index ab33943..f96f59c 100644
--- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
+++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
@@ -79,9 +79,8 @@ public class TestPullActions implements PullActions {
             }
         }
         if (fullnamePatch == null) {
-            fullnamePatch = new AttrPatch.Builder().
+            fullnamePatch = new AttrPatch.Builder(new AttrTO.Builder("fullname").build()).
                     operation(PatchOperation.ADD_REPLACE).
-                    attrTO(new AttrTO.Builder().schema("fullname").build()).
                     build();
         }
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index 2d61758..bd8a027 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -354,11 +354,11 @@ public abstract class AbstractITCase {
     }
 
     protected static AttrTO attrTO(final String schema, final String value) {
-        return new AttrTO.Builder().schema(schema).value(value).build();
+        return new AttrTO.Builder(schema).value(value).build();
     }
 
     protected static AttrPatch attrAddReplacePatch(final String schema, final String value) {
-        return new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).attrTO(attrTO(schema, value)).build();
+        return new AttrPatch.Builder(attrTO(schema, value)).operation(PatchOperation.ADD_REPLACE).build();
     }
 
     public static <T> T getObject(final URI location, final Class<?> serviceClass, final Class<T> resultClass) {
@@ -439,8 +439,7 @@ public abstract class AbstractITCase {
 
         // 2. create user
         UserCR req = UserITCase.getUniqueSample("notificationtest@syncope.apache.org");
-        req.getMemberships().add(
-                new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
+        req.getMemberships().add(new MembershipTO.Builder("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
         UserTO userTO = createUser(req).getEntity();
         assertNotNull(userTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
index 38fcc3d..472a3bd 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
@@ -48,9 +48,7 @@ import org.junit.jupiter.api.Test;
 public class AnyObjectITCase extends AbstractITCase {
 
     public static AnyObjectCR getSample(final String location) {
-        return new AnyObjectCR.Builder("PRINTER").
-                name(location + getUUIDString()).
-                realm(SyncopeConstants.ROOT_REALM).
+        return new AnyObjectCR.Builder(SyncopeConstants.ROOT_REALM, "PRINTER", location + getUUIDString()).
                 plainAttr(attrTO("location", location + getUUIDString())).
                 resource(RESOURCE_NAME_DBSCRIPTED).
                 build();
@@ -77,8 +75,7 @@ public class AnyObjectITCase extends AbstractITCase {
         // 1. create anyObject in realm /odd and attempt to assign group 15, from realm /even => exception
         AnyObjectCR anyObjectCR = getSample("createInvalidMembership");
         anyObjectCR.setRealm("/odd");
-        anyObjectCR.getMemberships().add(
-                new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build());
+        anyObjectCR.getMemberships().add(new MembershipTO.Builder("034740a9-fa10-453b-af37-dc7897e98fb1").build());
 
         try {
             createAnyObject(anyObjectCR);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
index 3a167f5..749f453 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
@@ -481,8 +481,7 @@ public class AuthenticationITCase extends AbstractITCase {
         // 1. create user with group 'groupForWorkflowApproval' 
         // (users with group groupForWorkflowApproval are defined in workflow as subject to approval)
         UserCR userCR = UserITCase.getUniqueSample("createWithReject@syncope.apache.org");
-        userCR.getMemberships().add(
-                new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
         UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConfigurationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConfigurationITCase.java
index c6a3438..77f6df0 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConfigurationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConfigurationITCase.java
@@ -53,7 +53,7 @@ public class ConfigurationITCase extends AbstractITCase {
         testKey.setType(AttrSchemaType.String);
         createSchema(SchemaType.PLAIN, testKey);
 
-        AttrTO conf = new AttrTO.Builder().schema(testKey.getKey()).value("testValue").build();
+        AttrTO conf = new AttrTO.Builder(testKey.getKey()).value("testValue").build();
 
         configurationService.set(conf);
 
@@ -69,7 +69,7 @@ public class ConfigurationITCase extends AbstractITCase {
         testKey.setMandatoryCondition("true");
         createSchema(SchemaType.PLAIN, testKey);
 
-        AttrTO conf = new AttrTO.Builder().schema(testKey.getKey()).build();
+        AttrTO conf = new AttrTO.Builder(testKey.getKey()).build();
         try {
             configurationService.set(conf);
             fail("This should not happen");
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
index a8bf513..2c0cc5e 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
@@ -197,7 +197,7 @@ public class DynRealmITCase extends AbstractITCase {
             // GROUP_UPDATE
             GroupUR groupUR = new GroupUR();
             groupUR.setKey(groupKey);
-            groupUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("icon", "modified")).build());
+            groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("icon", "modified")).build());
             group = delegatedGroupService.update(groupUR).readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
             }).getEntity();
             assertNotNull(group);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
index c5221ed..58a55f8 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
@@ -99,10 +99,7 @@ import org.junit.jupiter.api.Test;
 public class GroupITCase extends AbstractITCase {
 
     public static GroupCR getBasicSample(final String name) {
-        return new GroupCR.Builder().
-                realm(SyncopeConstants.ROOT_REALM).
-                name(name + getUUIDString()).
-                build();
+        return new GroupCR.Builder(SyncopeConstants.ROOT_REALM, name + getUUIDString()).build();
     }
 
     public static GroupCR getSample(final String name) {
@@ -238,9 +235,9 @@ public class GroupITCase extends AbstractITCase {
 
         groupTO.getPlainAttr("show").get().getValues().clear();
 
-        groupUR = new GroupUR.Builder().key(groupTO.getKey()).
-                plainAttr(new AttrPatch.Builder().operation(PatchOperation.DELETE).
-                        attrTO(new AttrTO.Builder().schema("show").build()).build()).build();
+        groupUR = new GroupUR.Builder(groupTO.getKey()).
+                plainAttr(new AttrPatch.Builder(new AttrTO.Builder("show").build()).
+                        operation(PatchOperation.DELETE).build()).build();
 
         groupTO = updateGroup(groupUR).getEntity();
 
@@ -257,11 +254,11 @@ public class GroupITCase extends AbstractITCase {
 
         GroupTO created = createGroup(createReq).getEntity();
 
-        created.getPlainAttrs().add(new AttrTO.Builder().schema("icon").build());
-        created.getPlainAttrs().add(new AttrTO.Builder().schema("show").build());
-        created.getPlainAttrs().add(new AttrTO.Builder().schema("rderived_sx").value("sx").build());
-        created.getPlainAttrs().add(new AttrTO.Builder().schema("rderived_dx").value("dx").build());
-        created.getPlainAttrs().add(new AttrTO.Builder().schema("title").value("mr").build());
+        created.getPlainAttrs().add(new AttrTO.Builder("icon").build());
+        created.getPlainAttrs().add(new AttrTO.Builder("show").build());
+        created.getPlainAttrs().add(new AttrTO.Builder("rderived_sx").value("sx").build());
+        created.getPlainAttrs().add(new AttrTO.Builder("rderived_dx").value("dx").build());
+        created.getPlainAttrs().add(new AttrTO.Builder("title").value("mr").build());
 
         GroupTO original = groupService.read(created.getKey());
 
@@ -696,9 +693,8 @@ public class GroupITCase extends AbstractITCase {
         // verify that the condition is dynamically applied
         AnyObjectUR anyObjectUR = new AnyObjectUR();
         anyObjectUR.setKey(newAny.getKey());
-        anyObjectUR.getPlainAttrs().add(new AttrPatch.Builder().
+        anyObjectUR.getPlainAttrs().add(new AttrPatch.Builder(new AttrTO.Builder("location").build()).
                 operation(PatchOperation.DELETE).
-                attrTO(new AttrTO.Builder().schema("location").build()).
                 build());
         newAny = updateAnyObject(anyObjectUR).getEntity();
         assertFalse(newAny.getPlainAttr("location").isPresent());
@@ -725,7 +721,7 @@ public class GroupITCase extends AbstractITCase {
         printerCR.setRealm(SyncopeConstants.ROOT_REALM);
         printerCR.setName("Printer_" + getUUIDString());
         printerCR.setType("PRINTER");
-        printerCR.getPlainAttrs().add(new AttrTO.Builder().schema("location").value("home").build());
+        printerCR.getPlainAttrs().add(new AttrTO.Builder("location").value("home").build());
         AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
@@ -746,7 +742,7 @@ public class GroupITCase extends AbstractITCase {
         printerCR.setRealm(SyncopeConstants.ROOT_REALM);
         printerCR.setName("Printer_" + getUUIDString());
         printerCR.setType("PRINTER");
-        printerCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        printerCR.getMemberships().add(new MembershipTO.Builder(group.getKey()).build());
         AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
@@ -787,8 +783,8 @@ public class GroupITCase extends AbstractITCase {
             // 2. update succeeds
             GroupUR groupUR = new GroupUR();
             groupUR.setKey(group.getKey());
-            groupUR.getPlainAttrs().add(new AttrPatch.Builder().
-                    operation(PatchOperation.ADD_REPLACE).attrTO(attrTO("title", "second")).build());
+            groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("title", "second")).
+                    operation(PatchOperation.ADD_REPLACE).build());
 
             result = updateGroup(groupUR);
             assertNotNull(result);
@@ -809,8 +805,8 @@ public class GroupITCase extends AbstractITCase {
             // 4. update succeeds again
             groupUR = new GroupUR();
             groupUR.setKey(group.getKey());
-            groupUR.getPlainAttrs().add(new AttrPatch.Builder().
-                    operation(PatchOperation.ADD_REPLACE).attrTO(attrTO("title", "third")).build());
+            groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("title", "third")).
+                    operation(PatchOperation.ADD_REPLACE).build());
 
             result = updateGroup(groupUR);
             assertNotNull(result);
@@ -831,8 +827,8 @@ public class GroupITCase extends AbstractITCase {
             // 6. update now fails
             groupUR = new GroupUR();
             groupUR.setKey(group.getKey());
-            groupUR.getPlainAttrs().add(new AttrPatch.Builder().
-                    operation(PatchOperation.ADD_REPLACE).attrTO(attrTO("title", "fourth")).build());
+            groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("title", "fourth")).
+                    operation(PatchOperation.ADD_REPLACE).build());
 
             result = updateGroup(groupUR);
             assertNotNull(result);
@@ -886,7 +882,7 @@ public class GroupITCase extends AbstractITCase {
 
         // 2. create user with such group assigned
         UserCR userCR = UserITCase.getUniqueSample("forProvision@syncope.apache.org");
-        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(groupTO.getKey()).build());
         UserTO userTO = createUser(userCR).getEntity();
 
         // 3. modify the group by assiging the LDAP resource
@@ -1103,7 +1099,7 @@ public class GroupITCase extends AbstractITCase {
         // 5. modify group with new double value
         GroupUR groupUR = new GroupUR();
         groupUR.setKey(groupTO.getKey());
-        groupUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO(doubleSchemaName, "11.257")).build());
+        groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO(doubleSchemaName, "11.257")).build());
 
         groupTO = updateGroup(groupUR).getEntity();
         assertNotNull(groupTO);
@@ -1116,7 +1112,7 @@ public class GroupITCase extends AbstractITCase {
         // 7. modify group with new double value, verify that no pattern is applied
         groupUR = new GroupUR();
         groupUR.setKey(groupTO.getKey());
-        groupUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO(doubleSchemaName, "11.23")).build());
+        groupUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO(doubleSchemaName, "11.23")).build());
 
         groupTO = updateGroup(groupUR).getEntity();
         assertNotNull(groupTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
index 6a2bd53..faaa15c 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
@@ -69,16 +69,16 @@ public class MembershipITCase extends AbstractITCase {
     public void misc() {
         UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
         userCR.setRealm("/even/two");
-        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        userCR.getPlainAttrs().add(new AttrTO.Builder("aLong").value("1976").build());
         userCR.getPlainAttrs().removeIf(attr -> "ctype".equals(attr.getSchema()));
 
         // the group 034740a9-fa10-453b-af37-dc7897e98fb1 has USER type extensions for 'csv' and 'other' 
         // any type classes
-        MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
-        membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1977").build());
+        MembershipTO membership = new MembershipTO.Builder("034740a9-fa10-453b-af37-dc7897e98fb1").build();
+        membership.getPlainAttrs().add(new AttrTO.Builder("aLong").value("1977").build());
 
         // 'fullname' is in 'minimal user', so it is not allowed for this membership
-        membership.getPlainAttrs().add(new AttrTO.Builder().schema("fullname").value("discarded").build());
+        membership.getPlainAttrs().add(new AttrTO.Builder("fullname").value("discarded").build());
 
         userCR.getMemberships().add(membership);
 
@@ -116,14 +116,14 @@ public class MembershipITCase extends AbstractITCase {
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
 
-            userUR.getPlainAttrs().add(new AttrPatch.Builder().
-                    attrTO(new AttrTO.Builder().schema("aLong").value("1977").build()).build());
+            userUR.getPlainAttrs().
+                    add(new AttrPatch.Builder(new AttrTO.Builder("aLong").value("1977").build()).build());
 
-            MembershipUR membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).build();
+            MembershipUR membershipPatch = new MembershipUR.Builder(membership.getGroupKey()).build();
             membershipPatch.getPlainAttrs().add(
-                    new AttrTO.Builder().schema("aLong").value("1976").build());
+                    new AttrTO.Builder("aLong").value("1976").build());
             membershipPatch.getPlainAttrs().add(
-                    new AttrTO.Builder().schema("ctype").value("membership type").build());
+                    new AttrTO.Builder("ctype").value("membership type").build());
             userUR.getMemberships().add(membershipPatch);
 
             userTO = updateUser(userUR).getEntity();
@@ -147,7 +147,7 @@ public class MembershipITCase extends AbstractITCase {
             userUR = new UserUR();
             userUR.setKey(userTO.getKey());
 
-            membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).
+            membershipPatch = new MembershipUR.Builder(membership.getGroupKey()).
                     operation(PatchOperation.DELETE).build();
             userUR.getMemberships().add(membershipPatch);
 
@@ -165,10 +165,10 @@ public class MembershipITCase extends AbstractITCase {
     public void deleteUserWithMembership() {
         UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
         userCR.setRealm("/even/two");
-        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        userCR.getPlainAttrs().add(new AttrTO.Builder("aLong").value("1976").build());
 
-        MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
-        membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1977").build());
+        MembershipTO membership = new MembershipTO.Builder("034740a9-fa10-453b-af37-dc7897e98fb1").build();
+        membership.getPlainAttrs().add(new AttrTO.Builder("aLong").value("1977").build());
         userCR.getMemberships().add(membership);
 
         UserTO user = createUser(userCR).getEntity();
@@ -193,8 +193,8 @@ public class MembershipITCase extends AbstractITCase {
         // pre: create user with membership to such group
         UserCR userCR = UserITCase.getUniqueSample("typeExt@apache.org");
 
-        MembershipTO membership = new MembershipTO.Builder().group(groupTO.getKey()).build();
-        membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1454").build());
+        MembershipTO membership = new MembershipTO.Builder(groupTO.getKey()).build();
+        membership.getPlainAttrs().add(new AttrTO.Builder("aLong").value("1454").build());
         userCR.getMemberships().add(membership);
 
         UserTO user = createUser(userCR).getEntity();
@@ -248,8 +248,8 @@ public class MembershipITCase extends AbstractITCase {
             userCR.getResources().clear();
             userCR.getResources().add(newResource.getKey());
 
-            MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
-            membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("5432").build());
+            MembershipTO membership = new MembershipTO.Builder("034740a9-fa10-453b-af37-dc7897e98fb1").build();
+            membership.getPlainAttrs().add(new AttrTO.Builder("aLong").value("5432").build());
             userCR.getMemberships().add(membership);
 
             user = createUser(userCR).getEntity();
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
index 2b2fb84..926730b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
@@ -187,10 +187,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
         // validation OK - application/pdf -> application/pdf
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).
-                attrTO(attrTO("BinaryPDF",
-                        Base64.getEncoder().encodeToString(
-                                IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.pdf"))))).
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("BinaryPDF",
+                Base64.getEncoder().encodeToString(
+                        IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.pdf"))))).
+                operation(PatchOperation.ADD_REPLACE).
                 build());
 
         updateUser(userUR);
@@ -200,10 +200,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         userUR.setKey(userTO.getKey());
         // validation KO - text/html -> application/pdf
         try {
-            userUR.getPlainAttrs().add(new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).
-                    attrTO(attrTO("BinaryPDF",
-                            Base64.getEncoder().encodeToString(
-                                    IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.html"))))).
+            userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("BinaryPDF",
+                    Base64.getEncoder().encodeToString(
+                            IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.html"))))).
+                    operation(PatchOperation.ADD_REPLACE).
                     build());
 
             updateUser(userUR);
@@ -215,10 +215,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         userUR = new UserUR();
         userUR.setKey(userTO.getKey());
         // validation ok - application/json -> application/json
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).
-                attrTO(attrTO("BinaryJSON",
-                        Base64.getEncoder().encodeToString(
-                                IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.json"))))).
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("BinaryJSON",
+                Base64.getEncoder().encodeToString(
+                        IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.json"))))).
+                operation(PatchOperation.ADD_REPLACE).
                 build());
 
         updateUser(userUR);
@@ -227,10 +227,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         userUR = new UserUR();
         userUR.setKey(userTO.getKey());
         // no validation - application/xml -> application/json
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).
-                attrTO(attrTO("BinaryJSON2",
-                        Base64.getEncoder().encodeToString(
-                                IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.xml"))))).
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("BinaryJSON2",
+                Base64.getEncoder().encodeToString(
+                        IOUtils.readBytesFromStream(getClass().getResourceAsStream("/test.xml"))))).
+                operation(PatchOperation.ADD_REPLACE).
                 build());
 
         updateUser(userUR);
@@ -351,8 +351,8 @@ public class PlainSchemaITCase extends AbstractITCase {
         UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
-        UserUR req = new UserUR.Builder().key(userTO.getKey()).
-                membership(new MembershipUR.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
+        UserUR req = new UserUR.Builder(userTO.getKey()).
+                membership(new MembershipUR.Builder("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
 
         UserTO newUserTO = updateUser(req).getEntity();
         assertNotNull(newUserTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
index f07a546..5ab0e85 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
@@ -142,8 +142,7 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
 
             // 1. create printer on external resource
             AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("propagationJEXLTransformer");
-            String originalLocation = anyObjectCR.getPlainAttrs().stream().
-                    filter(attr -> "location".equals(attr.getSchema())).findFirst().get().getValues().get(0);
+            String originalLocation = anyObjectCR.getPlainAttr("location").get().getValues().get(0);
             assertFalse(originalLocation.endsWith(suffix));
 
             AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
@@ -258,9 +257,9 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
         for (int i = 0; i < 9; i++) {
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
-            userUR.getPlainAttrs().add(new AttrPatch.Builder().operation(PatchOperation.ADD_REPLACE).
-                    attrTO(new AttrTO.Builder().schema("userId").value(
-                            "test" + getUUIDString() + i + "@test.com").build()).
+            userUR.getPlainAttrs().add(new AttrPatch.Builder(new AttrTO.Builder("userId").value(
+                    "test" + getUUIDString() + i + "@test.com").build()).
+                    operation(PatchOperation.ADD_REPLACE).
                     build());
 
             userService.update(userUR);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
index 1b850eb..57abc8e 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
@@ -164,8 +164,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
         UserTO userTemplate = new UserTO();
         userTemplate.getResources().add(RESOURCE_NAME_WS2);
 
-        userTemplate.getMemberships().add(
-                new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userTemplate.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
         task.getTemplates().put(AnyTypeKind.USER.name(), userTemplate);
 
         GroupTO groupTemplate = new GroupTO();
@@ -778,9 +777,8 @@ public class PullTaskITCase extends AbstractTaskITCase {
             AnyCR userCR = remediation.get().getAnyCRPayload();
             userCR.getResources().clear();
 
-            String email = userCR.getPlainAttrs().stream().
-                    filter(attr -> "email".equals(attr.getSchema())).findFirst().get().getValues().get(0);
-            userCR.getPlainAttrs().add(new AttrTO.Builder().schema("userId").value(email).build());
+            String email = userCR.getPlainAttr("email").get().getValues().get(0);
+            userCR.getPlainAttrs().add(new AttrTO.Builder("userId").value(email).build());
 
             remediationService.remedy(remediation.get().getKey(), userCR);
 
@@ -821,8 +819,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
         userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION2);
         userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
 
-        userCR.getMemberships().add(
-                new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
         UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
@@ -837,8 +834,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
             //-----------------------------
             UserTO template = new UserTO();
 
-            template.getMemberships().add(
-                    new MembershipTO.Builder().group("b8d38784-57e7-4595-859a-076222644b55").build());
+            template.getMemberships().add(new MembershipTO.Builder("b8d38784-57e7-4595-859a-076222644b55").build());
 
             template.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
             //-----------------------------
@@ -1233,7 +1229,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
 
             UserTO template = new UserTO();
             template.getAuxClasses().add("minimal group");
-            template.getMemberships().add(new MembershipTO.Builder().group(propagationGroup.getKey()).build());
+            template.getMemberships().add(new MembershipTO.Builder(propagationGroup.getKey()).build());
             template.getPlainAttrs().add(attrTO("firstname", "'fixed'"));
             pullTask.getTemplates().put(AnyTypeKind.USER.name(), template);
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
index 840da6e..42951d2 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
@@ -480,18 +480,14 @@ public class SearchITCase extends AbstractITCase {
 
         String serviceKey = null;
         try {
-            AnyObjectCR anyObjectCR = new AnyObjectCR();
-            anyObjectCR.setName("one");
-            anyObjectCR.setRealm(SyncopeConstants.ROOT_REALM);
-            anyObjectCR.setType(service.getKey());
-            anyObjectCR.getMemberships().add(
-                    new MembershipTO.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
+            AnyObjectCR anyObjectCR = new AnyObjectCR.Builder(SyncopeConstants.ROOT_REALM, service.getKey(), "one").
+                    membership(new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build()).
+                    build();
             serviceKey = createAnyObject(anyObjectCR).getEntity().getKey();
 
-            AnyObjectUR anyObjectUR = new AnyObjectUR();
-            anyObjectUR.setKey("fc6dbc3a-6c07-4965-8781-921e7401a4a5");
-            anyObjectUR.getMemberships().add(new MembershipUR.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").
-                    build());
+            AnyObjectUR anyObjectUR = new AnyObjectUR.Builder("fc6dbc3a-6c07-4965-8781-921e7401a4a5").
+                    membership(new MembershipUR.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build()).
+                    build();
             updateAnyObject(anyObjectUR);
 
             PagedResult<AnyObjectTO> matching = anyObjectService.search(new AnyQuery.Builder().fiql(
@@ -522,7 +518,7 @@ public class SearchITCase extends AbstractITCase {
     public void issueSYNCOPE1223() {
         UserUR req = new UserUR();
         req.setKey("vivaldi");
-        req.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("ctype", "ou=sample,o=isp")).build());
+        req.getPlainAttrs().add(new AttrPatch.Builder(attrTO("ctype", "ou=sample,o=isp")).build());
         userService.update(req);
 
         try {
@@ -533,7 +529,7 @@ public class SearchITCase extends AbstractITCase {
             assertEquals("vivaldi", users.getResult().get(0).getUsername());
         } finally {
             req.getPlainAttrs().clear();
-            req.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("ctype", "F")).build());
+            req.getPlainAttrs().add(new AttrPatch.Builder(attrTO("ctype", "F")).build());
             userService.update(req);
         }
     }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
index e5d3d37..fa177d3 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
@@ -48,17 +48,17 @@ import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.client.lib.batch.BatchRequest;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
-import org.apache.syncope.common.lib.request.ResourceAR;
+import org.apache.syncope.common.lib.policy.AccountPolicyTO;
+import org.apache.syncope.common.lib.policy.HaveIBeenPwnedPasswordRuleConf;
+import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.ResourceAR;
+import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.policy.AccountPolicyTO;
-import org.apache.syncope.common.lib.policy.HaveIBeenPwnedPasswordRuleConf;
-import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
 import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
@@ -73,11 +73,11 @@ import org.apache.syncope.common.lib.to.RealmTO;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
+import org.apache.syncope.common.lib.types.PatchOperation;
+import org.apache.syncope.common.lib.types.ExecStatus;
 import org.apache.syncope.common.lib.types.ImplementationEngine;
 import org.apache.syncope.common.lib.types.ImplementationType;
-import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.common.lib.types.PolicyType;
-import org.apache.syncope.common.lib.types.ExecStatus;
 import org.apache.syncope.common.lib.types.ResourceAssociationAction;
 import org.apache.syncope.common.lib.types.ResourceDeassociationAction;
 import org.apache.syncope.common.lib.types.StatusRType;
@@ -90,10 +90,10 @@ import org.apache.syncope.common.rest.api.service.ResourceService;
 import org.apache.syncope.common.rest.api.service.UserSelfService;
 import org.apache.syncope.common.rest.api.service.UserService;
 import org.apache.syncope.core.provisioning.api.serialization.POJOHelper;
-import org.apache.syncope.fit.core.reference.TestAccountRuleConf;
-import org.apache.syncope.fit.core.reference.TestPasswordRuleConf;
 import org.apache.syncope.fit.AbstractITCase;
 import org.apache.syncope.fit.FlowableDetector;
+import org.apache.syncope.fit.core.reference.TestAccountRuleConf;
+import org.apache.syncope.fit.core.reference.TestPasswordRuleConf;
 import org.identityconnectors.framework.common.objects.OperationalAttributes;
 import org.junit.jupiter.api.Test;
 
@@ -108,10 +108,8 @@ public class UserITCase extends AbstractITCase {
     }
 
     public static UserCR getSample(final String email) {
-        return new UserCR.Builder().
-                realm(SyncopeConstants.ROOT_REALM).
+        return new UserCR.Builder(SyncopeConstants.ROOT_REALM, email).
                 password("password123").
-                username(email).
                 plainAttr(attrTO("fullname", email)).
                 plainAttr(attrTO("firstname", email)).
                 plainAttr(attrTO("surname", "surname")).
@@ -260,8 +258,7 @@ public class UserITCase extends AbstractITCase {
             // configured to be minLength=16
             userCR.setPassword("password1");
 
-            userCR.getMemberships().add(new MembershipTO.Builder().
-                    group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+            userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
             createUser(userCR);
         });
@@ -293,8 +290,7 @@ public class UserITCase extends AbstractITCase {
         UserCR userCR = getUniqueSample("a.b@c.com");
 
         // add a membership
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // add an attribute with a non-existing schema: must be ignored
         AttrTO attrWithInvalidSchemaTO = attrTO("invalid schema", "a value");
@@ -372,12 +368,10 @@ public class UserITCase extends AbstractITCase {
     public void createWithRequiredValueMissing() {
         UserCR userCR = getUniqueSample("a.b@c.it");
 
-        AttrTO type = userCR.getPlainAttrs().stream().
-                filter(attr -> "ctype".equals(attr.getSchema())).findFirst().get();
+        AttrTO type = userCR.getPlainAttr("ctype").get();
         userCR.getPlainAttrs().remove(type);
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user without type (mandatory by UserSchema)
         try {
@@ -389,8 +383,7 @@ public class UserITCase extends AbstractITCase {
 
         userCR.getPlainAttrs().add(attrTO("ctype", "F"));
 
-        AttrTO surname = userCR.getPlainAttrs().stream().
-                filter(attr -> "surname".equals(attr.getSchema())).findFirst().get();
+        AttrTO surname = userCR.getPlainAttr("surname").get();
         userCR.getPlainAttrs().remove(surname);
 
         // 2. create user without surname (mandatory when type == 'F')
@@ -506,9 +499,9 @@ public class UserITCase extends AbstractITCase {
         UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
-        UserUR userUR = new UserUR.Builder().key(userTO.getKey()).
-                plainAttr(new AttrPatch.Builder().operation(PatchOperation.DELETE).
-                        attrTO(new AttrTO.Builder().schema("ctype").build()).
+        UserUR userUR = new UserUR.Builder(userTO.getKey()).
+                plainAttr(new AttrPatch.Builder(new AttrTO.Builder("ctype").build()).
+                        operation(PatchOperation.DELETE).
                         build()).build();
 
         userTO = updateUser(userUR).getEntity();
@@ -554,8 +547,7 @@ public class UserITCase extends AbstractITCase {
     public void update() {
         UserCR userCR = getUniqueSample("g.h@t.com");
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         UserTO userTO = createUser(userCR).getEntity();
 
@@ -572,10 +564,10 @@ public class UserITCase extends AbstractITCase {
         String newFullName = getUUIDString() + "g.h@t.com";
         userUR.getPlainAttrs().add(attrAddReplacePatch("fullname", newFullName));
 
-        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
-                group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
-        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
-                group(userTO.getMemberships().get(0).getGroupKey()).build());
+        userUR.getMemberships().add(new MembershipUR.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").
+                operation(PatchOperation.ADD_REPLACE).build());
+        userUR.getMemberships().add(new MembershipUR.Builder(userTO.getMemberships().get(0).getGroupKey()).
+                operation(PatchOperation.ADD_REPLACE).build());
 
         userTO = updateUser(userUR).getEntity();
         assertNotNull(userTO);
@@ -614,7 +606,7 @@ public class UserITCase extends AbstractITCase {
         assertFalse(beforeTasks <= 0);
 
         UserCR userCR = getUniqueSample("pwdonly@t.com");
-        userCR.getMemberships().add(new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         UserTO userTO = createUser(userCR).getEntity();
 
@@ -651,8 +643,7 @@ public class UserITCase extends AbstractITCase {
         UserCR userCR = getUniqueSample("t@p.mode");
 
         // add a membership
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user
         UserTO userTO = createUser(userCR).getEntity();
@@ -716,8 +707,7 @@ public class UserITCase extends AbstractITCase {
 
         UserCR userCR = getUniqueSample("createActivate@syncope.apache.org");
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("268fed79-f440-4390-9435-b273768eb5d6").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("268fed79-f440-4390-9435-b273768eb5d6").build());
 
         UserTO userTO = createUser(userCR).getEntity();
 
@@ -743,8 +733,7 @@ public class UserITCase extends AbstractITCase {
     public void suspendReactivate() {
         UserCR userCR = getUniqueSample("suspendReactivate@syncope.apache.org");
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
         UserTO userTO = createUser(userCR).getEntity();
 
@@ -856,8 +845,8 @@ public class UserITCase extends AbstractITCase {
         userUR.setKey(userTO.getKey());
 
         loginDate.getValues().add("2000-01-01");
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().
-                operation(PatchOperation.ADD_REPLACE).attrTO(loginDate).build());
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(loginDate).
+                operation(PatchOperation.ADD_REPLACE).build());
 
         userTO = updateUser(userUR).getEntity();
         assertNotNull(userTO);
@@ -925,8 +914,7 @@ public class UserITCase extends AbstractITCase {
 
         userCR.getAuxClasses().add("csv");
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("37d15e4c-cdc1-460b-a591-8505c8133806").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("37d15e4c-cdc1-460b-a591-8505c8133806").build());
 
         userCR.getResources().add(RESOURCE_NAME_CSV);
 
@@ -1339,9 +1327,8 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(response.getEntity());
 
         // 2. update
-        UserUR userUR = new UserUR.Builder().key(result.getEntity().getKey()).
-                plainAttr(new AttrPatch.Builder().
-                        attrTO(new AttrTO.Builder().schema("surname").value("surname2").build()).build()).
+        UserUR userUR = new UserUR.Builder(result.getEntity().getKey()).
+                plainAttr(new AttrPatch.Builder(new AttrTO.Builder("surname").value("surname2").build()).build()).
                 build();
         result = userService.update(userUR).readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
index 4ac01df..d6e416f 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
@@ -114,8 +114,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertTrue(userTO.getResources().isEmpty());
 
         // 2. update assigning a resource forcing mandatory constraints: must fail with RequiredValuesMissing
-        UserUR userUR = new UserUR.Builder().
-                key(userTO.getKey()).
+        UserUR userUR = new UserUR.Builder(userTO.getKey()).
                 password(new PasswordPatch.Builder().value("newPassword123").build()).
                 resource(new StringPatchItem.Builder().
                         operation(PatchOperation.ADD_REPLACE).value(RESOURCE_NAME_WS2).build()).
@@ -269,10 +268,8 @@ public class UserIssuesITCase extends AbstractITCase {
         userCR.getVirAttrs().clear();
         userCR.getAuxClasses().add("csv");
 
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("0626100b-a4ba-4e00-9971-86fad52a6216").build());
-        userCR.getMemberships().add(new MembershipTO.Builder().
-                group("ba9ed509-b1f5-48ab-a334-c8530a6422dc").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("0626100b-a4ba-4e00-9971-86fad52a6216").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("ba9ed509-b1f5-48ab-a334-c8530a6422dc").build());
 
         userCR.getResources().add(RESOURCE_NAME_CSV);
 
@@ -288,11 +285,10 @@ public class UserIssuesITCase extends AbstractITCase {
         // -----------------------------------
         // Remove the first membership: de-provisioning shouldn't happen
         // -----------------------------------
-        UserUR userUR = new UserUR();
-        userUR.setKey(userTO.getKey());
-
-        userUR.getMemberships().add(new MembershipUR.Builder().
-                operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
+        UserUR userUR = new UserUR.Builder(userTO.getKey()).
+                membership(new MembershipUR.Builder(userTO.getMemberships().get(0).getGroupKey()).
+                        operation(PatchOperation.DELETE).build()).
+                build();
 
         userTO = updateUser(userUR).getEntity();
         assertNotNull(userTO);
@@ -323,11 +319,10 @@ public class UserIssuesITCase extends AbstractITCase {
         // -----------------------------------
         // Remove the first membership: de-provisioning should happen
         // -----------------------------------
-        userUR = new UserUR();
-        userUR.setKey(userTO.getKey());
-
-        userUR.getMemberships().add(new MembershipUR.Builder().
-                operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
+        userUR = new UserUR.Builder(userTO.getKey()).
+                membership(new MembershipUR.Builder(userTO.getMemberships().get(0).getGroupKey()).
+                        operation(PatchOperation.DELETE).build()).
+                build();
 
         userTO = updateUser(userUR).getEntity();
         assertNotNull(userTO);
@@ -641,7 +636,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 2. create user with LDAP resource and membership of the above group
         UserCR userCR = UserITCase.getUniqueSample("syncope354@syncope.apache.org");
         userCR.getResources().add(RESOURCE_NAME_LDAP);
-        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(groupTO.getKey()).build());
 
         UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
@@ -657,8 +652,8 @@ public class UserIssuesITCase extends AbstractITCase {
         // 4. remove membership
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
-        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.DELETE).
-                group(userTO.getMemberships().get(0).getGroupKey()).build());
+        userUR.getMemberships().add(new MembershipUR.Builder(userTO.getMemberships().get(0).getGroupKey()).
+                operation(PatchOperation.DELETE).build());
 
         userTO = updateUser(userUR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
@@ -699,7 +694,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userCR.getPlainAttrs().add(attrTO("obscure", "valueToBeObscured"));
         userCR.getPlainAttrs().add(attrTO("photo", Base64.getEncoder().encodeToString(
                 IOUtils.readBytesFromStream(getClass().getResourceAsStream("/favicon.jpg")))));
-        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(groupTO.getKey()).build());
 
         UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
@@ -1304,8 +1299,8 @@ public class UserIssuesITCase extends AbstractITCase {
             // 5. update user with the new group, and don't provide any password
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
-            userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
-                    group(group.getKey()).build());
+            userUR.getMemberships().add(new MembershipUR.Builder(group.getKey()).
+                    operation(PatchOperation.ADD_REPLACE).build());
 
             ProvisioningResult<UserTO> result = updateUser(userUR);
             assertNotNull(result);
@@ -1340,8 +1335,8 @@ public class UserIssuesITCase extends AbstractITCase {
         UserCR userCR = UserITCase.getUniqueSample("syncope710@syncope.apache.org");
         userCR.getResources().clear();
         userCR.getMemberships().clear();
-        userCR.getMemberships().add(new MembershipTO.Builder().group(ldapGroup.getKey()).build());
-        userCR.getMemberships().add(new MembershipTO.Builder().group(dbGroup.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(ldapGroup.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(dbGroup.getKey()).build());
 
         ProvisioningResult<UserTO> result = createUser(userCR);
         assertEquals(2, result.getPropagationStatuses().size());
@@ -1371,7 +1366,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 2. create user and assign such group
         UserCR userCR = UserITCase.getUniqueSample("syncope881U@apache.org");
         userCR.getMemberships().clear();
-        userCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder(group.getKey()).build());
 
         UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
@@ -1405,9 +1400,7 @@ public class UserIssuesITCase extends AbstractITCase {
 
         // 2. create user matching the condition above
         UserCR userCR = UserITCase.getUniqueSample("syncope1099U@apache.org");
-        userCR.getPlainAttrs().stream().
-                filter(attr -> "firstname".equals(attr.getSchema())).findFirst().get().
-                getValues().set(0, "issueSYNCOPE1099");
+        userCR.getPlainAttr("firstname").get().getValues().set(0, "issueSYNCOPE1099");
 
         ProvisioningResult<UserTO> created = createUser(userCR);
         assertNotNull(created);
@@ -1471,7 +1464,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 3. update user to match the dynamic condition: expect propagation to LDAP
         UserUR userUR = new UserUR();
         userUR.setKey(result.getEntity().getKey());
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("cool", "true")).build());
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("cool", "true")).build());
 
         result = updateUser(userUR);
         assertEquals(1, result.getPropagationStatuses().size());
@@ -1480,7 +1473,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 4. update again user to not match the dynamic condition any more: expect propagation to LDAP
         userUR = new UserUR();
         userUR.setKey(result.getEntity().getKey());
-        userUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("cool", "false")).build());
+        userUR.getPlainAttrs().add(new AttrPatch.Builder(attrTO("cool", "false")).build());
 
         result = updateUser(userUR);
         assertEquals(1, result.getPropagationStatuses().size());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
index 90ba42b..b56f9db 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
@@ -110,7 +110,7 @@ public class UserSelfITCase extends AbstractITCase {
         // 1. self-create user with membership: goes 'createApproval' with resources and membership but no propagation
         UserCR userCR = UserITCase.getUniqueSample("anonymous@syncope.apache.org");
         userCR.getMemberships().add(
-                new MembershipTO.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
+                new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
         userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
         SyncopeClient anonClient = clientFactory.create();
@@ -148,7 +148,7 @@ public class UserSelfITCase extends AbstractITCase {
         // 1. self-create user with membership: goes 'createApproval' with resources and membership but no propagation
         UserCR userCR = UserITCase.getUniqueSample("anonymous@syncope.apache.org");
         userCR.getMemberships().add(
-                new MembershipTO.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
+                new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
         userCR.getResources().add(RESOURCE_NAME_TESTDB);
         SyncopeClient anonClient = clientFactory.create();
         UserTO userTO = anonClient.getService(UserSelfService.class).
@@ -252,9 +252,8 @@ public class UserSelfITCase extends AbstractITCase {
         UserUR userUR = new UserUR();
         userUR.setKey(created.getKey());
         userUR.setUsername(new StringReplacePatchItem.Builder().value(created.getUsername() + "XX").build());
-        userUR.getMemberships().add(new MembershipUR.Builder().
+        userUR.getMemberships().add(new MembershipUR.Builder("bf825fe1-7320-4a54-bd64-143b5c18ab97").
                 operation(PatchOperation.ADD_REPLACE).
-                group("bf825fe1-7320-4a54-bd64-143b5c18ab97").
                 build());
         userUR.getResources().add(new StringPatchItem.Builder().
                 operation(PatchOperation.ADD_REPLACE).value(RESOURCE_NAME_TESTDB).build());
@@ -463,7 +462,7 @@ public class UserSelfITCase extends AbstractITCase {
         userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
         // User with group 0cbcabd2-4410-4b6b-8f05-a052b451d18f are defined in workflow as subject to approval
-        userCR.getMemberships().add(new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
         // 1. create user with group 0cbcabd2-4410-4b6b-8f05-a052b451d18f
         UserTO userTO = createUser(userCR).getEntity();
@@ -542,7 +541,7 @@ public class UserSelfITCase extends AbstractITCase {
 
         // User with group 0cbcabd2-4410-4b6b-8f05-a052b451d18f are defined in workflow as subject to approval
         userCR.getMemberships().add(
-                new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
+                new MembershipTO.Builder("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
         // 1. create user and verify that no propagation occurred)
         ProvisioningResult<UserTO> result = createUser(userCR);
@@ -632,7 +631,7 @@ public class UserSelfITCase extends AbstractITCase {
 
         UserUR req = new UserUR();
         req.setKey(created.getKey());
-        req.getMemberships().add(new MembershipUR.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build());
+        req.getMemberships().add(new MembershipUR.Builder("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build());
 
         SyncopeClient client = clientFactory.create(created.getUsername(), "password123");
         Response response = client.getService(UserSelfService.class).update(req);
@@ -707,8 +706,7 @@ public class UserSelfITCase extends AbstractITCase {
         userCR.getMemberships().clear();
 
         // Users with group 0cbcabd2-4410-4b6b-8f05-a052b451d18f are defined in workflow as subject to approval
-        userCR.getMemberships().add(
-                new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
         // 1. create user with group 9 (and verify that no propagation occurred)
         UserTO userTO = createUser(userCR).getEntity();
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java
index 7078432..356c070 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java
@@ -79,8 +79,7 @@ public class VirAttrITCase extends AbstractITCase {
         UserCR userCR = UserITCase.getUniqueSample("issue16@apache.org");
         userCR.getVirAttrs().add(attrTO("virtualdata", "virtualvalue"));
         userCR.getResources().add(RESOURCE_NAME_DBVIRATTR);
-        userCR.getMemberships().add(
-                new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        userCR.getMemberships().add(new MembershipTO.Builder("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user
         UserTO userTO = createUser(userCR).getEntity();
@@ -542,7 +541,7 @@ public class VirAttrITCase extends AbstractITCase {
             userCR.getVirAttrs().clear();
             userCR.getMemberships().clear();
 
-            userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+            userCR.getMemberships().add(new MembershipTO.Builder(groupTO.getKey()).build());
 
             ProvisioningResult<UserTO> result = createUser(userCR);
             assertEquals(2, result.getPropagationStatuses().size());
@@ -684,7 +683,7 @@ public class VirAttrITCase extends AbstractITCase {
             userUR.setKey(userTO.getKey());
             // modify virtual attribute
             userUR.getVirAttrs().add(
-                    new AttrTO.Builder().schema(virSchema.getKey()).
+                    new AttrTO.Builder(virSchema.getKey()).
                             value("test@issue691.dom3.org").
                             value("test@issue691.dom4.org").
                             build());


[syncope] 01/02: [SYNCOPE-1410] Now using [User, Group, AnyObject]CR instead of [\1]TO for create

Posted by il...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git

commit 90d1d931735a9e29e96f735ddaded1d9d24bfa1c
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Tue Dec 11 15:38:12 2018 +0100

    [SYNCOPE-1410] Now using [User,Group,AnyObject]CR instead of [\1]TO for create
---
 .../console/panels/RemediationDirectoryPanel.java  |  28 +-
 .../client/console/rest/AnyObjectRestClient.java   |   5 +-
 .../client/console/rest/GroupRestClient.java       |   5 +-
 .../client/console/rest/RemediationRestClient.java |   7 +-
 .../client/console/rest/UserRestClient.java        |   5 +-
 .../console/status/AnyStatusDirectoryPanel.java    |   6 +-
 .../status/ResourceStatusDirectoryPanel.java       |   3 +-
 .../wizards/any/AnyObjectWizardBuilder.java        |   7 +-
 .../console/wizards/any/GroupWizardBuilder.java    |   7 +-
 .../console/wizards/any/UserWizardBuilder.java     |   8 +-
 .../console/implementations/MyPullActions.groovy   |  26 +-
 .../client/enduser/resources/GroupResource.java    |   4 +-
 .../enduser/resources/UserSelfCreateResource.java  |  19 +-
 .../apache/syncope/common/lib/AnyOperations.java   |  30 +-
 .../apache/syncope/common/lib/EntityTOUtils.java   |  88 ++++
 .../syncope/common/lib/request/AbstractPatch.java  |   2 +-
 .../common/lib/request/{AnyUR.java => AnyCR.java}  | 115 ++---
 .../AnyObjectTO.java => request/AnyObjectCR.java}  |  95 ++++-
 .../syncope/common/lib/request/AnyObjectUR.java    |  20 +-
 .../apache/syncope/common/lib/request/AnyUR.java   |   4 +-
 .../lib/{to/GroupTO.java => request/GroupCR.java}  | 135 +++---
 .../{MembershipPatch.java => MembershipUR.java}    |  12 +-
 ...{RelationshipPatch.java => RelationshipUR.java} |  12 +-
 .../lib/request/{UserUR.java => UserCR.java}       | 148 ++++---
 .../apache/syncope/common/lib/request/UserUR.java  |  20 +-
 .../common/lib/to/AbstractAnnotatedBean.java       |   5 -
 .../apache/syncope/common/lib/to/AnyObjectTO.java  |   1 -
 .../org/apache/syncope/common/lib/to/AnyTO.java    |  14 +-
 .../AttributableReqEntity.java}                    |  13 +-
 .../org/apache/syncope/common/lib/to/GroupTO.java  |   4 -
 .../syncope/common/lib/to/RemediationTO.java       |  11 +-
 .../org/apache/syncope/common/lib/to/UserTO.java   |   9 -
 .../syncope/common/lib/types/AnyTypeKind.java      |  29 +-
 .../org/apache/syncope/common/lib/JSONTest.java    |   3 +-
 .../common/rest/api/service/AnyObjectService.java  |   5 +-
 .../common/rest/api/service/GroupService.java      |   5 +-
 .../rest/api/service/RemediationService.java       |   6 +-
 .../common/rest/api/service/UserSelfService.java   |   8 +-
 .../common/rest/api/service/UserService.java       |  10 +-
 .../syncope/core/logic/AbstractAnyLogic.java       |  46 +-
 .../apache/syncope/core/logic/AnyObjectLogic.java  |   7 +-
 .../org/apache/syncope/core/logic/GroupLogic.java  |   7 +-
 .../syncope/core/logic/RemediationLogic.java       |  16 +-
 .../org/apache/syncope/core/logic/UserLogic.java   |  23 +-
 .../core/persistence/api/entity/AnyUtils.java      |   5 +-
 .../core/persistence/api/entity/Remediation.java   |   8 +-
 .../core/persistence/jpa/entity/JPAAnyUtils.java   |  37 +-
 .../persistence/jpa/entity/JPARemediation.java     |  10 +-
 .../validation/entity/RemediationValidator.java    |   2 +-
 .../api/AnyObjectProvisioningManager.java          |   5 +-
 .../provisioning/api/GroupProvisioningManager.java |   6 +-
 .../core/provisioning/api/LogicActions.java        |   5 +-
 .../core/provisioning/api/ProvisioningManager.java |  14 +-
 .../provisioning/api/UserProvisioningManager.java  |   8 +-
 .../provisioning/api/data/AnyObjectDataBinder.java |   3 +-
 .../provisioning/api/data/GroupDataBinder.java     |   3 +-
 .../core/provisioning/api/data/UserDataBinder.java |   3 +-
 .../provisioning/api/pushpull/PullActions.java     |  47 ++-
 .../java/DefaultAnyObjectProvisioningManager.java  |  12 +-
 .../java/DefaultGroupProvisioningManager.java      |  18 +-
 .../java/DefaultUserProvisioningManager.java       |  23 +-
 .../java/data/AbstractAnyDataBinder.java           |   9 +-
 .../java/data/AnyObjectDataBinderImpl.java         |  21 +-
 .../java/data/GroupDataBinderImpl.java             |  33 +-
 .../java/data/RemediationDataBinderImpl.java       |   4 +-
 .../provisioning/java/data/UserDataBinderImpl.java |  31 +-
 .../provisioning/java/job/SetUMembershipsJob.java  |   8 +-
 .../java/pushpull/AbstractPullResultHandler.java   |  37 +-
 .../java/pushpull/DBPasswordPullActions.java       |  12 +-
 .../DefaultAnyObjectPullResultHandler.java         |  15 +-
 .../pushpull/DefaultGroupPullResultHandler.java    |  15 +-
 .../pushpull/DefaultUserPullResultHandler.java     |  15 +-
 .../java/pushpull/LDAPMembershipPullActions.java   |   4 +-
 .../java/pushpull/LDAPPasswordPullActions.java     |  12 +-
 .../provisioning/java/utils/ConnObjectUtils.java   |  61 +--
 .../provisioning/java/utils/TemplateUtils.java     |  63 ++-
 .../core/rest/cxf/service/AbstractAnyService.java  |   5 +-
 .../rest/cxf/service/AnyObjectServiceImpl.java     |  10 +-
 .../core/rest/cxf/service/GroupServiceImpl.java    |   9 +-
 .../rest/cxf/service/RemediationServiceImpl.java   |   6 +-
 .../core/rest/cxf/service/UserSelfServiceImpl.java |   5 +-
 .../core/rest/cxf/service/UserServiceImpl.java     |   9 +-
 .../workflow/api/AnyObjectWorkflowAdapter.java     |   6 +-
 .../core/workflow/api/GroupWorkflowAdapter.java    |   6 +-
 .../core/workflow/api/UserWorkflowAdapter.java     |  13 +-
 .../java/AbstractAnyObjectWorkflowAdapter.java     |   8 +-
 .../java/AbstractGroupWorkflowAdapter.java         |   8 +-
 .../workflow/java/AbstractUserWorkflowAdapter.java |  15 +-
 .../java/DefaultAnyObjectWorkflowAdapter.java      |   6 +-
 .../workflow/java/DefaultGroupWorkflowAdapter.java |   6 +-
 .../workflow/java/DefaultUserWorkflowAdapter.java  |   9 +-
 .../camel/CamelAnyObjectProvisioningManager.java   |  10 +-
 .../camel/CamelGroupProvisioningManager.java       |  10 +-
 .../camel/CamelUserProvisioningManager.java        |  19 +-
 .../camel/producer/CreateProducer.java             |  26 +-
 .../src/main/resources/userRoutes.xml              |   2 +-
 .../core/flowable/impl/FlowableRuntimeUtils.java   |   4 +-
 .../flowable/impl/FlowableUserWorkflowAdapter.java |  20 +-
 .../core/flowable/impl/FlowableWorkflowUtils.java  |   2 -
 .../apache/syncope/core/flowable/task/Create.java  |   7 +-
 .../syncope/core/logic/oidc/OIDCUserManager.java   |  21 +-
 .../core/provisioning/api/OIDCProviderActions.java |   4 +-
 .../java/DefaultOIDCProviderActions.java           |  48 ---
 .../syncope/core/logic/saml2/SAML2UserManager.java |  21 +-
 .../core/provisioning/api/SAML2IdPActions.java     |   3 +-
 .../apache/syncope/core/logic/SCIMDataBinder.java  | 111 ++---
 .../ext/scimv2/cxf/service/AbstractService.java    |   5 +-
 .../ext/scimv2/cxf/service/GroupServiceImpl.java   |  10 +-
 .../ext/scimv2/cxf/service/UserServiceImpl.java    |   2 +-
 .../reference/flowable/AssignDirectorGroup.java    |   4 +-
 .../reference/flowable/CreateARelationship.java    |   4 +-
 .../fit/core/reference/TestPullActions.java        |  33 +-
 .../org/apache/syncope/fit/AbstractITCase.java     |  27 +-
 .../apache/syncope/fit/core/AnyObjectITCase.java   |  61 ++-
 .../syncope/fit/core/AuthenticationITCase.java     |  67 +--
 .../org/apache/syncope/fit/core/BatchITCase.java   |  39 +-
 .../apache/syncope/fit/core/CamelRouteITCase.java  |  29 +-
 .../apache/syncope/fit/core/DynRealmITCase.java    |  32 +-
 .../syncope/fit/core/ExceptionMapperITCase.java    |  28 +-
 .../org/apache/syncope/fit/core/GroupITCase.java   | 213 +++++-----
 .../apache/syncope/fit/core/MembershipITCase.java  |  92 ++--
 .../syncope/fit/core/MultitenancyITCase.java       |  15 +-
 .../syncope/fit/core/NotificationTaskITCase.java   |   9 +-
 .../apache/syncope/fit/core/PlainSchemaITCase.java |  33 +-
 .../syncope/fit/core/PropagationTaskITCase.java    |  30 +-
 .../apache/syncope/fit/core/PullTaskITCase.java    | 152 +++----
 .../apache/syncope/fit/core/PushTaskITCase.java    |  13 +-
 .../org/apache/syncope/fit/core/RESTITCase.java    |   9 +-
 .../syncope/fit/core/ReconciliationITCase.java     |  13 +-
 .../apache/syncope/fit/core/ResourceITCase.java    |  20 +-
 .../org/apache/syncope/fit/core/SCIMITCase.java    |   2 +-
 .../org/apache/syncope/fit/core/SearchITCase.java  |  35 +-
 .../org/apache/syncope/fit/core/UserITCase.java    | 425 ++++++++++---------
 .../apache/syncope/fit/core/UserIssuesITCase.java  | 463 +++++++++++----------
 .../apache/syncope/fit/core/UserRequestITCase.java |   6 +-
 .../apache/syncope/fit/core/UserSelfITCase.java    |  78 ++--
 .../org/apache/syncope/fit/core/VirAttrITCase.java | 157 +++----
 .../test/resources/DoubleValueLogicActions.groovy  |   4 +-
 138 files changed, 2230 insertions(+), 1891 deletions(-)

diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
index ad628a4..4342c71 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java
@@ -52,10 +52,14 @@ import org.apache.syncope.client.console.wizards.any.AnyWrapper;
 import org.apache.syncope.client.console.wizards.any.GroupWizardBuilder;
 import org.apache.syncope.client.console.wizards.any.UserWizardBuilder;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -191,7 +195,8 @@ public class RemediationDirectoryPanel
                             UserTO newUserTO;
                             UserTO previousUserTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newUserTO = (UserTO) remediationTO.getAnyTOPayload();
+                                newUserTO = new UserTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newUserTO);
                                 previousUserTO = null;
                             } else {
                                 previousUserTO = new UserRestClient().
@@ -217,7 +222,8 @@ public class RemediationDirectoryPanel
                             GroupTO newGroupTO;
                             GroupTO previousGroupTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newGroupTO = (GroupTO) remediationTO.getAnyTOPayload();
+                                newGroupTO = new GroupTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newGroupTO);
                                 previousGroupTO = null;
                             } else {
                                 previousGroupTO = new GroupRestClient().
@@ -243,7 +249,8 @@ public class RemediationDirectoryPanel
                             AnyObjectTO newAnyObjectTO;
                             AnyObjectTO previousAnyObjectTO;
                             if (remediationTO.getAnyURPayload() == null) {
-                                newAnyObjectTO = (AnyObjectTO) remediationTO.getAnyTOPayload();
+                                newAnyObjectTO = new AnyObjectTO();
+                                EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newAnyObjectTO);
                                 previousAnyObjectTO = null;
                             } else {
                                 previousAnyObjectTO = new AnyObjectRestClient().
@@ -371,7 +378,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<UserTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                UserCR req = new UserCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 UserUR req = AnyOperations.diff(inner, previousUserTO, false);
 
@@ -423,7 +433,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<GroupTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                GroupCR req = new GroupCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 GroupUR req = AnyOperations.diff(inner, previousGroupTO, false);
 
@@ -468,7 +481,10 @@ public class RemediationDirectoryPanel
             ProvisioningResult<AnyObjectTO> result;
 
             if (remediationTO.getAnyURPayload() == null) {
-                result = restClient.remedy(remediationTO.getKey(), inner);
+                AnyObjectCR req = new AnyObjectCR();
+                EntityTOUtils.toAnyCR(inner, req);
+
+                result = restClient.remedy(remediationTO.getKey(), req);
             } else {
                 AnyObjectUR req = AnyOperations.diff(inner, previousAnyObjectTO, false);
 
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
index c2e71f6..9b47662 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/AnyObjectRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -41,8 +42,8 @@ public class AnyObjectRestClient extends AbstractAnyRestClient<AnyObjectTO> {
         return AnyObjectService.class;
     }
 
-    public ProvisioningResult<AnyObjectTO> create(final AnyObjectTO anyObjectTO) {
-        Response response = getService(AnyObjectService.class).create(anyObjectTO);
+    public ProvisioningResult<AnyObjectTO> create(final AnyObjectCR createReq) {
+        Response response = getService(AnyObjectService.class).create(createReq);
         return response.readEntity(new GenericType<ProvisioningResult<AnyObjectTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
index f5bd6c3..cea9301 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -42,8 +43,8 @@ public class GroupRestClient extends AbstractAnyRestClient<GroupTO> {
         return GroupService.class;
     }
 
-    public ProvisioningResult<GroupTO> create(final GroupTO groupTO) {
-        Response response = getService(GroupService.class).create(groupTO);
+    public ProvisioningResult<GroupTO> create(final GroupCR groupCR) {
+        Response response = getService(GroupService.class).create(groupCR);
         return response.readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
index 30fb1b1..d2f2074 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java
@@ -21,6 +21,7 @@ package org.apache.syncope.client.console.rest;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -49,9 +50,9 @@ public class RemediationRestClient extends BaseRestClient {
         return getService(RemediationService.class).read(key);
     }
 
-    public <T extends AnyTO> ProvisioningResult<T> remedy(final String key, final T anyTO) {
-        Response response = getService(RemediationService.class).remedy(key, anyTO);
-        return response.readEntity(new GenericType<ProvisioningResult<T>>() {
+    public <C extends AnyCR, A extends AnyTO> ProvisioningResult<A> remedy(final String key, final C anyCR) {
+        Response response = getService(RemediationService.class).remedy(key, anyCR);
+        return response.readEntity(new GenericType<ProvisioningResult<A>>() {
         });
     }
 
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
index 223e37f..4ff2bca 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/UserRestClient.java
@@ -29,6 +29,7 @@ import org.apache.syncope.client.console.commons.status.StatusBean;
 import org.apache.syncope.client.console.commons.status.StatusUtils;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -51,8 +52,8 @@ public class UserRestClient extends AbstractAnyRestClient<UserTO> {
         return UserService.class;
     }
 
-    public ProvisioningResult<UserTO> create(final UserTO userTO, final boolean storePassword) {
-        Response response = getService(UserService.class).create(userTO, storePassword);
+    public ProvisioningResult<UserTO> create(final UserCR createReq) {
+        Response response = getService(UserService.class).create(createReq);
         return response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
         });
     }
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
index fe67ff6..d8f103b 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java
@@ -293,8 +293,7 @@ public class AnyStatusDirectoryPanel
                             getReconStatuses(anyTypeKind, anyTO.getKey(), Arrays.asList(resource));
                 }
 
-                return StatusUtils.getStatusBean(
-                        actual,
+                return StatusUtils.getStatusBean(actual,
                         resource,
                         statuses.isEmpty() ? null : statuses.get(0).getRight().getOnResource(),
                         actual instanceof GroupTO);
@@ -334,8 +333,7 @@ public class AnyStatusDirectoryPanel
                 statusBeans.addAll(resources.stream().
                         filter(resource -> !anyTO.getResources().contains(resource)).
                         map(resource -> {
-                            StatusBean statusBean = StatusUtils.getStatusBean(
-                                    actual,
+                            StatusBean statusBean = StatusUtils.getStatusBean(actual,
                                     resource,
                                     null,
                                     actual instanceof GroupTO);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
index bba8d2f..e3bdd0b 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java
@@ -280,8 +280,7 @@ public class ResourceStatusDirectoryPanel
                 List<? extends AnyTO> result = restClient.search(
                         SyncopeConstants.ROOT_REALM, fiql, (page < 0 ? 0 : page) + 1, paginatorRows, getSort(), type);
 
-                statusBeans.addAll(result.stream().map(any -> StatusUtils.getStatusBean(
-                        any,
+                statusBeans.addAll(result.stream().map(any -> StatusUtils.getStatusBean(any,
                         resource.getKey(),
                         null,
                         any instanceof GroupTO)).collect(Collectors.toList()));
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
index 12b9dea..1d63ea9 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyObjectWizardBuilder.java
@@ -25,6 +25,8 @@ import org.apache.syncope.client.console.layout.AnyObjectFormLayoutInfo;
 import org.apache.syncope.client.console.rest.AnyObjectRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -70,7 +72,10 @@ public class AnyObjectWizardBuilder extends AnyWizardBuilder<AnyObjectTO> implem
 
         ProvisioningResult<AnyObjectTO> result;
         if (inner.getKey() == null) {
-            result = anyObjectRestClient.create(inner);
+            AnyObjectCR req = new AnyObjectCR();
+            EntityTOUtils.toAnyCR(inner, req);
+
+            result = anyObjectRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             AnyObjectUR req = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
index dbbde35..575f6bc 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/GroupWizardBuilder.java
@@ -28,6 +28,8 @@ import org.apache.syncope.client.console.rest.GroupRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.client.console.wizards.AjaxWizardBuilder;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -89,7 +91,10 @@ public class GroupWizardBuilder extends AnyWizardBuilder<GroupTO> implements Gro
 
         ProvisioningResult<GroupTO> result;
         if (inner.getKey() == null) {
-            result = groupRestClient.create(inner);
+            GroupCR req = new GroupCR();
+            EntityTOUtils.toAnyCR(inner, req);
+
+            result = groupRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             GroupUR groupUR = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
index c95cb5b..8201ec1 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserWizardBuilder.java
@@ -26,7 +26,9 @@ import org.apache.syncope.client.console.layout.UserFormLayoutInfo;
 import org.apache.syncope.client.console.rest.UserRestClient;
 import org.apache.syncope.client.console.wizards.AjaxWizard;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -78,9 +80,13 @@ public class UserWizardBuilder extends AnyWizardBuilder<UserTO> implements UserF
 
         ProvisioningResult<UserTO> result;
         if (inner.getKey() == null) {
-            result = userRestClient.create(inner, modelObject instanceof UserWrapper
+            UserCR req = new UserCR();
+            EntityTOUtils.toAnyCR(inner, req);
+            req.setStorePassword(modelObject instanceof UserWrapper
                     ? UserWrapper.class.cast(modelObject).isStorePasswordInSyncope()
                     : StringUtils.isNotBlank(inner.getPassword()));
+
+            result = userRestClient.create(req);
         } else {
             fixPlainAndVirAttrs(inner, getOriginalItem().getInnerObject());
             UserUR userUR = AnyOperations.diff(inner, getOriginalItem().getInnerObject(), false);
diff --git a/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy b/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
index 125d527..5de8a22 100644
--- a/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
+++ b/client/console/src/main/resources/org/apache/syncope/client/console/implementations/MyPullActions.groovy
@@ -17,8 +17,10 @@
  * under the License.
  */
 import groovy.transform.CompileStatic
+import org.apache.syncope.common.lib.request.AnyCR
 import org.apache.syncope.common.lib.request.AnyUR
 import org.apache.syncope.common.lib.to.EntityTO
+import org.apache.syncope.common.lib.to.RealmTO
 import org.apache.syncope.core.persistence.api.entity.task.ProvisioningTask
 import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningActions
@@ -40,7 +42,15 @@ class MyPullActions implements PullActions {
   void beforeProvision(
     ProvisioningProfile profile,
     SyncDelta delta,
-    EntityTO entity) throws JobExecutionException {
+    AnyCR anyCR) throws JobExecutionException {
+
+  }
+
+  @Override
+  void beforeProvision(
+    ProvisioningProfile profile,
+    SyncDelta delta,
+    RealmTO realmTO) throws JobExecutionException {
 
   }
 
@@ -48,7 +58,15 @@ class MyPullActions implements PullActions {
   void beforeAssign(
     ProvisioningProfile profile,
     SyncDelta delta,
-    EntityTO entity) throws JobExecutionException {
+    AnyCR anyCR) throws JobExecutionException {
+
+  }
+
+  @Override
+  void beforeAssign(
+    ProvisioningProfile profile,
+    SyncDelta delta,
+    RealmTO realmTO) throws JobExecutionException {
 
   }
 
@@ -85,11 +103,11 @@ class MyPullActions implements PullActions {
   }
 
   @Override
-  <R extends AnyUR> void beforeUpdate(
+  void beforeUpdate(
     ProvisioningProfile profile,
     SyncDelta delta,
     EntityTO entity,
-    R anyUR) throws JobExecutionException {
+    AnyUR anyUR) throws JobExecutionException {
 
   }
 
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
index 14fb790..d2b7a20 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/GroupResource.java
@@ -75,8 +75,8 @@ public class GroupResource extends BaseResource {
                         1,
                         30).getResult();
                 groupResponse.setTotGroups(totGroups);
-                groupResponse.setGroupTOs(groupTOs.stream().collect(
-                        Collectors.toMap(GroupTO::getKey, GroupTO::getName)));
+                groupResponse.setGroupTOs(groupTOs.stream().
+                        collect(Collectors.toMap(GroupTO::getKey, GroupTO::getName)));
             } else {
                 groupResponse.setTotGroups(0);
                 Map<String, String> groups = new HashMap<>();
diff --git a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
index acc1577..41be448 100644
--- a/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
+++ b/client/enduser/src/main/java/org/apache/syncope/client/enduser/resources/UserSelfCreateResource.java
@@ -30,6 +30,7 @@ import org.apache.syncope.client.enduser.SyncopeEnduserSession;
 import org.apache.syncope.client.enduser.annotations.Resource;
 import org.apache.syncope.client.enduser.util.Validation;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -165,8 +166,22 @@ public class UserSelfCreateResource extends BaseUserSelfResource {
                     LOG.trace("Received user self registration request is: [{}]", userTO);
 
                     // adapt request and create user
-                    final Response res = SyncopeEnduserSession.get().getService(UserSelfService.class).create(userTO,
-                            true);
+                    UserCR req = new UserCR.Builder().
+                            realm(userTO.getRealm()).
+                            username(userTO.getUsername()).
+                            password(userTO.getPassword()).
+                            mustChangePassword(userTO.isMustChangePassword()).
+                            securityQuestion(userTO.getSecurityQuestion()).
+                            securityAnswer(userTO.getSecurityAnswer()).
+                            auxClasses(userTO.getAuxClasses()).
+                            plainAttrs(userTO.getPlainAttrs()).
+                            virAttrs(userTO.getVirAttrs()).
+                            memberships(userTO.getMemberships()).
+                            relationships(userTO.getRelationships()).
+                            roles(userTO.getRoles()).
+                            resources(userTO.getResources()).
+                            build();
+                    Response res = SyncopeEnduserSession.get().getService(UserSelfService.class).create(req);
 
                     buildResponse(response, res.getStatus(),
                             Response.Status.Family.SUCCESSFUL.equals(res.getStatusInfo().getFamily())
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
index 59d8ac2..0f9cb00 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
@@ -31,9 +31,9 @@ import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
-import org.apache.syncope.common.lib.request.RelationshipPatch;
+import org.apache.syncope.common.lib.request.RelationshipUR;
 import org.apache.syncope.common.lib.request.AbstractReplacePatchItem;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.StringPatchItem;
@@ -189,7 +189,7 @@ public final class AnyOperations {
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
                 forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipPatch.Builder().
+                    result.getRelationships().add(new RelationshipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).
                             relationshipTO(entry.getValue()).build());
                 });
@@ -197,7 +197,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipPatch.Builder().
+                        result.getRelationships().add(new RelationshipUR.Builder().
                                 operation(PatchOperation.DELETE).
                                 relationshipTO(originalRels.get(key)).build());
                     });
@@ -208,7 +208,7 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().
+            MembershipUR membershipPatch = new MembershipUR.Builder().
                     operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
 
             diff(value, membershipPatch);
@@ -223,7 +223,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipPatch.Builder().
+                        result.getMemberships().add(new MembershipUR.Builder().
                                 operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
                     });
         }
@@ -233,7 +233,7 @@ public final class AnyOperations {
 
     private static void diff(
             final MembershipTO updated,
-            final MembershipPatch result) {
+            final MembershipUR result) {
 
         // 1. plain attributes
         result.getPlainAttrs().addAll(updated.getPlainAttrs().stream().
@@ -311,7 +311,7 @@ public final class AnyOperations {
         updatedRels.entrySet().stream().
                 filter(entry -> (!originalRels.containsKey(entry.getKey()))).
                 forEachOrdered(entry -> {
-                    result.getRelationships().add(new RelationshipPatch.Builder().
+                    result.getRelationships().add(new RelationshipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).
                             relationshipTO(entry.getValue()).build());
                 });
@@ -319,7 +319,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalRels.keySet().stream().filter(relationship -> !updatedRels.containsKey(relationship)).
                     forEach(key -> {
-                        result.getRelationships().add(new RelationshipPatch.Builder().
+                        result.getRelationships().add(new RelationshipUR.Builder().
                                 operation(PatchOperation.DELETE).
                                 relationshipTO(originalRels.get(key)).build());
                     });
@@ -330,7 +330,7 @@ public final class AnyOperations {
         Map<String, MembershipTO> originalMembs = EntityTOUtils.buildMembershipMap(original.getMemberships());
 
         updatedMembs.forEach((key, value) -> {
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().
+            MembershipUR membershipPatch = new MembershipUR.Builder().
                     operation(PatchOperation.ADD_REPLACE).group(value.getGroupKey()).build();
 
             diff(value, membershipPatch);
@@ -345,7 +345,7 @@ public final class AnyOperations {
         if (!incremental) {
             originalMembs.keySet().stream().filter(membership -> !updatedMembs.containsKey(membership)).
                     forEach(key -> {
-                        result.getMemberships().add(new MembershipPatch.Builder().
+                        result.getMemberships().add(new MembershipUR.Builder().
                                 operation(PatchOperation.DELETE).group(originalMembs.get(key).getGroupKey()).build());
                     });
         }
@@ -511,7 +511,7 @@ public final class AnyOperations {
         anyObjectUR.getRelationships().
                 forEach(relPatch -> {
                     if (relPatch.getRelationshipTO() == null) {
-                        LOG.warn("Invalid {} specified: {}", RelationshipPatch.class.getName(), relPatch);
+                        LOG.warn("Invalid {} specified: {}", RelationshipUR.class.getName(), relPatch);
                     } else {
                         result.getRelationships().remove(relPatch.getRelationshipTO());
                         if (relPatch.getOperation() == PatchOperation.ADD_REPLACE) {
@@ -524,7 +524,7 @@ public final class AnyOperations {
         anyObjectUR.getMemberships().
                 forEach(membPatch -> {
                     if (membPatch.getGroup() == null) {
-                        LOG.warn("Invalid {} specified: {}", MembershipPatch.class.getName(), membPatch);
+                        LOG.warn("Invalid {} specified: {}", MembershipUR.class.getName(), membPatch);
                     } else {
                         result.getMemberships().stream().
                                 filter(membership -> membPatch.getGroup().equals(membership.getGroupKey())).
@@ -566,7 +566,7 @@ public final class AnyOperations {
         userUR.getRelationships().
                 forEach(relPatch -> {
                     if (relPatch.getRelationshipTO() == null) {
-                        LOG.warn("Invalid {} specified: {}", RelationshipPatch.class.getName(), relPatch);
+                        LOG.warn("Invalid {} specified: {}", RelationshipUR.class.getName(), relPatch);
                     } else {
                         result.getRelationships().remove(relPatch.getRelationshipTO());
                         if (relPatch.getOperation() == PatchOperation.ADD_REPLACE) {
@@ -579,7 +579,7 @@ public final class AnyOperations {
         userUR.getMemberships().
                 forEach(membPatch -> {
                     if (membPatch.getGroup() == null) {
-                        LOG.warn("Invalid {} specified: {}", MembershipPatch.class.getName(), membPatch);
+                        LOG.warn("Invalid {} specified: {}", MembershipUR.class.getName(), membPatch);
                     } else {
                         result.getMemberships().stream().
                                 filter(membership -> membPatch.getGroup().equals(membership.getGroupKey())).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java b/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
index e5b2bee..d085a19 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java
@@ -23,9 +23,17 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
+import org.apache.syncope.common.lib.to.AnyObjectTO;
+import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.RelationshipTO;
+import org.apache.syncope.common.lib.to.UserTO;
 
 public final class EntityTOUtils {
 
@@ -52,6 +60,86 @@ public final class EntityTOUtils {
         return Collections.unmodifiableMap(result);
     }
 
+    public static <A extends AnyTO, C extends AnyCR> void toAnyCR(final A anyTO, final C anyCR) {
+        anyCR.setRealm(anyTO.getRealm());
+        anyCR.getAuxClasses().addAll(anyTO.getAuxClasses());
+        anyCR.getPlainAttrs().addAll(anyTO.getPlainAttrs());
+        anyCR.getVirAttrs().addAll(anyTO.getVirAttrs());
+        anyCR.getResources().addAll(anyTO.getResources());
+
+        if (anyCR instanceof UserCR && anyTO instanceof UserTO) {
+            UserCR userCR = (UserCR) anyCR;
+            UserTO userTO = (UserTO) anyTO;
+
+            userCR.setUsername(userTO.getUsername());
+            userCR.setPassword(userTO.getPassword());
+            userCR.setSecurityQuestion(userTO.getSecurityQuestion());
+            userCR.setSecurityAnswer(userTO.getSecurityAnswer());
+            userCR.setMustChangePassword(userTO.isMustChangePassword());
+            userCR.getRelationships().addAll(userTO.getRelationships());
+            userCR.getMemberships().addAll(userTO.getMemberships());
+            userCR.getRoles().addAll(userTO.getRoles());
+        } else if (anyCR instanceof GroupCR && anyTO instanceof GroupTO) {
+            GroupCR groupCR = (GroupCR) anyCR;
+            GroupTO groupTO = (GroupTO) anyTO;
+
+            groupCR.setName(groupTO.getName());
+            groupCR.setUserOwner(groupTO.getUserOwner());
+            groupCR.setGroupOwner(groupTO.getGroupOwner());
+            groupCR.setUDynMembershipCond(groupTO.getUDynMembershipCond());
+            groupCR.getADynMembershipConds().putAll(groupTO.getADynMembershipConds());
+            groupCR.getTypeExtensions().addAll(groupTO.getTypeExtensions());
+        } else if (anyCR instanceof AnyObjectCR && anyTO instanceof AnyObjectTO) {
+            AnyObjectCR anyObjectCR = (AnyObjectCR) anyCR;
+            AnyObjectTO anyObjectTO = (AnyObjectTO) anyTO;
+
+            anyObjectCR.setType(anyObjectTO.getType());
+            anyObjectCR.setName(anyObjectTO.getName());
+            anyObjectCR.getRelationships().addAll(anyObjectTO.getRelationships());
+            anyObjectCR.getMemberships().addAll(anyObjectTO.getMemberships());
+        }
+    }
+
+    public static <C extends AnyCR, A extends AnyTO> void toAnyTO(final C anyCR, final A anyTO) {
+        anyTO.setRealm(anyCR.getRealm());
+        anyTO.getAuxClasses().addAll(anyCR.getAuxClasses());
+        anyTO.getPlainAttrs().addAll(anyCR.getPlainAttrs());
+        anyTO.getVirAttrs().addAll(anyCR.getVirAttrs());
+        anyTO.getResources().addAll(anyCR.getResources());
+
+        if (anyTO instanceof UserTO && anyCR instanceof UserCR) {
+            UserTO userTO = (UserTO) anyTO;
+            UserCR userCR = (UserCR) anyCR;
+
+            userTO.setUsername(userCR.getUsername());
+            userTO.setPassword(userCR.getPassword());
+            userTO.setSecurityQuestion(userCR.getSecurityQuestion());
+            userTO.setSecurityAnswer(userCR.getSecurityAnswer());
+            userTO.setMustChangePassword(userCR.isMustChangePassword());
+            userTO.getRelationships().addAll(userCR.getRelationships());
+            userTO.getMemberships().addAll(userCR.getMemberships());
+            userTO.getRoles().addAll(userCR.getRoles());
+        } else if (anyTO instanceof GroupTO && anyCR instanceof GroupCR) {
+            GroupTO groupTO = (GroupTO) anyTO;
+            GroupCR groupCR = (GroupCR) anyCR;
+
+            groupTO.setName(groupCR.getName());
+            groupTO.setUserOwner(groupCR.getUserOwner());
+            groupTO.setGroupOwner(groupCR.getGroupOwner());
+            groupTO.setUDynMembershipCond(groupCR.getUDynMembershipCond());
+            groupTO.getADynMembershipConds().putAll(groupCR.getADynMembershipConds());
+            groupTO.getTypeExtensions().addAll(groupCR.getTypeExtensions());
+        } else if (anyTO instanceof AnyObjectTO && anyCR instanceof AnyObjectCR) {
+            AnyObjectTO anyObjectTO = (AnyObjectTO) anyTO;
+            AnyObjectCR anyObjectCR = (AnyObjectCR) anyCR;
+
+            anyObjectTO.setType(anyObjectCR.getType());
+            anyObjectTO.setName(anyObjectCR.getName());
+            anyObjectTO.getRelationships().addAll(anyObjectCR.getRelationships());
+            anyObjectTO.getMemberships().addAll(anyObjectCR.getMemberships());
+        }
+    }
+
     /**
      * Private default constructor, for static-only classes.
      */
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
index 8d86659..357f92f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AbstractPatch.java
@@ -26,7 +26,7 @@ import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.types.PatchOperation;
 
 @XmlType
-@XmlSeeAlso({ AbstractPatchItem.class, AttrPatch.class, MembershipPatch.class, RelationshipPatch.class })
+@XmlSeeAlso({ AbstractPatchItem.class, AttrPatch.class, MembershipUR.class, RelationshipUR.class })
 public abstract class AbstractPatch implements Serializable {
 
     private static final long serialVersionUID = -4729181508529829580L;
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
similarity index 73%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
index d0befda..49efeb1 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyCR.java
@@ -26,9 +26,10 @@ import io.swagger.v3.oas.annotations.media.Schema;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
+import java.util.Optional;
 import java.util.Set;
-import javax.ws.rs.PathParam;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlSeeAlso;
@@ -37,17 +38,18 @@ import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.AttributableReqEntity;
 
 @XmlType
 @XmlSeeAlso({ UserUR.class, GroupUR.class, AnyObjectUR.class })
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
-@JsonPropertyOrder(value = { "@class", "key" })
-@Schema(subTypes = { UserUR.class, GroupUR.class, AnyObjectUR.class }, discriminatorProperty = "@class")
-public abstract class AnyUR implements Serializable, AttributableUR {
+@JsonPropertyOrder(value = { "@class" })
+@Schema(subTypes = { UserCR.class, GroupCR.class, AnyObjectCR.class }, discriminatorProperty = "@class")
+public abstract class AnyCR implements Serializable, AttributableReqEntity {
 
-    private static final long serialVersionUID = -7445489774552440544L;
+    private static final long serialVersionUID = -1180587903919947455L;
 
-    protected abstract static class Builder<R extends AnyUR, B extends Builder<R, B>> {
+    protected abstract static class Builder<R extends AnyCR, B extends Builder<R, B>> {
 
         protected R instance;
 
@@ -61,49 +63,43 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         }
 
         @SuppressWarnings("unchecked")
-        public B key(final String key) {
-            getInstance().setKey(key);
-            return (B) this;
-        }
-
-        @SuppressWarnings("unchecked")
-        public B realm(final StringReplacePatchItem realm) {
+        public B realm(final String realm) {
             getInstance().setRealm(realm);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClass(final StringPatchItem auxClass) {
+        public B auxClass(final String auxClass) {
             getInstance().getAuxClasses().add(auxClass);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClasses(final StringPatchItem... auxClasses) {
+        public B auxClasses(final String... auxClasses) {
             getInstance().getAuxClasses().addAll(Arrays.asList(auxClasses));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B auxClasses(final Collection<StringPatchItem> auxClasses) {
+        public B auxClasses(final Collection<String> auxClasses) {
             getInstance().getAuxClasses().addAll(auxClasses);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttr(final AttrPatch plainAttr) {
+        public B plainAttr(final AttrTO plainAttr) {
             getInstance().getPlainAttrs().add(plainAttr);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttrs(final AttrPatch... plainAttrs) {
+        public B plainAttrs(final AttrTO... plainAttrs) {
             getInstance().getPlainAttrs().addAll(Arrays.asList(plainAttrs));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B plainAttrs(final Collection<AttrPatch> plainAttrs) {
+        public B plainAttrs(final Collection<AttrTO> plainAttrs) {
             getInstance().getPlainAttrs().addAll(plainAttrs);
             return (B) this;
         }
@@ -127,19 +123,19 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         }
 
         @SuppressWarnings("unchecked")
-        public B resource(final StringPatchItem resource) {
+        public B resource(final String resource) {
             getInstance().getResources().add(resource);
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B resources(final StringPatchItem... resources) {
+        public B resources(final String... resources) {
             getInstance().getResources().addAll(Arrays.asList(resources));
             return (B) this;
         }
 
         @SuppressWarnings("unchecked")
-        public B resources(final Collection<StringPatchItem> resources) {
+        public B resources(final Collection<String> resources) {
             getInstance().getResources().addAll(resources);
             return (B) this;
         }
@@ -153,17 +149,15 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @JsonProperty("@class")
     private String discriminator;
 
-    private String key;
-
-    private StringReplacePatchItem realm;
+    private String realm;
 
-    private final Set<StringPatchItem> auxClasses = new HashSet<>();
+    private final Set<String> auxClasses = new HashSet<>();
 
-    private final Set<AttrPatch> plainAttrs = new HashSet<>();
+    private final Set<AttrTO> plainAttrs = new HashSet<>();
 
     private final Set<AttrTO> virAttrs = new HashSet<>();
 
-    private final Set<StringPatchItem> resources = new HashSet<>();
+    private final Set<String> resources = new HashSet<>();
 
     @Schema(name = "@class", required = true)
     public abstract String getDiscriminator();
@@ -174,38 +168,57 @@ public abstract class AnyUR implements Serializable, AttributableUR {
 
     @JsonProperty(required = true)
     @XmlElement(required = true)
-    public String getKey() {
-        return key;
-    }
-
-    @PathParam("key")
-    public void setKey(final String key) {
-        this.key = key;
-    }
-
-    public StringReplacePatchItem getRealm() {
+    @Override
+    public String getRealm() {
         return realm;
     }
 
-    public void setRealm(final StringReplacePatchItem realm) {
+    @Override
+    public void setRealm(final String realm) {
         this.realm = realm;
     }
 
     @XmlElementWrapper(name = "auxClasses")
-    @XmlElement(name = "auxClass")
+    @XmlElement(name = "class")
     @JsonProperty("auxClasses")
-    public Set<StringPatchItem> getAuxClasses() {
+    @Override
+    public Set<String> getAuxClasses() {
         return auxClasses;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getPlainAttr(final String schema) {
+        return plainAttrs.stream().filter(attr -> attr.getSchema().equals(schema)).findFirst();
+    }
+
     @XmlElementWrapper(name = "plainAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("plainAttrs")
     @Override
-    public Set<AttrPatch> getPlainAttrs() {
+    public Set<AttrTO> getPlainAttrs() {
         return plainAttrs;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getDerAttr(final String schema) {
+        return Optional.empty();
+    }
+
+    @XmlTransient
+    @JsonIgnore
+    @Override
+    public Set<AttrTO> getDerAttrs() {
+        return Collections.emptySet();
+    }
+
+    @JsonIgnore
+    @Override
+    public Optional<AttrTO> getVirAttr(final String schema) {
+        return virAttrs.stream().filter(attr -> attr.getSchema().equals(schema)).findFirst();
+    }
+
     @XmlElementWrapper(name = "virAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("virAttrs")
@@ -217,26 +230,15 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "resources")
     @XmlElement(name = "resource")
     @JsonProperty("resources")
-    public Set<StringPatchItem> getResources() {
+    @Override
+    public Set<String> getResources() {
         return resources;
     }
 
-    /**
-     * @return true if no actual changes are defined
-     */
-    @JsonIgnore
-    public boolean isEmpty() {
-        return realm == null
-                && auxClasses.isEmpty()
-                && plainAttrs.isEmpty() && virAttrs.isEmpty()
-                && resources.isEmpty();
-    }
-
     @Override
     public int hashCode() {
         return new HashCodeBuilder().
                 append(discriminator).
-                append(key).
                 append(realm).
                 append(auxClasses).
                 append(plainAttrs).
@@ -256,10 +258,9 @@ public abstract class AnyUR implements Serializable, AttributableUR {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final AnyUR other = (AnyUR) obj;
+        final AnyCR other = (AnyCR) obj;
         return new EqualsBuilder().
                 append(discriminator, other.discriminator).
-                append(key, other.key).
                 append(realm, other.realm).
                 append(auxClasses, other.auxClasses).
                 append(plainAttrs, other.plainAttrs).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
similarity index 59%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
index a2b6a44..a833034 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectCR.java
@@ -16,28 +16,84 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.to;
+package org.apache.syncope.common.lib.request;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
+import org.apache.syncope.common.lib.to.GroupableRelatableTO;
+import org.apache.syncope.common.lib.to.MembershipTO;
+import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "anyObject")
+@XmlRootElement(name = "anyObjectCR")
 @XmlType
-@Schema(allOf = { AnyTO.class })
-public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
+@JsonPropertyOrder(value = { "@class", "name" })
+@Schema(allOf = { AnyCR.class })
+public class AnyObjectCR extends AnyCR implements GroupableRelatableTO {
 
-    private static final long serialVersionUID = 8841697496476959639L;
+    private static final long serialVersionUID = 5460996992553869226L;
+
+    public static class Builder extends AnyCR.Builder<AnyObjectCR, Builder> {
+
+        @Override
+        protected AnyObjectCR newInstance() {
+            return new AnyObjectCR();
+        }
+
+        public Builder(final String type) {
+            getInstance().setType(type);
+        }
+
+        public Builder name(final String name) {
+            getInstance().setName(name);
+            return this;
+        }
+
+        public Builder relationship(final RelationshipTO relationship) {
+            getInstance().getRelationships().add(relationship);
+            return this;
+        }
+
+        public Builder relationships(final RelationshipTO... relationships) {
+            getInstance().getRelationships().addAll(Arrays.asList(relationships));
+            return this;
+        }
+
+        public Builder relationships(final Collection<RelationshipTO> relationships) {
+            getInstance().getRelationships().addAll(relationships);
+            return this;
+        }
+
+        public Builder membership(final MembershipTO membership) {
+            getInstance().getMemberships().add(membership);
+            return this;
+        }
+
+        public Builder memberships(final MembershipTO... memberships) {
+            getInstance().getMemberships().addAll(Arrays.asList(memberships));
+            return this;
+        }
+
+        public Builder memberships(final Collection<MembershipTO> memberships) {
+            getInstance().getMemberships().addAll(memberships);
+            return this;
+        }
+    }
+
+    private String type;
 
     private String name;
 
@@ -45,16 +101,25 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
 
     private final List<MembershipTO> memberships = new ArrayList<>();
 
-    private final List<MembershipTO> dynMemberships = new ArrayList<>();
-
-    @XmlTransient
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.to.AnyObjectTO")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.AnyObjectCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
+    public String getType() {
+        return type;
+    }
+
+    public void setType(final String type) {
+        this.type = type;
+    }
+
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
     public String getName() {
         return name;
     }
@@ -93,13 +158,9 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    @XmlElementWrapper(name = "dynMemberships")
-    @XmlElement(name = "dynMembership")
-    @JsonProperty("dynMemberships")
     @Override
     public List<MembershipTO> getDynMemberships() {
-        return dynMemberships;
+        return Collections.emptyList();
     }
 
     @Override
@@ -109,7 +170,6 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
                 append(name).
                 append(relationships).
                 append(memberships).
-                append(dynMemberships).
                 build();
     }
 
@@ -124,13 +184,12 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final AnyObjectTO other = (AnyObjectTO) obj;
+        final AnyObjectCR other = (AnyObjectCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(name, other.name).
                 append(relationships, other.relationships).
                 append(memberships, other.memberships).
-                append(dynMemberships, other.dynMemberships).
                 build();
     }
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
index 87136fe..1f7cdbf 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyObjectUR.java
@@ -50,32 +50,32 @@ public class AnyObjectUR extends AnyUR {
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipUR relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipUR... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipUR> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipUR membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipUR... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipUR> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
@@ -83,9 +83,9 @@ public class AnyObjectUR extends AnyUR {
 
     private StringReplacePatchItem name;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final Set<RelationshipUR> relationships = new HashSet<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final Set<MembershipUR> memberships = new HashSet<>();
 
     @JsonProperty("@class")
     @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.AnyObjectUR")
@@ -105,14 +105,14 @@ public class AnyObjectUR extends AnyUR {
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    public Set<RelationshipUR> getRelationships() {
         return relationships;
     }
 
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    public Set<MembershipUR> getMemberships() {
         return memberships;
     }
 
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
index d0befda..52a6b3f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/AnyUR.java
@@ -43,7 +43,7 @@ import org.apache.syncope.common.lib.to.AttrTO;
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
 @JsonPropertyOrder(value = { "@class", "key" })
 @Schema(subTypes = { UserUR.class, GroupUR.class, AnyObjectUR.class }, discriminatorProperty = "@class")
-public abstract class AnyUR implements Serializable, AttributableUR {
+public abstract class AnyUR implements Serializable {
 
     private static final long serialVersionUID = -7445489774552440544L;
 
@@ -201,7 +201,6 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "plainAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("plainAttrs")
-    @Override
     public Set<AttrPatch> getPlainAttrs() {
         return plainAttrs;
     }
@@ -209,7 +208,6 @@ public abstract class AnyUR implements Serializable, AttributableUR {
     @XmlElementWrapper(name = "virAttrs")
     @XmlElement(name = "attribute")
     @JsonProperty("virAttrs")
-    @Override
     public Set<AttrTO> getVirAttrs() {
         return virAttrs;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
similarity index 63%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
index cc01eda..8830e1c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/GroupCR.java
@@ -16,73 +16,105 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.to;
+package org.apache.syncope.common.lib.request;
 
-import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
 import javax.xml.bind.annotation.XmlType;
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.jaxb.XmlGenericMapAdapter;
-import org.apache.syncope.common.lib.types.AnyTypeKind;
+import org.apache.syncope.common.lib.to.TypeExtensionTO;
 
-@XmlRootElement(name = "group")
+@XmlRootElement(name = "groupCR")
 @XmlType
-@Schema(allOf = { AnyTO.class })
-public class GroupTO extends AnyTO {
+@JsonPropertyOrder(value = { "@class", "name" })
+@Schema(allOf = { AnyCR.class })
+public class GroupCR extends AnyCR {
 
-    private static final long serialVersionUID = -7785920258290147542L;
+    private static final long serialVersionUID = -4559772531167385473L;
 
-    private String name;
+    public static class Builder extends AnyCR.Builder<GroupCR, Builder> {
 
-    private String userOwner;
+        @Override
+        protected GroupCR newInstance() {
+            return new GroupCR();
+        }
 
-    private String groupOwner;
+        public Builder name(final String name) {
+            getInstance().setName(name);
+            return this;
+        }
 
-    private String udynMembershipCond;
+        public Builder userOwner(final String userOwner) {
+            getInstance().setUserOwner(userOwner);
+            return this;
+        }
+
+        public Builder groupOwner(final String groupOwner) {
+            getInstance().setGroupOwner(groupOwner);
+            return this;
+        }
+
+        public Builder udynMembershipCond(final String udynMembershipCond) {
+            getInstance().setUDynMembershipCond(udynMembershipCond);
+            return this;
+        }
+
+        public Builder adynMembershipCond(final String type, final String fiql) {
+            getInstance().getADynMembershipConds().put(type, fiql);
+            return this;
+        }
+
+        public Builder typeExtension(final TypeExtensionTO typeExtension) {
+            getInstance().getTypeExtensions().add(typeExtension);
+            return this;
+        }
+
+        public Builder typeExtensions(final TypeExtensionTO... typeExtensions) {
+            getInstance().getTypeExtensions().addAll(Arrays.asList(typeExtensions));
+            return this;
+        }
+
+        public Builder typeExtensions(final Collection<TypeExtensionTO> typeExtensions) {
+            getInstance().getTypeExtensions().addAll(typeExtensions);
+            return this;
+        }
+    }
 
-    private int staticUserMembershipCount;
+    private String name;
 
-    private int dynamicUserMembershipCount;
+    private String userOwner;
 
-    private int staticAnyObjectMembershipCount;
+    private String groupOwner;
 
-    private int dynamicAnyObjectMembershipCount;
+    private String udynMembershipCond;
 
     @XmlJavaTypeAdapter(XmlGenericMapAdapter.class)
     private final Map<String, String> adynMembershipConds = new HashMap<>();
 
     private final List<TypeExtensionTO> typeExtensions = new ArrayList<>();
 
-    @XmlTransient
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.to.GroupTO")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.GroupCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
-    @Override
-    public String getType() {
-        return AnyTypeKind.GROUP.name();
-    }
-
-    @Override
-    public void setType(final String type) {
-        // fixed
-    }
-
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
     public String getName() {
         return name;
     }
@@ -115,54 +147,11 @@ public class GroupTO extends AnyTO {
         this.udynMembershipCond = uDynMembershipCond;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getStaticUserMembershipCount() {
-        return staticUserMembershipCount;
-    }
-
-    public void setStaticUserMembershipCount(final int staticUserMembershipCount) {
-        this.staticUserMembershipCount = staticUserMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getDynamicUserMembershipCount() {
-        return dynamicUserMembershipCount;
-    }
-
-    public void setDynamicUserMembershipCount(final int dynamicUserMembershipCount) {
-        this.dynamicUserMembershipCount = dynamicUserMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getStaticAnyObjectMembershipCount() {
-        return staticAnyObjectMembershipCount;
-    }
-
-    public void setStaticAnyObjectMembershipCount(final int staticAnyObjectMembershipCount) {
-        this.staticAnyObjectMembershipCount = staticAnyObjectMembershipCount;
-    }
-
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public int getDynamicAnyObjectMembershipCount() {
-        return dynamicAnyObjectMembershipCount;
-    }
-
-    public void setDynamicAnyObjectMembershipCount(final int dynamicAnyObjectMembershipCount) {
-        this.dynamicAnyObjectMembershipCount = dynamicAnyObjectMembershipCount;
-    }
-
     @JsonProperty
     public Map<String, String> getADynMembershipConds() {
         return adynMembershipConds;
     }
 
-    @JsonIgnore
-    public Optional<TypeExtensionTO> getTypeExtension(final String anyType) {
-        return typeExtensions.stream().filter(
-                typeExtension -> anyType != null && anyType.equals(typeExtension.getAnyType())).
-                findFirst();
-    }
-
     @XmlElementWrapper(name = "typeExtensions")
     @XmlElement(name = "typeExtension")
     @JsonProperty("typeExtensions")
@@ -194,7 +183,7 @@ public class GroupTO extends AnyTO {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final GroupTO other = (GroupTO) obj;
+        final GroupCR other = (GroupCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(name, other.name).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
similarity index 93%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
index b79bf9c..dde21be 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/MembershipUR.java
@@ -31,17 +31,17 @@ import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.AttrTO;
 
-@XmlRootElement(name = "membershipPatch")
+@XmlRootElement(name = "membershipUR")
 @XmlType
-public class MembershipPatch extends AbstractPatch {
+public class MembershipUR extends AbstractPatch {
 
     private static final long serialVersionUID = -6783121761221554433L;
 
-    public static class Builder extends AbstractPatch.Builder<MembershipPatch, Builder> {
+    public static class Builder extends AbstractPatch.Builder<MembershipUR, Builder> {
 
         @Override
-        protected MembershipPatch newInstance() {
-            return new MembershipPatch();
+        protected MembershipUR newInstance() {
+            return new MembershipUR();
         }
 
         public Builder group(final String group) {
@@ -129,7 +129,7 @@ public class MembershipPatch extends AbstractPatch {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final MembershipPatch other = (MembershipPatch) obj;
+        final MembershipUR other = (MembershipUR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(group, other.group).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
similarity index 89%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
index e777de7..d193fe8 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipPatch.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/RelationshipUR.java
@@ -24,17 +24,17 @@ import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
 import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "relationshipPatch")
+@XmlRootElement(name = "relationshipUR")
 @XmlType
-public class RelationshipPatch extends AbstractPatch {
+public class RelationshipUR extends AbstractPatch {
 
     private static final long serialVersionUID = 1314175521205206511L;
 
-    public static class Builder extends AbstractPatch.Builder<RelationshipPatch, Builder> {
+    public static class Builder extends AbstractPatch.Builder<RelationshipUR, Builder> {
 
         @Override
-        protected RelationshipPatch newInstance() {
-            return new RelationshipPatch();
+        protected RelationshipUR newInstance() {
+            return new RelationshipUR();
         }
 
         public Builder relationshipTO(final RelationshipTO relationshipTO) {
@@ -72,7 +72,7 @@ public class RelationshipPatch extends AbstractPatch {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final RelationshipPatch other = (RelationshipPatch) obj;
+        final RelationshipUR other = (RelationshipUR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(relationshipTO, other.relationshipTO).
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
similarity index 56%
copy from common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
copy to common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
index abe50cb..38929fa 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserCR.java
@@ -18,11 +18,17 @@
  */
 package org.apache.syncope.common.lib.request;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import io.swagger.v3.oas.annotations.media.Schema;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Optional;
 import java.util.Set;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlElementWrapper;
@@ -30,195 +36,229 @@ import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.builder.EqualsBuilder;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
+import org.apache.syncope.common.lib.to.GroupableRelatableTO;
+import org.apache.syncope.common.lib.to.MembershipTO;
+import org.apache.syncope.common.lib.to.RelationshipTO;
 
-@XmlRootElement(name = "userUR")
+@XmlRootElement(name = "userCR")
 @XmlType
-@Schema(allOf = { AnyUR.class })
-public class UserUR extends AnyUR {
+@JsonPropertyOrder(value = { "@class", "username" })
+@Schema(allOf = { AnyCR.class })
+public class UserCR extends AnyCR implements GroupableRelatableTO {
 
-    private static final long serialVersionUID = 2872795537911821448L;
+    private static final long serialVersionUID = 2808404532469484940L;
 
-    public static class Builder extends AnyUR.Builder<UserUR, Builder> {
+    public static class Builder extends AnyCR.Builder<UserCR, Builder> {
 
         @Override
-        protected UserUR newInstance() {
-            return new UserUR();
+        protected UserCR newInstance() {
+            return new UserCR();
         }
 
-        public Builder username(final StringReplacePatchItem username) {
+        public Builder username(final String username) {
             getInstance().setUsername(username);
             return this;
         }
 
-        public Builder password(final PasswordPatch password) {
+        public Builder password(final String password) {
             getInstance().setPassword(password);
             return this;
         }
 
-        public Builder securityQuestion(final StringReplacePatchItem securityQuestion) {
+        public Builder storePassword(final boolean storePassword) {
+            getInstance().setStorePassword(storePassword);
+            return this;
+        }
+
+        public Builder securityQuestion(final String securityQuestion) {
             getInstance().setSecurityQuestion(securityQuestion);
             return this;
         }
 
-        public Builder securityAnswer(final StringReplacePatchItem securityAnswer) {
+        public Builder securityAnswer(final String securityAnswer) {
             getInstance().setSecurityAnswer(securityAnswer);
             return this;
         }
 
-        public Builder mustChangePassword(final BooleanReplacePatchItem mustChangePassword) {
+        public Builder mustChangePassword(final boolean mustChangePassword) {
             getInstance().setMustChangePassword(mustChangePassword);
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipTO relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipTO... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipTO> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipTO membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipTO... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipTO> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
 
-        public Builder role(final StringPatchItem role) {
+        public Builder role(final String role) {
             getInstance().getRoles().add(role);
             return this;
         }
 
-        public Builder roles(final StringPatchItem... roles) {
+        public Builder roles(final String... roles) {
             getInstance().getRoles().addAll(Arrays.asList(roles));
             return this;
         }
 
-        public Builder roles(final Collection<StringPatchItem> roles) {
+        public Builder roles(final Collection<String> roles) {
             getInstance().getRoles().addAll(roles);
             return this;
         }
     }
 
-    private StringReplacePatchItem username;
+    private String username;
+
+    private String password;
 
-    private PasswordPatch password;
+    private boolean storePassword = true;
 
-    private StringReplacePatchItem securityQuestion;
+    private String securityQuestion;
 
-    private StringReplacePatchItem securityAnswer;
+    private String securityAnswer;
 
-    private BooleanReplacePatchItem mustChangePassword;
+    private boolean mustChangePassword;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final List<RelationshipTO> relationships = new ArrayList<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final List<MembershipTO> memberships = new ArrayList<>();
 
-    private final Set<StringPatchItem> roles = new HashSet<>();
+    private final Set<String> roles = new HashSet<>();
 
     @JsonProperty("@class")
-    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.UserUR")
+    @Schema(name = "@class", required = true, example = "org.apache.syncope.common.lib.request.UserCR")
     @Override
     public String getDiscriminator() {
         return getClass().getName();
     }
 
-    public StringReplacePatchItem getUsername() {
+    @JsonProperty(required = true)
+    @XmlElement(required = true)
+    public String getUsername() {
         return username;
     }
 
-    public void setUsername(final StringReplacePatchItem username) {
+    public void setUsername(final String username) {
         this.username = username;
     }
 
-    public PasswordPatch getPassword() {
+    public String getPassword() {
         return password;
     }
 
-    public void setPassword(final PasswordPatch password) {
+    public void setPassword(final String password) {
         this.password = password;
     }
 
-    public StringReplacePatchItem getSecurityQuestion() {
+    public boolean isStorePassword() {
+        return storePassword;
+    }
+
+    public void setStorePassword(final boolean storePassword) {
+        this.storePassword = storePassword;
+    }
+
+    public String getSecurityQuestion() {
         return securityQuestion;
     }
 
-    public void setSecurityQuestion(final StringReplacePatchItem securityQuestion) {
+    public void setSecurityQuestion(final String securityQuestion) {
         this.securityQuestion = securityQuestion;
     }
 
-    public StringReplacePatchItem getSecurityAnswer() {
+    public String getSecurityAnswer() {
         return securityAnswer;
     }
 
-    public void setSecurityAnswer(final StringReplacePatchItem securityAnswer) {
+    public void setSecurityAnswer(final String securityAnswer) {
         this.securityAnswer = securityAnswer;
     }
 
-    public BooleanReplacePatchItem getMustChangePassword() {
+    public boolean isMustChangePassword() {
         return mustChangePassword;
     }
 
-    public void setMustChangePassword(final BooleanReplacePatchItem mustChangePassword) {
+    public void setMustChangePassword(final boolean mustChangePassword) {
         this.mustChangePassword = mustChangePassword;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<RelationshipTO> getRelationship(final String type, final String otherKey) {
+        return relationships.stream().filter(
+                relationship -> type.equals(relationship.getType()) && otherKey.equals(relationship.getOtherEndKey())).
+                findFirst();
+    }
+
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    @Override
+    public List<RelationshipTO> getRelationships() {
         return relationships;
     }
 
+    @JsonIgnore
+    @Override
+    public Optional<MembershipTO> getMembership(final String groupKey) {
+        return memberships.stream().filter(membership -> groupKey.equals(membership.getGroupKey())).findFirst();
+    }
+
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    @Override
+    public List<MembershipTO> getMemberships() {
         return memberships;
     }
 
+    @Override
+    public List<MembershipTO> getDynMemberships() {
+        return Collections.emptyList();
+    }
+
     @XmlElementWrapper(name = "roles")
     @XmlElement(name = "role")
     @JsonProperty("roles")
-    public Set<StringPatchItem> getRoles() {
+    public Set<String> getRoles() {
         return roles;
     }
 
     @Override
-    public boolean isEmpty() {
-        return super.isEmpty()
-                && username == null && password == null && securityQuestion == null && securityAnswer == null
-                && mustChangePassword == null && relationships.isEmpty() && memberships.isEmpty() && roles.isEmpty();
-    }
-
-    @Override
     public int hashCode() {
         return new HashCodeBuilder().
                 appendSuper(super.hashCode()).
                 append(username).
-                append(password).
+                append(roles).
                 append(securityQuestion).
                 append(securityAnswer).
                 append(mustChangePassword).
                 append(relationships).
                 append(memberships).
-                append(roles).
                 build();
     }
 
@@ -233,16 +273,16 @@ public class UserUR extends AnyUR {
         if (getClass() != obj.getClass()) {
             return false;
         }
-        final UserUR other = (UserUR) obj;
+        final UserCR other = (UserCR) obj;
         return new EqualsBuilder().
                 appendSuper(super.equals(obj)).
                 append(username, other.username).
+                append(roles, other.roles).
                 append(securityQuestion, other.securityQuestion).
                 append(securityAnswer, other.securityAnswer).
                 append(mustChangePassword, other.mustChangePassword).
                 append(relationships, other.relationships).
                 append(memberships, other.memberships).
-                append(roles, other.roles).
                 build();
     }
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
index abe50cb..bc5f854 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java
@@ -70,32 +70,32 @@ public class UserUR extends AnyUR {
             return this;
         }
 
-        public Builder relationship(final RelationshipPatch relationship) {
+        public Builder relationship(final RelationshipUR relationship) {
             getInstance().getRelationships().add(relationship);
             return this;
         }
 
-        public Builder relationships(final RelationshipPatch... relationships) {
+        public Builder relationships(final RelationshipUR... relationships) {
             getInstance().getRelationships().addAll(Arrays.asList(relationships));
             return this;
         }
 
-        public Builder relationships(final Collection<RelationshipPatch> relationships) {
+        public Builder relationships(final Collection<RelationshipUR> relationships) {
             getInstance().getRelationships().addAll(relationships);
             return this;
         }
 
-        public Builder membership(final MembershipPatch membership) {
+        public Builder membership(final MembershipUR membership) {
             getInstance().getMemberships().add(membership);
             return this;
         }
 
-        public Builder memberships(final MembershipPatch... memberships) {
+        public Builder memberships(final MembershipUR... memberships) {
             getInstance().getMemberships().addAll(Arrays.asList(memberships));
             return this;
         }
 
-        public Builder memberships(final Collection<MembershipPatch> memberships) {
+        public Builder memberships(final Collection<MembershipUR> memberships) {
             getInstance().getMemberships().addAll(memberships);
             return this;
         }
@@ -126,9 +126,9 @@ public class UserUR extends AnyUR {
 
     private BooleanReplacePatchItem mustChangePassword;
 
-    private final Set<RelationshipPatch> relationships = new HashSet<>();
+    private final Set<RelationshipUR> relationships = new HashSet<>();
 
-    private final Set<MembershipPatch> memberships = new HashSet<>();
+    private final Set<MembershipUR> memberships = new HashSet<>();
 
     private final Set<StringPatchItem> roles = new HashSet<>();
 
@@ -182,14 +182,14 @@ public class UserUR extends AnyUR {
     @XmlElementWrapper(name = "relationships")
     @XmlElement(name = "relationship")
     @JsonProperty("relationships")
-    public Set<RelationshipPatch> getRelationships() {
+    public Set<RelationshipUR> getRelationships() {
         return relationships;
     }
 
     @XmlElementWrapper(name = "memberships")
     @XmlElement(name = "membership")
     @JsonProperty("memberships")
-    public Set<MembershipPatch> getMemberships() {
+    public Set<MembershipUR> getMemberships() {
         return memberships;
     }
 
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
index 7a4df9e..499fb93 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AbstractAnnotatedBean.java
@@ -19,7 +19,6 @@
 package org.apache.syncope.common.lib.to;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
-import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.Date;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.commons.lang3.StringUtils;
@@ -67,7 +66,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
      */
     private Date lastChangeDate;
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getCreator() {
         return creator;
     }
@@ -76,7 +74,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         this.creator = creator;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getCreationDate() {
         if (creationDate != null) {
             return new Date(creationDate.getTime());
@@ -92,7 +89,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         }
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getLastModifier() {
         return lastModifier;
     }
@@ -101,7 +97,6 @@ public abstract class AbstractAnnotatedBean extends BaseBean implements EntityTO
         this.lastModifier = lastModifier;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getLastChangeDate() {
         if (lastChangeDate != null) {
             return new Date(lastChangeDate.getTime());
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
index a2b6a44..a2973f9 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyObjectTO.java
@@ -93,7 +93,6 @@ public class AnyObjectTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynMemberships")
     @XmlElement(name = "dynMembership")
     @JsonProperty("dynMemberships")
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
index d8bd896..2581013 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AnyTO.java
@@ -41,7 +41,7 @@ import org.apache.commons.lang3.builder.HashCodeBuilder;
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "@class")
 @JsonPropertyOrder(value = { "@class", "key", "type", "realm", "username", "name" })
 @Schema(subTypes = { UserTO.class, GroupTO.class, AnyObjectTO.class }, discriminatorProperty = "@class")
-public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, AttributableTO {
+public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, AttributableReqEntity {
 
     private static final long serialVersionUID = -754311920679872084L;
 
@@ -59,7 +59,7 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
 
     private String status;
 
-    private final List<String> auxClasses = new ArrayList<>();
+    private final Set<String> auxClasses = new HashSet<>();
 
     private final Set<AttrTO> plainAttrs = new HashSet<>();
 
@@ -76,7 +76,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         // do nothing
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @Override
     public String getKey() {
         return key;
@@ -87,7 +86,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         this.key = key;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getType() {
         return type;
     }
@@ -96,15 +94,16 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         this.type = type;
     }
 
+    @Override
     public String getRealm() {
         return realm;
     }
 
+    @Override
     public void setRealm(final String realm) {
         this.realm = realm;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynRealms")
     @XmlElement(name = "dynRealmF")
     @JsonProperty("dynRealms")
@@ -112,7 +111,6 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
         return dynRealms;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getStatus() {
         return status;
     }
@@ -124,7 +122,8 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
     @XmlElementWrapper(name = "auxClasses")
     @XmlElement(name = "class")
     @JsonProperty("auxClasses")
-    public List<String> getAuxClasses() {
+    @Override
+    public Set<String> getAuxClasses() {
         return auxClasses;
     }
 
@@ -173,6 +172,7 @@ public abstract class AnyTO extends AbstractAnnotatedBean implements EntityTO, A
     @XmlElementWrapper(name = "resources")
     @XmlElement(name = "resource")
     @JsonProperty("resources")
+    @Override
     public Set<String> getResources() {
         return resources;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
similarity index 78%
rename from common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java
rename to common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
index 30b8396..8180a52 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/request/AttributableUR.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/AttributableReqEntity.java
@@ -16,14 +16,17 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.syncope.common.lib.request;
+package org.apache.syncope.common.lib.to;
 
 import java.util.Set;
-import org.apache.syncope.common.lib.to.AttrTO;
 
-public interface AttributableUR {
+public interface AttributableReqEntity extends AttributableTO {
 
-    Set<AttrPatch> getPlainAttrs();
+    String getRealm();
 
-    Set<AttrTO> getVirAttrs();
+    void setRealm(String realm);
+
+    Set<String> getAuxClasses();
+
+    Set<String> getResources();
 }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
index cc01eda..a7247d9 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/GroupTO.java
@@ -115,7 +115,6 @@ public class GroupTO extends AnyTO {
         this.udynMembershipCond = uDynMembershipCond;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getStaticUserMembershipCount() {
         return staticUserMembershipCount;
     }
@@ -124,7 +123,6 @@ public class GroupTO extends AnyTO {
         this.staticUserMembershipCount = staticUserMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getDynamicUserMembershipCount() {
         return dynamicUserMembershipCount;
     }
@@ -133,7 +131,6 @@ public class GroupTO extends AnyTO {
         this.dynamicUserMembershipCount = dynamicUserMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getStaticAnyObjectMembershipCount() {
         return staticAnyObjectMembershipCount;
     }
@@ -142,7 +139,6 @@ public class GroupTO extends AnyTO {
         this.staticAnyObjectMembershipCount = staticAnyObjectMembershipCount;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public int getDynamicAnyObjectMembershipCount() {
         return dynamicAnyObjectMembershipCount;
     }
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
index e27ecb0..65df20f 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/RemediationTO.java
@@ -24,6 +24,7 @@ import javax.ws.rs.PathParam;
 import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlType;
 import org.apache.syncope.common.lib.BaseBean;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 
@@ -39,7 +40,7 @@ public class RemediationTO extends BaseBean implements EntityTO {
 
     private ResourceOperation operation;
 
-    private AnyTO anyTOPayload;
+    private AnyCR anyCRPayload;
 
     private AnyUR anyURPayload;
 
@@ -85,12 +86,12 @@ public class RemediationTO extends BaseBean implements EntityTO {
     }
 
     @Schema(accessMode = Schema.AccessMode.READ_ONLY)
-    public AnyTO getAnyTOPayload() {
-        return anyTOPayload;
+    public AnyCR getAnyCRPayload() {
+        return anyCRPayload;
     }
 
-    public void setAnyTOPayload(final AnyTO anyTOPayload) {
-        this.anyTOPayload = anyTOPayload;
+    public void setAnyCRPayload(final AnyCR anyCRPayload) {
+        this.anyCRPayload = anyCRPayload;
     }
 
     @Schema(accessMode = Schema.AccessMode.READ_ONLY)
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java b/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
index 4d1da53..5cad50c 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java
@@ -108,7 +108,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return roles;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynRoles")
     @XmlElement(name = "role")
     @JsonProperty("dynRoles")
@@ -123,7 +122,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return privileges;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public String getToken() {
         return token;
     }
@@ -132,7 +130,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.token = token;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getTokenExpireTime() {
         if (tokenExpireTime != null) {
             return new Date(tokenExpireTime.getTime());
@@ -158,7 +155,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.username = username;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getChangePwdDate() {
         if (changePwdDate != null) {
             return new Date(changePwdDate.getTime());
@@ -166,12 +162,10 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return null;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Integer getFailedLogins() {
         return failedLogins;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public Date getLastLoginDate() {
         if (lastLoginDate != null) {
             return new Date(lastLoginDate.getTime());
@@ -215,7 +209,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.securityAnswer = securityAnswer;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public boolean isSuspended() {
         return suspended;
     }
@@ -224,7 +217,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         this.suspended = suspended;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     public boolean isMustChangePassword() {
         return mustChangePassword;
     }
@@ -263,7 +255,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
         return memberships;
     }
 
-    @Schema(accessMode = Schema.AccessMode.READ_ONLY)
     @XmlElementWrapper(name = "dynMemberships")
     @XmlElement(name = "dynMembership")
     @JsonProperty("dynMemberships")
diff --git a/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java b/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
index 281a72e..9971f13 100644
--- a/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
+++ b/common/lib/src/main/java/org/apache/syncope/common/lib/types/AnyTypeKind.java
@@ -19,9 +19,13 @@
 package org.apache.syncope.common.lib.types;
 
 import javax.xml.bind.annotation.XmlEnum;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -31,25 +35,36 @@ import org.apache.syncope.common.lib.to.UserTO;
 @XmlEnum
 public enum AnyTypeKind {
 
-    USER(UserTO.class, UserUR.class),
-    GROUP(GroupTO.class, GroupUR.class),
-    ANY_OBJECT(AnyObjectTO.class, AnyObjectUR.class);
+    USER(UserTO.class, UserCR.class, UserUR.class),
+    GROUP(GroupTO.class, GroupCR.class, GroupUR.class),
+    ANY_OBJECT(AnyObjectTO.class, AnyObjectCR.class, AnyObjectUR.class);
 
     private final Class<? extends AnyTO> toClass;
 
-    private final Class<? extends AnyUR> reqClass;
+    private final Class<? extends AnyCR> crClass;
+
+    private final Class<? extends AnyUR> urClass;
+
+    AnyTypeKind(
+            final Class<? extends AnyTO> toClass,
+            final Class<? extends AnyCR> crClass,
+            final Class<? extends AnyUR> urClass) {
 
-    AnyTypeKind(final Class<? extends AnyTO> toClass, final Class<? extends AnyUR> reqClass) {
         this.toClass = toClass;
-        this.reqClass = reqClass;
+        this.crClass = crClass;
+        this.urClass = urClass;
     }
 
     public Class<? extends AnyTO> getTOClass() {
         return toClass;
     }
 
+    public Class<? extends AnyCR> getCRClass() {
+        return crClass;
+    }
+
     public Class<? extends AnyUR> getURClass() {
-        return reqClass;
+        return urClass;
     }
 
     public static AnyTypeKind fromTOClass(final Class<? extends AnyTO> clazz) {
diff --git a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
index 7ef5c24..780fc30 100644
--- a/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
+++ b/common/lib/src/test/java/org/apache/syncope/common/lib/JSONTest.java
@@ -100,8 +100,7 @@ public class JSONTest {
         StringWriter writer = new StringWriter();
         mapper.writeValue(writer, original);
 
-        ProvisioningResult<GroupTO> actual = mapper.readValue(
-                writer.toString(), new TypeReference<ProvisioningResult<GroupTO>>() {
+        ProvisioningResult<GroupTO> actual = mapper.readValue(writer.toString(), new TypeReference<ProvisioningResult<GroupTO>>() {
         });
         assertEquals(original, actual);
     }
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
index 4a28787..3388b7c 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java
@@ -37,6 +37,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.PagedResult;
@@ -71,7 +72,7 @@ public interface AnyObjectService extends AnyService<AnyObjectTO> {
     /**
      * Creates a new any object.
      *
-     * @param anyObjectTO any object to be created
+     * @param createReq any object create request
      * @return Response object featuring Location header of created any object as well as the any
      * object itself enriched with propagation status information
      */
@@ -105,7 +106,7 @@ public interface AnyObjectService extends AnyService<AnyObjectTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull AnyObjectTO anyObjectTO);
+    Response create(@NotNull AnyObjectCR createReq);
 
     /**
      * Updates any object matching the provided key.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
index 21aee3c..17ed036 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/GroupService.java
@@ -40,6 +40,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.ExecTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -76,7 +77,7 @@ public interface GroupService extends AnyService<GroupTO> {
     /**
      * Creates a new group.
      *
-     * @param groupTO group to be created
+     * @param createReq group create request
      * @return Response object featuring Location header of created group as well as the any
      * object itself enriched with propagation status information
      */
@@ -109,7 +110,7 @@ public interface GroupService extends AnyService<GroupTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull GroupTO groupTO);
+    Response create(@NotNull GroupCR createReq);
 
     /**
      * Updates group matching the provided key.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
index f3c4e84..71b172e 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RemediationService.java
@@ -41,8 +41,8 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
@@ -95,7 +95,7 @@ public interface RemediationService extends JAXRSService {
      * Perform remediation by creating the provided user, group or any object.
      *
      * @param remediationKey key for remediation to act on
-     * @param anyTO user, group or any object to create
+     * @param createReq user, group or any object to create
      * @return Response object featuring Location header of created object as well as the object itself
      * enriched with propagation status information
      */
@@ -131,7 +131,7 @@ public interface RemediationService extends JAXRSService {
     @Path("{remediationKey}")
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response remedy(@NotNull @PathParam("remediationKey") String remediationKey, @NotNull AnyTO anyTO);
+    Response remedy(@NotNull @PathParam("remediationKey") String remediationKey, @NotNull AnyCR createReq);
 
     /**
      * Perform remediation by updating the provided user, group or any object.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
index e278f70..923642e 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java
@@ -31,7 +31,6 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import javax.validation.constraints.NotNull;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
 import javax.ws.rs.GET;
 import javax.ws.rs.PATCH;
 import javax.ws.rs.POST;
@@ -43,6 +42,7 @@ import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -82,8 +82,7 @@ public interface UserSelfService extends JAXRSService {
     /**
      * Self-registration for new user.
      *
-     * @param userTO user to be created
-     * @param storePassword whether password shall be stored internally
+     * @param createReq user to be created
      * @return Response object featuring Location header of self-registered user as well as the user itself
      * enriched with propagation status information
      */
@@ -111,8 +110,7 @@ public interface UserSelfService extends JAXRSService {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(@NotNull UserTO userTO,
-            @DefaultValue("true") @QueryParam("storePassword") boolean storePassword);
+    Response create(@NotNull UserCR createReq);
 
     /**
      * Self-updates user.
diff --git a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
index e54c181..aef50d1 100644
--- a/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
+++ b/common/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserService.java
@@ -30,16 +30,15 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirements;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import javax.validation.constraints.NotNull;
 import javax.ws.rs.Consumes;
-import javax.ws.rs.DefaultValue;
 import javax.ws.rs.PATCH;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -74,8 +73,7 @@ public interface UserService extends AnyService<UserTO> {
     /**
      * Creates a new user.
      *
-     * @param userTO user to be created
-     * @param storePassword whether password shall be stored internally
+     * @param createReq user create request
      * @return Response object featuring Location header of created user as well as the user itself
      * enriched with propagation status information
      */
@@ -108,9 +106,7 @@ public interface UserService extends AnyService<UserTO> {
     @POST
     @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
     @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML })
-    Response create(
-            @NotNull UserTO userTO,
-            @DefaultValue("true") @QueryParam("storePassword") boolean storePassword);
+    Response create(@NotNull UserCR createReq);
 
     /**
      * Updates user matching the provided key.
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
index 31329a6..9ae073c 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/AbstractAnyLogic.java
@@ -22,15 +22,16 @@ import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
-import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
 import org.apache.syncope.core.persistence.api.dao.AnyDAO;
@@ -50,7 +51,8 @@ import org.apache.syncope.core.provisioning.api.utils.RealmUtils;
 import org.apache.syncope.core.spring.ImplementationManager;
 import org.springframework.beans.factory.annotation.Autowired;
 
-public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extends AbstractResourceAssociator<TO> {
+public abstract class AbstractAnyLogic<TO extends AnyTO, C extends AnyCR, U extends AnyUR>
+        extends AbstractResourceAssociator<TO> {
 
     @Autowired
     protected UserDAO userDAO;
@@ -84,7 +86,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
         return actions;
     }
 
-    protected Pair<TO, List<LogicActions>> beforeCreate(final TO input) {
+    protected Pair<C, List<LogicActions>> beforeCreate(final C input) {
         Realm realm = realmDAO.findByFullPath(input.getRealm());
         if (realm == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -92,32 +94,34 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             throw sce;
         }
 
-        AnyType anyType = input instanceof UserTO
-                ? anyTypeDAO.findUser()
-                : input instanceof GroupTO
-                        ? anyTypeDAO.findGroup()
-                        : anyTypeDAO.find(input.getType());
+        AnyType anyType = null;
+        if (input instanceof UserCR) {
+            anyType = anyTypeDAO.findUser();
+        } else if (input instanceof GroupCR) {
+            anyType = anyTypeDAO.findGroup();
+        } else if (input instanceof AnyObjectCR) {
+            anyType = anyTypeDAO.find(((AnyObjectCR) input).getType());
+        }
         if (anyType == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidAnyType);
-            sce.getElements().add(input.getType());
             throw sce;
         }
 
-        TO any = input;
+        C anyCR = input;
 
-        templateUtils.apply(any, realm.getTemplate(anyType));
+        templateUtils.apply(anyCR, realm.getTemplate(anyType));
 
         List<LogicActions> actions = getActions(realm);
         for (LogicActions action : actions) {
-            any = action.beforeCreate(any);
+            anyCR = action.beforeCreate(anyCR);
         }
 
-        LOG.debug("Input: {}\nOutput: {}\n", input, any);
+        LOG.debug("Input: {}\nOutput: {}\n", input, anyCR);
 
-        return ImmutablePair.of(any, actions);
+        return Pair.of(anyCR, actions);
     }
 
-    protected Pair<R, List<LogicActions>> beforeUpdate(final R input, final String realmPath) {
+    protected Pair<U, List<LogicActions>> beforeUpdate(final U input, final String realmPath) {
         Realm realm = realmDAO.findByFullPath(realmPath);
         if (realm == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -125,7 +129,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             throw sce;
         }
 
-        R mod = input;
+        U mod = input;
 
         List<LogicActions> actions = getActions(realm);
         for (LogicActions action : actions) {
@@ -134,7 +138,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
 
         LOG.debug("Input: {}\nOutput: {}\n", input, mod);
 
-        return ImmutablePair.of(mod, actions);
+        return Pair.of(mod, actions);
     }
 
     protected Pair<TO, List<LogicActions>> beforeDelete(final TO input) {
@@ -154,7 +158,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
 
         LOG.debug("Input: {}\nOutput: {}\n", input, any);
 
-        return ImmutablePair.of(any, actions);
+        return Pair.of(any, actions);
     }
 
     protected ProvisioningResult<TO> afterCreate(
@@ -253,7 +257,7 @@ public abstract class AbstractAnyLogic<TO extends AnyTO, R extends AnyUR> extend
             String realm,
             boolean details);
 
-    public abstract ProvisioningResult<TO> update(R updateReq, boolean nullPriorityAsync);
+    public abstract ProvisioningResult<TO> update(U updateReq, boolean nullPriorityAsync);
 
     public abstract ProvisioningResult<TO> delete(String key, boolean nullPriorityAsync);
 }
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
index 5ed80cf..05efdb7 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java
@@ -28,6 +28,7 @@ import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -56,7 +57,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectUR> {
+public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectCR, AnyObjectUR> {
 
     @Autowired
     protected AnySearchDAO searchDAO;
@@ -99,8 +100,8 @@ public class AnyObjectLogic extends AbstractAnyLogic<AnyObjectTO, AnyObjectUR> {
         return Pair.of(count, result);
     }
 
-    public ProvisioningResult<AnyObjectTO> create(final AnyObjectTO anyObjectTO, final boolean nullPriorityAsync) {
-        Pair<AnyObjectTO, List<LogicActions>> before = beforeCreate(anyObjectTO);
+    public ProvisioningResult<AnyObjectTO> create(final AnyObjectCR createReq, final boolean nullPriorityAsync) {
+        Pair<AnyObjectCR, List<LogicActions>> before = beforeCreate(createReq);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
index 0da1b9d..a7aa6a0 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java
@@ -33,6 +33,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -81,7 +82,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupUR> {
+public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupCR, GroupUR> {
 
     @Resource(name = "adminUser")
     protected String adminUser;
@@ -173,8 +174,8 @@ public class GroupLogic extends AbstractAnyLogic<GroupTO, GroupUR> {
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.GROUP_CREATE + "')")
-    public ProvisioningResult<GroupTO> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
-        Pair<GroupTO, List<LogicActions>> before = beforeCreate(groupTO);
+    public ProvisioningResult<GroupTO> create(final GroupCR createReq, final boolean nullPriorityAsync) {
+        Pair<GroupCR, List<LogicActions>> before = beforeCreate(createReq);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
index 5757665..e22f157 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/RemediationLogic.java
@@ -24,16 +24,16 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
-import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.StandardEntitlement;
 import org.apache.syncope.core.persistence.api.dao.NotFoundException;
 import org.apache.syncope.core.persistence.api.dao.RemediationDAO;
@@ -104,7 +104,7 @@ public class RemediationLogic extends AbstractTransactionalLogic<RemediationTO>
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.REMEDIATION_REMEDY + "')")
-    public ProvisioningResult<?> remedy(final String key, final AnyTO anyTO, final boolean nullPriorityAsync) {
+    public ProvisioningResult<?> remedy(final String key, final AnyCR anyCR, final boolean nullPriorityAsync) {
         Remediation remediation = remediationDAO.find(key);
         if (remediation == null) {
             LOG.error("Could not find remediation '" + key + "'");
@@ -116,15 +116,15 @@ public class RemediationLogic extends AbstractTransactionalLogic<RemediationTO>
         switch (remediation.getAnyType().getKind()) {
             case USER:
             default:
-                result = userLogic.create((UserTO) anyTO, true, nullPriorityAsync);
+                result = userLogic.create((UserCR) anyCR, nullPriorityAsync);
                 break;
 
             case GROUP:
-                result = groupLogic.create((GroupTO) anyTO, nullPriorityAsync);
+                result = groupLogic.create((GroupCR) anyCR, nullPriorityAsync);
                 break;
 
             case ANY_OBJECT:
-                result = anyObjectLogic.create((AnyObjectTO) anyTO, nullPriorityAsync);
+                result = anyObjectLogic.create((AnyObjectCR) anyCR, nullPriorityAsync);
         }
 
         remediationDAO.delete(remediation);
diff --git a/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java b/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
index e970b10..06674d0 100644
--- a/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
+++ b/core/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java
@@ -33,6 +33,7 @@ import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -65,7 +66,7 @@ import org.springframework.transaction.annotation.Transactional;
  * Spring's Transactional logic at class level.
  */
 @Component
-public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
+public class UserLogic extends AbstractAnyLogic<UserTO, UserCR, UserUR> {
 
     @Autowired
     protected AnySearchDAO searchDAO;
@@ -125,26 +126,21 @@ public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
     }
 
     @PreAuthorize("isAnonymous() or hasRole('" + StandardEntitlement.ANONYMOUS + "')")
-    public ProvisioningResult<UserTO> selfCreate(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return doCreate(userTO, storePassword, true, nullPriorityAsync);
+    public ProvisioningResult<UserTO> selfCreate(final UserCR createReq, final boolean nullPriorityAsync) {
+        return doCreate(createReq, true, nullPriorityAsync);
     }
 
     @PreAuthorize("hasRole('" + StandardEntitlement.USER_CREATE + "')")
-    public ProvisioningResult<UserTO> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return doCreate(userTO, storePassword, false, nullPriorityAsync);
+    public ProvisioningResult<UserTO> create(final UserCR createReq, final boolean nullPriorityAsync) {
+        return doCreate(createReq, false, nullPriorityAsync);
     }
 
     protected ProvisioningResult<UserTO> doCreate(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR userCR,
             final boolean self,
             final boolean nullPriorityAsync) {
 
-        Pair<UserTO, List<LogicActions>> before = beforeCreate(userTO);
+        Pair<UserCR, List<LogicActions>> before = beforeCreate(userCR);
 
         if (before.getLeft().getRealm() == null) {
             throw SyncopeClientException.build(ClientExceptionType.InvalidRealm);
@@ -157,8 +153,7 @@ public class UserLogic extends AbstractAnyLogic<UserTO, UserUR> {
             securityChecks(effectiveRealms, before.getLeft().getRealm(), null);
         }
 
-        Pair<String, List<PropagationStatus>> created =
-                provisioningManager.create(before.getLeft(), storePassword, nullPriorityAsync);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(before.getLeft(), nullPriorityAsync);
 
         return afterCreate(
                 binder.returnUserTO(binder.getUserTO(created.getKey())), created.getRight(), before.getRight());
diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
index 7103352..d9b53c3 100644
--- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
+++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java
@@ -20,6 +20,7 @@ package org.apache.syncope.core.persistence.api.entity;
 
 import java.lang.reflect.Field;
 import java.util.Set;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
@@ -50,7 +51,9 @@ public interface AnyUtils {
 
     <T extends AnyTO> T newAnyTO();
 
-    <P extends AnyUR> P newAnyUR(String key);
+    <C extends AnyCR> C newAnyCR();
+
+    <U extends AnyUR> U newAnyUR(String key);
 
     <A extends Any<?>> AnyDAO<A> dao();
 
diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
index cbca8ea..3504a16 100644
--- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
+++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Remediation.java
@@ -19,8 +19,8 @@
 package org.apache.syncope.core.persistence.api.entity;
 
 import java.util.Date;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.task.PullTask;
 
@@ -34,15 +34,15 @@ public interface Remediation extends Entity {
 
     void setOperation(ResourceOperation operation);
 
-    void setPayload(AnyTO anyTO);
+    void setPayload(AnyCR anyCR);
 
     void setPayload(AnyUR anyUR);
 
     void setPayload(String key);
 
-    <T extends AnyTO> T getPayloadAsTO(Class<T> reference);
+    <C extends AnyCR> C getPayloadAsCR(Class<C> reference);
 
-    <P extends AnyUR> P getPayloadAsUR(Class<P> reference);
+    <U extends AnyUR> U getPayloadAsUR(Class<U> reference);
 
     String getPayloadAsKey();
 
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
index 5914353..46e5215 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java
@@ -27,9 +27,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.apache.commons.lang3.ClassUtils;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -308,20 +312,43 @@ public class JPAAnyUtils implements AnyUtils {
     }
 
     @Override
-    public <P extends AnyUR> P newAnyUR(final String key) {
-        P result = null;
+    public <C extends AnyCR> C newAnyCR() {
+        C result = null;
 
         switch (anyTypeKind) {
             case USER:
-                result = (P) new UserUR();
+                result = (C) new UserCR();
                 break;
 
             case GROUP:
-                result = (P) new GroupUR();
+                result = (C) new GroupCR();
                 break;
 
             case ANY_OBJECT:
-                result = (P) new AnyObjectUR();
+                result = (C) new AnyObjectCR();
+                break;
+
+            default:
+        }
+
+        return result;
+    }
+
+    @Override
+    public <U extends AnyUR> U newAnyUR(final String key) {
+        U result = null;
+
+        switch (anyTypeKind) {
+            case USER:
+                result = (U) new UserUR();
+                break;
+
+            case GROUP:
+                result = (U) new GroupUR();
+                break;
+
+            case ANY_OBJECT:
+                result = (U) new AnyObjectUR();
                 break;
 
             default:
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
index 87f9c9e..d93c6fe 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARemediation.java
@@ -28,8 +28,8 @@ import javax.persistence.Table;
 import javax.persistence.Temporal;
 import javax.persistence.TemporalType;
 import javax.validation.constraints.NotNull;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.AnyType;
 import org.apache.syncope.core.persistence.api.entity.Remediation;
@@ -94,12 +94,12 @@ public class JPARemediation extends AbstractGeneratedKeyEntity implements Remedi
     }
 
     @Override
-    public <T extends AnyTO> T getPayloadAsTO(final Class<T> reference) {
+    public <C extends AnyCR> C getPayloadAsCR(final Class<C> reference) {
         return POJOHelper.deserialize(this.payload, reference);
     }
 
     @Override
-    public <P extends AnyUR> P getPayloadAsUR(final Class<P> reference) {
+    public <U extends AnyUR> U getPayloadAsUR(final Class<U> reference) {
         return POJOHelper.deserialize(this.payload, reference);
     }
 
@@ -109,8 +109,8 @@ public class JPARemediation extends AbstractGeneratedKeyEntity implements Remedi
     }
 
     @Override
-    public void setPayload(final AnyTO anyTO) {
-        this.payload = POJOHelper.serialize(anyTO);
+    public void setPayload(final AnyCR anyCR) {
+        this.payload = POJOHelper.serialize(anyCR);
     }
 
     @Override
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
index 4a8a468..98ab4a1 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/RemediationValidator.java
@@ -31,7 +31,7 @@ public class RemediationValidator extends AbstractValidator<RemediationCheck, Re
 
         switch (remediation.getOperation()) {
             case CREATE:
-                if (remediation.getPayloadAsTO(remediation.getAnyType().getKind().getTOClass()) == null) {
+                if (remediation.getPayloadAsCR(remediation.getAnyType().getKind().getCRClass()) == null) {
                     context.disableDefaultConstraintViolation();
                     context.buildConstraintViolationWithTemplate(
                             getTemplate(EntityViolationType.InvalidRemediation,
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
index 8937684..7fe4064 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java
@@ -22,14 +22,15 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 
-public interface AnyObjectProvisioningManager extends ProvisioningManager<AnyObjectTO, AnyObjectUR> {
+public interface AnyObjectProvisioningManager extends ProvisioningManager<AnyObjectTO, AnyObjectCR, AnyObjectUR> {
 
     Pair<String, List<PropagationStatus>> create(
-            AnyObjectTO anyObjectTO, Set<String> excludedResources, boolean nullPriorityAsync);
+            AnyObjectCR anyObjectCR, Set<String> excludedResources, boolean nullPriorityAsync);
 
     List<PropagationStatus> provision(String key, Collection<String> resources, boolean nullPriorityAsync);
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
index 94e850f..4278be4 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java
@@ -23,18 +23,18 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.GroupTO;
 
-public interface GroupProvisioningManager extends ProvisioningManager<GroupTO, GroupUR> {
+public interface GroupProvisioningManager extends ProvisioningManager<GroupTO, GroupCR, GroupUR> {
 
     Pair<String, List<PropagationStatus>> create(
-            GroupTO groupTO,
+            GroupCR groupCR,
             Map<String, String> groupOwnerMap,
             Set<String> excludedResources,
             boolean nullPriorityAsync);
 
     List<PropagationStatus> provision(String key, Collection<String> resources, boolean nullPriorityAsync);
-
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
index a5d952d..4c57dee 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/LogicActions.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 
@@ -26,7 +27,7 @@ import org.apache.syncope.common.lib.to.AnyTO;
  */
 public interface LogicActions {
 
-    default <A extends AnyTO> A beforeCreate(A input) {
+    default <C extends AnyCR> C beforeCreate(C input) {
         return input;
     }
 
@@ -34,7 +35,7 @@ public interface LogicActions {
         return input;
     }
 
-    default <P extends AnyUR> P beforeUpdate(P input) {
+    default <U extends AnyUR> U beforeUpdate(U input) {
         return input;
     }
 
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
index 2672f9d..99ab5b1 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisioningManager.java
@@ -22,26 +22,26 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 
-public interface ProvisioningManager<T extends AnyTO, R extends AnyUR> {
+public interface ProvisioningManager<T extends AnyTO, C extends AnyCR, U extends AnyUR> {
 
-    Pair<String, List<PropagationStatus>> create(T anyTO, boolean nullPriorityAsync);
+    Pair<String, List<PropagationStatus>> create(C anyCR, boolean nullPriorityAsync);
 
-    Pair<R, List<PropagationStatus>> update(R anyUR, boolean nullPriorityAsync);
+    Pair<U, List<PropagationStatus>> update(U anyUR, boolean nullPriorityAsync);
 
-    Pair<R, List<PropagationStatus>> update(R anyUR, Set<String> excludedResources, boolean nullPriorityAsync);
+    Pair<U, List<PropagationStatus>> update(U anyUR, Set<String> excludedResources, boolean nullPriorityAsync);
 
     List<PropagationStatus> delete(String anyKey, boolean nullPriorityAsync);
 
     List<PropagationStatus> delete(String anyKey, Set<String> excludedResources, boolean nullPriorityAsync);
 
-    String unlink(R anyUR);
+    String unlink(U anyUR);
 
-    String link(R anyUR);
+    String link(U anyUR);
 
     List<PropagationStatus> deprovision(String anyKey, Collection<String> resources, boolean nullPriorityAsync);
-
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
index 91e4a02..b397149 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java
@@ -23,12 +23,13 @@ import java.util.List;
 import java.util.Set;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningReport;
 
-public interface UserProvisioningManager extends ProvisioningManager<UserTO, UserUR> {
+public interface UserProvisioningManager extends ProvisioningManager<UserTO, UserCR, UserUR> {
 
     Pair<String, List<PropagationStatus>> activate(StatusR statusR, boolean nullPriorityAsync);
 
@@ -38,11 +39,8 @@ public interface UserProvisioningManager extends ProvisioningManager<UserTO, Use
 
     void internalSuspend(String key);
 
-    Pair<String, List<PropagationStatus>> create(UserTO userTO, boolean storePassword, boolean nullPriorityAsync);
-
     Pair<String, List<PropagationStatus>> create(
-            UserTO userTO,
-            boolean storePassword,
+            UserCR userCR,
             boolean disablePwdPolicyCheck,
             Boolean enabled,
             Set<String> excludedResources,
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
index 6669188..2fb8cb6 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AnyObjectDataBinder.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api.data;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -29,7 +30,7 @@ public interface AnyObjectDataBinder {
 
     AnyObjectTO getAnyObjectTO(AnyObject anyObject, boolean details);
 
-    void create(AnyObject anyObject, AnyObjectTO anyObjectTO);
+    void create(AnyObject anyObject, AnyObjectCR anyObjectCR);
 
     PropagationByResource update(AnyObject toBeUpdated, AnyObjectUR anyObjectUR);
 }
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
index 0570af3..0b13456 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/GroupDataBinder.java
@@ -19,6 +19,7 @@
 package org.apache.syncope.core.provisioning.api.data;
 
 import java.util.Map;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.TypeExtensionTO;
@@ -34,7 +35,7 @@ public interface GroupDataBinder {
 
     GroupTO getGroupTO(Group group, boolean details);
 
-    void create(Group group, GroupTO groupTO);
+    void create(Group group, GroupCR groupCR);
 
     PropagationByResource update(Group group, GroupUR groupUR);
 
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
index fe9800b..43dc841 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/UserDataBinder.java
@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.provisioning.api.data;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -33,7 +34,7 @@ public interface UserDataBinder {
 
     UserTO getUserTO(User user, boolean details);
 
-    void create(User user, UserTO userTO, boolean storePassword);
+    void create(User user, UserCR userCR);
 
     /**
      * Update user, given {@link UserUR}.
diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
index 1bf9d0b..1a1a578 100644
--- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
+++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java
@@ -18,8 +18,10 @@
  */
 package org.apache.syncope.core.provisioning.api.pushpull;
 
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.EntityTO;
+import org.apache.syncope.common.lib.to.RealmTO;
 import org.identityconnectors.framework.common.objects.SyncDelta;
 import org.quartz.JobExecutionException;
 
@@ -48,13 +50,29 @@ public interface PullActions extends ProvisioningActions {
      *
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
-     * @param entity entity
+     * @param createReq create request
      * @throws JobExecutionException in case of generic failure
      */
     default void beforeProvision(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
-            EntityTO entity) throws JobExecutionException {
+            AnyCR createReq) throws JobExecutionException {
+    }
+
+    /**
+     * Action to be executed before to create a pulled realm locally.
+     * The realm is created locally upon pull in case of the un-matching rule
+     * {@link org.apache.syncope.common.lib.types.UnmatchingRule#PROVISION} (default un-matching rule) is applied.
+     *
+     * @param profile profile of the pull being executed.
+     * @param delta retrieved pull information
+     * @param realm realm
+     * @throws JobExecutionException in case of generic failure
+     */
+    default void beforeProvision(
+            ProvisioningProfile<?, ?> profile,
+            SyncDelta delta,
+            RealmTO realm) throws JobExecutionException {
     }
 
     /**
@@ -64,13 +82,29 @@ public interface PullActions extends ProvisioningActions {
      *
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
-     * @param entity entity
+     * @param createReq create request
      * @throws JobExecutionException in case of generic failure
      */
     default void beforeAssign(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
-            EntityTO entity) throws JobExecutionException {
+            AnyCR createReq) throws JobExecutionException {
+    }
+
+    /**
+     * Action to be executed before creating (and linking to the resource) a pulled realm locally.
+     * The realm is created locally and linked to the pulled resource upon pull in case of the
+     * un-matching rule {@link org.apache.syncope.common.lib.types.UnmatchingRule#ASSIGN} is applied.
+     *
+     * @param profile profile of the pull being executed.
+     * @param delta retrieved pull information
+     * @param realm realm
+     * @throws JobExecutionException in case of generic failure
+     */
+    default void beforeAssign(
+            ProvisioningProfile<?, ?> profile,
+            SyncDelta delta,
+            RealmTO realm) throws JobExecutionException {
     }
 
     /**
@@ -142,18 +176,17 @@ public interface PullActions extends ProvisioningActions {
      * The entity is updated upon pull in case of the matching rule
      * {@link org.apache.syncope.common.lib.types.MatchingRule#UPDATE} (default matching rule) is applied.
      *
-     * @param <P> any object modifications
      * @param profile profile of the pull being executed.
      * @param delta retrieved pull information
      * @param entity entity
      * @param anyUR modification
      * @throws JobExecutionException in case of generic failure.
      */
-    default <P extends AnyUR> void beforeUpdate(
+    default void beforeUpdate(
             ProvisioningProfile<?, ?> profile,
             SyncDelta delta,
             EntityTO entity,
-            P anyUR) throws JobExecutionException {
+            AnyUR anyUR) throws JobExecutionException {
     }
 
     /**
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
index b1be404..3f601e0 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java
@@ -24,9 +24,9 @@ import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
@@ -63,24 +63,24 @@ public class DefaultAnyObjectProvisioningManager implements AnyObjectProvisionin
 
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final boolean nullPriorityAsync) {
+            final AnyObjectCR anyObjectCR, final boolean nullPriorityAsync) {
 
-        return create(anyObjectTO, Collections.<String>emptySet(), nullPriorityAsync);
+        return create(anyObjectCR, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final Set<String> excludedResources, final boolean nullPriorityAsync) {
+            final AnyObjectCR anyObjectCR, final Set<String> excludedResources, final boolean nullPriorityAsync) {
 
-        WorkflowResult<String> created = awfAdapter.create(anyObjectTO);
+        WorkflowResult<String> created = awfAdapter.create(anyObjectCR);
 
         List<PropagationTaskInfo> taskInfos = propagationManager.getCreateTasks(
                 AnyTypeKind.ANY_OBJECT,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                anyObjectTO.getVirAttrs(),
+                anyObjectCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
index 69de66b..6b14f25 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java
@@ -28,9 +28,9 @@ import java.util.stream.Collectors;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
@@ -68,15 +68,15 @@ public class DefaultGroupProvisioningManager implements GroupProvisioningManager
     protected VirAttrHandler virtAttrHandler;
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
-        WorkflowResult<String> created = gwfAdapter.create(groupTO);
+    public Pair<String, List<PropagationStatus>> create(final GroupCR groupCR, final boolean nullPriorityAsync) {
+        WorkflowResult<String> created = gwfAdapter.create(groupCR);
 
         List<PropagationTaskInfo> tasks = propagationManager.getCreateTasks(
                 AnyTypeKind.GROUP,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                groupTO.getVirAttrs(),
+                groupCR.getVirAttrs(),
                 Collections.<String>emptySet());
         PropagationReporter propagationReporter = taskExecutor.execute(tasks, nullPriorityAsync);
 
@@ -86,23 +86,23 @@ public class DefaultGroupProvisioningManager implements GroupProvisioningManager
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final GroupTO groupTO,
+            final GroupCR groupCR,
             final Map<String, String> groupOwnerMap,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
 
-        WorkflowResult<String> created = gwfAdapter.create(groupTO);
+        WorkflowResult<String> created = gwfAdapter.create(groupCR);
 
         // see ConnObjectUtils#getAnyTOFromConnObject for GroupOwnerSchema
-        groupTO.getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
-                -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().iterator().next()));
+        groupCR.getPlainAttrs().stream().filter(attr -> StringUtils.EMPTY.equals(attr.getSchema())).findFirst().
+                ifPresent(groupOwner -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().get(0)));
 
         List<PropagationTaskInfo> tasks = propagationManager.getCreateTasks(
                 AnyTypeKind.GROUP,
                 created.getResult(),
                 null,
                 created.getPropByRes(),
-                groupTO.getVirAttrs(),
+                groupCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(tasks, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
index 4d1a69a..9847ed4 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java
@@ -29,9 +29,9 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
@@ -75,36 +75,27 @@ public class DefaultUserProvisioningManager implements UserProvisioningManager {
     protected UserDAO userDAO;
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final UserTO userTO, final boolean nullPriorityAsync) {
-        return create(userTO, true, false, null, Collections.<String>emptySet(), nullPriorityAsync);
-    }
-
-    @Override
-    public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return create(userTO, storePassword, false, null, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final UserCR userCR, final boolean nullPriorityAsync) {
+        return create(userCR, false, null, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
             final Boolean enabled,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
 
-        WorkflowResult<Pair<String, Boolean>> created =
-                uwfAdapter.create(userTO, disablePwdPolicyCheck, enabled, storePassword);
+        WorkflowResult<Pair<String, Boolean>> created = uwfAdapter.create(userCR, disablePwdPolicyCheck, enabled);
 
         List<PropagationTaskInfo> taskInfos = propagationManager.getUserCreateTasks(
                 created.getResult().getLeft(),
-                userTO.getPassword(),
+                userCR.getPassword(),
                 created.getResult().getRight(),
                 created.getPropByRes(),
-                userTO.getVirAttrs(),
+                userCR.getVirAttrs(),
                 excludedResources);
         PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
index a4b8443..c33e9db 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
@@ -31,6 +31,7 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
@@ -434,13 +435,13 @@ abstract class AbstractAnyDataBinder {
     @SuppressWarnings({ "unchecked", "rawtypes" })
     protected void fill(
             final Any any,
-            final AnyTO anyTO,
+            final AnyCR anyCR,
             final AnyUtils anyUtils,
             final SyncopeClientCompositeException scce) {
 
         // 0. aux classes
         any.getAuxClasses().clear();
-        anyTO.getAuxClasses().stream().
+        anyCR.getAuxClasses().stream().
                 map(className -> anyTypeClassDAO.find(className)).
                 forEachOrdered(auxClass -> {
                     if (auxClass == null) {
@@ -453,7 +454,7 @@ abstract class AbstractAnyDataBinder {
         // 1. attributes
         SyncopeClientException invalidValues = SyncopeClientException.build(ClientExceptionType.InvalidValues);
 
-        anyTO.getPlainAttrs().stream().
+        anyCR.getPlainAttrs().stream().
                 filter(attrTO -> !attrTO.getValues().isEmpty()).
                 forEach(attrTO -> {
                     PlainSchema schema = getPlainSchema(attrTO.getSchema());
@@ -484,7 +485,7 @@ abstract class AbstractAnyDataBinder {
         }
 
         // 2. resources
-        anyTO.getResources().forEach(resourceKey -> {
+        anyCR.getResources().forEach(resourceKey -> {
             ExternalResource resource = resourceDAO.find(resourceKey);
             if (resource == null) {
                 LOG.debug("Invalid " + ExternalResource.class.getSimpleName() + " {}, ignoring...", resourceKey);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
index a6e3f17..02325d6 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
@@ -31,6 +31,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -131,11 +132,11 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
     }
 
     @Override
-    public void create(final AnyObject anyObject, final AnyObjectTO anyObjectTO) {
-        AnyType type = anyTypeDAO.find(anyObjectTO.getType());
+    public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) {
+        AnyType type = anyTypeDAO.find(anyObjectCR.getType());
         if (type == null) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidAnyType);
-            sce.getElements().add(anyObjectTO.getType());
+            sce.getElements().add(anyObjectCR.getType());
             throw sce;
         }
         anyObject.setType(type);
@@ -144,19 +145,19 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
 
         // name
         SyncopeClientException invalidGroups = SyncopeClientException.build(ClientExceptionType.InvalidGroup);
-        if (anyObjectTO.getName() == null) {
+        if (anyObjectCR.getName() == null) {
             LOG.error("No name specified for this anyObject");
 
             invalidGroups.getElements().add("No name specified for this anyObject");
         } else {
-            anyObject.setName(anyObjectTO.getName());
+            anyObject.setName(anyObjectCR.getName());
         }
 
         // realm
-        Realm realm = realmDAO.findByFullPath(anyObjectTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(anyObjectCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + anyObjectTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + anyObjectCR.getRealm());
             scce.addException(noRealm);
         }
         anyObject.setRealm(realm);
@@ -164,7 +165,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
         AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.ANY_OBJECT);
         if (anyObject.getRealm() != null) {
             // relationships
-            anyObjectTO.getRelationships().forEach(relationshipTO -> {
+            anyObjectCR.getRelationships().forEach(relationshipTO -> {
                 if (StringUtils.isBlank(relationshipTO.getOtherEndType())
                         || AnyTypeKind.USER.name().equals(relationshipTO.getOtherEndType())
                         || AnyTypeKind.GROUP.name().equals(relationshipTO.getOtherEndType())) {
@@ -202,7 +203,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
             });
 
             // memberships
-            anyObjectTO.getMemberships().forEach(membershipTO -> {
+            anyObjectCR.getMemberships().forEach(membershipTO -> {
                 Group group = membershipTO.getGroupKey() == null
                         ? groupDAO.findByName(membershipTO.getGroupName())
                         : groupDAO.find(membershipTO.getGroupKey());
@@ -230,7 +231,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
         }
 
         // attributes and resources
-        fill(anyObject, anyObjectTO, anyUtils, scce);
+        fill(anyObject, anyObjectCR, anyUtils, scce);
 
         // Throw composite exception if there is at least one element set in the composing exceptions
         if (scce.hasExceptions()) {
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
index b960fd7..d14a7f5 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
@@ -27,6 +27,7 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.TypeExtensionTO;
@@ -95,54 +96,54 @@ public class GroupDataBinderImpl extends AbstractAnyDataBinder implements GroupD
     }
 
     @Override
-    public void create(final Group group, final GroupTO groupTO) {
+    public void create(final Group group, final GroupCR groupCR) {
         SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
 
         // name
         SyncopeClientException invalidGroups = SyncopeClientException.build(ClientExceptionType.InvalidGroup);
-        if (groupTO.getName() == null) {
+        if (groupCR.getName() == null) {
             LOG.error("No name specified for this group");
 
             invalidGroups.getElements().add("No name specified for this group");
         } else {
-            group.setName(groupTO.getName());
+            group.setName(groupCR.getName());
         }
 
         // realm
-        Realm realm = realmDAO.findByFullPath(groupTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(groupCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + groupTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + groupCR.getRealm());
             scce.addException(noRealm);
         }
         group.setRealm(realm);
 
         // attributes and resources
-        fill(group, groupTO, anyUtilsFactory.getInstance(AnyTypeKind.GROUP), scce);
+        fill(group, groupCR, anyUtilsFactory.getInstance(AnyTypeKind.GROUP), scce);
 
         // owner
-        if (groupTO.getUserOwner() != null) {
-            User owner = userDAO.find(groupTO.getUserOwner());
+        if (groupCR.getUserOwner() != null) {
+            User owner = userDAO.find(groupCR.getUserOwner());
             if (owner == null) {
-                LOG.warn("Ignoring invalid user specified as owner: {}", groupTO.getUserOwner());
+                LOG.warn("Ignoring invalid user specified as owner: {}", groupCR.getUserOwner());
             } else {
                 group.setUserOwner(owner);
             }
         }
-        if (groupTO.getGroupOwner() != null) {
-            Group owner = groupDAO.find(groupTO.getGroupOwner());
+        if (groupCR.getGroupOwner() != null) {
+            Group owner = groupDAO.find(groupCR.getGroupOwner());
             if (owner == null) {
-                LOG.warn("Ignoring invalid group specified as owner: {}", groupTO.getGroupOwner());
+                LOG.warn("Ignoring invalid group specified as owner: {}", groupCR.getGroupOwner());
             } else {
                 group.setGroupOwner(owner);
             }
         }
 
         // dynamic membership
-        if (groupTO.getUDynMembershipCond() != null) {
-            setDynMembership(group, anyTypeDAO.findUser(), groupTO.getUDynMembershipCond());
+        if (groupCR.getUDynMembershipCond() != null) {
+            setDynMembership(group, anyTypeDAO.findUser(), groupCR.getUDynMembershipCond());
         }
-        groupTO.getADynMembershipConds().forEach((type, fiql) -> {
+        groupCR.getADynMembershipConds().forEach((type, fiql) -> {
             AnyType anyType = anyTypeDAO.find(type);
             if (anyType == null) {
                 LOG.warn("Ignoring invalid {}: {}", AnyType.class.getSimpleName(), type);
@@ -152,7 +153,7 @@ public class GroupDataBinderImpl extends AbstractAnyDataBinder implements GroupD
         });
 
         // type extensions
-        groupTO.getTypeExtensions().forEach(typeExtTO -> {
+        groupCR.getTypeExtensions().forEach(typeExtTO -> {
             AnyType anyType = anyTypeDAO.find(typeExtTO.getAnyType());
             if (anyType == null) {
                 LOG.warn("Ignoring invalid {}: {}", AnyType.class.getSimpleName(), typeExtTO.getAnyType());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
index 0430295..5ae4b8b 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RemediationDataBinderImpl.java
@@ -37,8 +37,8 @@ public class RemediationDataBinderImpl implements RemediationDataBinder {
 
         switch (remediation.getOperation()) {
             case CREATE:
-                remediationTO.setAnyTOPayload(
-                        remediation.getPayloadAsTO(remediation.getAnyType().getKind().getTOClass()));
+                remediationTO.setAnyCRPayload(
+                        remediation.getPayloadAsCR(remediation.getAnyType().getKind().getCRClass()));
                 break;
 
             case UPDATE:
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
index c31bbbb..79e7e03 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
@@ -37,6 +37,7 @@ import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.MembershipTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -144,32 +145,32 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
     }
 
     @Override
-    public void create(final User user, final UserTO userTO, final boolean storePassword) {
+    public void create(final User user, final UserCR userCR) {
         SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
 
         // set username
-        user.setUsername(userTO.getUsername());
+        user.setUsername(userCR.getUsername());
 
         // set password
-        if (StringUtils.isBlank(userTO.getPassword()) || !storePassword) {
+        if (StringUtils.isBlank(userCR.getPassword()) || !userCR.isStorePassword()) {
             LOG.debug("Password was not provided or not required to be stored");
         } else {
-            setPassword(user, userTO.getPassword(), scce);
+            setPassword(user, userCR.getPassword(), scce);
         }
 
-        user.setMustChangePassword(userTO.isMustChangePassword());
+        user.setMustChangePassword(userCR.isMustChangePassword());
 
         // security question / answer
-        if (userTO.getSecurityQuestion() != null) {
-            SecurityQuestion securityQuestion = securityQuestionDAO.find(userTO.getSecurityQuestion());
+        if (userCR.getSecurityQuestion() != null) {
+            SecurityQuestion securityQuestion = securityQuestionDAO.find(userCR.getSecurityQuestion());
             if (securityQuestion != null) {
                 user.setSecurityQuestion(securityQuestion);
             }
         }
-        user.setSecurityAnswer(userTO.getSecurityAnswer());
+        user.setSecurityAnswer(userCR.getSecurityAnswer());
 
         // roles
-        userTO.getRoles().forEach(roleKey -> {
+        userCR.getRoles().forEach(roleKey -> {
             Role role = roleDAO.find(roleKey);
             if (role == null) {
                 LOG.warn("Ignoring unknown role with id {}", roleKey);
@@ -179,10 +180,10 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         });
 
         // realm
-        Realm realm = realmDAO.findByFullPath(userTO.getRealm());
+        Realm realm = realmDAO.findByFullPath(userCR.getRealm());
         if (realm == null) {
             SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
-            noRealm.getElements().add("Invalid or null realm specified: " + userTO.getRealm());
+            noRealm.getElements().add("Invalid or null realm specified: " + userCR.getRealm());
             scce.addException(noRealm);
         }
         user.setRealm(realm);
@@ -190,7 +191,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.USER);
         if (user.getRealm() != null) {
             // relationships
-            userTO.getRelationships().forEach(relationshipTO -> {
+            userCR.getRelationships().forEach(relationshipTO -> {
                 AnyObject otherEnd = anyObjectDAO.find(relationshipTO.getOtherEndKey());
                 if (otherEnd == null) {
                     LOG.debug("Ignoring invalid anyObject " + relationshipTO.getOtherEndKey());
@@ -217,7 +218,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
             });
 
             // memberships
-            userTO.getMemberships().forEach(membershipTO -> {
+            userCR.getMemberships().forEach(membershipTO -> {
                 Group group = membershipTO.getGroupKey() == null
                         ? groupDAO.findByName(membershipTO.getGroupName())
                         : groupDAO.find(membershipTO.getGroupKey());
@@ -245,7 +246,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
         }
 
         // attributes and resources
-        fill(user, userTO, anyUtils, scce);
+        fill(user, userCR, anyUtils, scce);
 
         // Throw composite exception if there is at least one element set in the composing exceptions
         if (scce.hasExceptions()) {
@@ -421,7 +422,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
                     plainAttrValueDAO.deleteAll(attr, anyUtils);
                     plainAttrDAO.delete(attr);
                 });
-                
+
                 if (membPatch.getOperation() == PatchOperation.DELETE) {
                     groupDAO.findAllResourceKeys(membership.getRightEnd().getKey()).stream().
                             filter(resource -> reasons.containsKey(resource)).
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
index a404e05..4fca9f2 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SetUMembershipsJob.java
@@ -22,7 +22,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.provisioning.api.UserProvisioningManager;
@@ -74,8 +74,7 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> before = membershipsBefore.get(user);
                         if (before == null || !before.contains(group)) {
-                            userUR.getMemberships().add(
-                                    new MembershipPatch.Builder().
+                            userUR.getMemberships().add(new MembershipUR.Builder().
                                             operation(PatchOperation.ADD_REPLACE).
                                             group(group).
                                             build());
@@ -95,8 +94,7 @@ public class SetUMembershipsJob extends AbstractInterruptableJob {
                     groups.forEach(group -> {
                         Set<String> after = membershipsAfter.get(user);
                         if (after == null || !after.contains(group)) {
-                            userUR.getMemberships().add(
-                                    new MembershipPatch.Builder().
+                            userUR.getMemberships().add(new MembershipUR.Builder().
                                             operation(PatchOperation.DELETE).
                                             group(group).
                                             build());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
index 566403c..22cfee1 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java
@@ -24,6 +24,7 @@ import java.util.Date;
 import java.util.List;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -99,11 +100,13 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
 
     protected abstract String getName(AnyTO anyTO);
 
-    protected abstract ProvisioningManager<?, ?> getProvisioningManager();
+    protected abstract String getName(AnyCR anyCR);
 
-    protected abstract AnyTO doCreate(AnyTO anyTO, SyncDelta delta);
+    protected abstract ProvisioningManager<?, ?, ?> getProvisioningManager();
 
-    protected abstract AnyUR doUpdate(AnyTO before, AnyUR req, SyncDelta delta, ProvisioningReport result);
+    protected abstract AnyTO doCreate(AnyCR anyCR, SyncDelta delta);
+
+    protected abstract AnyUR doUpdate(AnyTO before, AnyUR anyUR, SyncDelta delta, ProvisioningReport result);
 
     @Override
     public void setPullExecutor(final SyncopePullExecutor executor) {
@@ -182,14 +185,14 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             return Collections.<ProvisioningReport>emptyList();
         }
 
-        AnyTO anyTO = connObjectUtils.getAnyTO(delta.getObject(), profile.getTask(), provision, anyUtils);
-        anyTO.getResources().add(profile.getTask().getResource().getKey());
+        AnyCR anyCR = connObjectUtils.getAnyCR(delta.getObject(), profile.getTask(), provision, anyUtils);
+        anyCR.getResources().add(profile.getTask().getResource().getKey());
 
         ProvisioningReport result = new ProvisioningReport();
         result.setOperation(ResourceOperation.CREATE);
         result.setAnyType(provision.getAnyType().getKey());
         result.setStatus(ProvisioningReport.Status.SUCCESS);
-        result.setName(getName(anyTO));
+        result.setName(getName(anyCR));
         result.setUidValue(delta.getUid().getUidValue());
 
         if (profile.isDryRun()) {
@@ -197,10 +200,10 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             finalize(UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), Result.SUCCESS, null, null, delta);
         } else {
             for (PullActions action : profile.getActions()) {
-                action.beforeAssign(profile, delta, anyTO);
+                action.beforeAssign(profile, delta, anyCR);
             }
 
-            create(anyTO, delta, UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), provision, result);
+            create(anyCR, delta, UnmatchingRule.toEventName(UnmatchingRule.ASSIGN), provision, result);
         }
 
         return Collections.singletonList(result);
@@ -216,13 +219,13 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             return Collections.<ProvisioningReport>emptyList();
         }
 
-        AnyTO anyTO = connObjectUtils.getAnyTO(delta.getObject(), profile.getTask(), provision, anyUtils);
+        AnyCR anyCR = connObjectUtils.getAnyCR(delta.getObject(), profile.getTask(), provision, anyUtils);
 
         ProvisioningReport result = new ProvisioningReport();
         result.setOperation(ResourceOperation.CREATE);
         result.setAnyType(provision.getAnyType().getKey());
         result.setStatus(ProvisioningReport.Status.SUCCESS);
-        result.setName(getName(anyTO));
+        result.setName(getName(anyCR));
         result.setUidValue(delta.getUid().getUidValue());
 
         if (profile.isDryRun()) {
@@ -230,10 +233,10 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
             finalize(UnmatchingRule.toEventName(UnmatchingRule.PROVISION), Result.SUCCESS, null, null, delta);
         } else {
             for (PullActions action : profile.getActions()) {
-                action.beforeProvision(profile, delta, anyTO);
+                action.beforeProvision(profile, delta, anyCR);
             }
 
-            create(anyTO, delta, UnmatchingRule.toEventName(UnmatchingRule.PROVISION), provision, result);
+            create(anyCR, delta, UnmatchingRule.toEventName(UnmatchingRule.PROVISION), provision, result);
         }
 
         return Collections.singletonList(result);
@@ -258,7 +261,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
     }
 
     protected void create(
-            final AnyTO anyTO,
+            final AnyCR anyCR,
             final SyncDelta delta,
             final String operation,
             final Provision provision,
@@ -269,7 +272,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
         Result resultStatus;
 
         try {
-            AnyTO created = doCreate(anyTO, delta);
+            AnyTO created = doCreate(anyCR, delta);
             output = created;
             result.setKey(created.getKey());
             result.setName(getName(created));
@@ -283,7 +286,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
         } catch (PropagationException e) {
             // A propagation failure doesn't imply a pull failure.
             // The propagation exception status will be reported into the propagation task execution.
-            LOG.error("Could not propagate {} {}", anyTO.getType(), delta.getUid().getUidValue(), e);
+            LOG.error("Could not propagate {} {}", provision.getAnyType().getKey(), delta.getUid().getUidValue(), e);
             output = e;
             resultStatus = Result.FAILURE;
         } catch (Exception e) {
@@ -291,7 +294,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
 
             result.setStatus(ProvisioningReport.Status.FAILURE);
             result.setMessage(ExceptionUtils.getRootCauseMessage(e));
-            LOG.error("Could not create {} {} ", anyTO.getType(), delta.getUid().getUidValue(), e);
+            LOG.error("Could not create {} {} ", provision.getAnyType().getKey(), delta.getUid().getUidValue(), e);
             output = e;
             resultStatus = Result.FAILURE;
 
@@ -299,7 +302,7 @@ public abstract class AbstractPullResultHandler extends AbstractSyncopeResultHan
                 Remediation entity = entityFactory.newEntity(Remediation.class);
                 entity.setAnyType(provision.getAnyType());
                 entity.setOperation(ResourceOperation.CREATE);
-                entity.setPayload(anyTO);
+                entity.setPayload(anyCR);
                 entity.setError(result.getMessage());
                 entity.setInstant(new Date());
                 entity.setRemoteName(delta.getObject().getName().getNameValue());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
index f5251f0..d177613 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java
@@ -19,8 +19,10 @@
 package org.apache.syncope.core.provisioning.java.pushpull;
 
 import java.util.Optional;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -63,21 +65,21 @@ public class DBPasswordPullActions implements PullActions {
     public void beforeProvision(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
-            final EntityTO any) throws JobExecutionException {
+            final AnyCR anyCR) throws JobExecutionException {
 
-        if (any instanceof UserTO) {
-            String password = ((UserTO) any).getPassword();
+        if (anyCR instanceof UserCR) {
+            String password = ((UserCR) anyCR).getPassword();
             parseEncodedPassword(password, profile.getConnector());
         }
     }
 
     @Transactional(readOnly = true)
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (anyUR instanceof UserUR) {
             PasswordPatch modPassword = ((UserUR) anyUR).getPassword();
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
index 5fc6a17..08ae663 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultAnyObjectPullResultHandler.java
@@ -22,6 +22,8 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.to.AnyTO;
@@ -53,7 +55,12 @@ public class DefaultAnyObjectPullResultHandler extends AbstractPullResultHandler
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return AnyObjectCR.class.cast(anyCR).getName();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return anyObjectProvisioningManager;
     }
 
@@ -68,11 +75,11 @@ public class DefaultAnyObjectPullResultHandler extends AbstractPullResultHandler
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        AnyObjectTO anyObjectTO = AnyObjectTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        AnyObjectCR anyObjectCR = AnyObjectCR.class.cast(anyCR);
 
         Map.Entry<String, List<PropagationStatus>> created = anyObjectProvisioningManager.create(
-                anyObjectTO, Collections.singleton(profile.getTask().getResource().getKey()), true);
+                anyObjectCR, Collections.singleton(profile.getTask().getResource().getKey()), true);
 
         return getAnyTO(created.getKey());
     }
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
index 2cc291c..e4be81d 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultGroupPullResultHandler.java
@@ -23,8 +23,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -63,7 +65,12 @@ public class DefaultGroupPullResultHandler extends AbstractPullResultHandler imp
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return GroupCR.class.cast(anyCR).getName();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return groupProvisioningManager;
     }
 
@@ -78,11 +85,11 @@ public class DefaultGroupPullResultHandler extends AbstractPullResultHandler imp
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        GroupTO groupTO = GroupTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        GroupCR groupCR = GroupCR.class.cast(anyCR);
 
         Map.Entry<String, List<PropagationStatus>> created = groupProvisioningManager.create(
-                groupTO,
+                groupCR,
                 groupOwnerMap,
                 Collections.singleton(profile.getTask().getResource().getKey()),
                 true);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
index ede43f2..f16b77b 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java
@@ -22,7 +22,9 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -53,7 +55,12 @@ public class DefaultUserPullResultHandler extends AbstractPullResultHandler impl
     }
 
     @Override
-    protected ProvisioningManager<?, ?> getProvisioningManager() {
+    protected String getName(final AnyCR anyCR) {
+        return UserCR.class.cast(anyCR).getUsername();
+    }
+
+    @Override
+    protected ProvisioningManager<?, ?, ?> getProvisioningManager() {
         return userProvisioningManager;
     }
 
@@ -69,12 +76,12 @@ public class DefaultUserPullResultHandler extends AbstractPullResultHandler impl
     }
 
     @Override
-    protected AnyTO doCreate(final AnyTO anyTO, final SyncDelta delta) {
-        UserTO userTO = UserTO.class.cast(anyTO);
+    protected AnyTO doCreate(final AnyCR anyCR, final SyncDelta delta) {
+        UserCR userCR = UserCR.class.cast(anyCR);
 
         Boolean enabled = pullUtils.readEnabled(delta.getObject(), profile.getTask());
         Map.Entry<String, List<PropagationStatus>> created =
-                userProvisioningManager.create(userTO, true, true, enabled,
+                userProvisioningManager.create(userCR, true, enabled,
                         Collections.singleton(profile.getTask().getResource().getKey()), true);
 
         return getAnyTO(created.getKey());
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
index 969571d..b2a26af 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java
@@ -129,11 +129,11 @@ public class LDAPMembershipPullActions extends SchedulingPullActions {
      */
     @Transactional(readOnly = true)
     @Override
-    public <P extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entity,
-            final P anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (!(entity instanceof GroupTO)) {
             super.beforeUpdate(profile, delta, entity, anyUR);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
index fcc6384..3618cf8 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java
@@ -20,8 +20,10 @@ package org.apache.syncope.core.provisioning.java.pushpull;
 
 import java.util.Base64;
 import javax.xml.bind.DatatypeConverter;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -58,21 +60,21 @@ public class LDAPPasswordPullActions implements PullActions {
     public void beforeProvision(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
-            final EntityTO entity) throws JobExecutionException {
+            final AnyCR anyCR) throws JobExecutionException {
 
-        if (entity instanceof UserTO) {
-            String password = ((UserTO) entity).getPassword();
+        if (anyCR instanceof UserCR) {
+            String password = ((UserCR) anyCR).getPassword();
             parseEncodedPassword(password);
         }
     }
 
     @Transactional(readOnly = true)
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         if (anyUR instanceof UserUR) {
             PasswordPatch modPassword = ((UserUR) anyUR).getPassword();
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
index a7acb6f..d971f46 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java
@@ -25,7 +25,10 @@ import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -148,34 +151,34 @@ public class ConnObjectUtils {
     }
 
     /**
-     * Build a UserTO / GroupTO / AnyObjectTO out of connector object attributes and schema mapping.
+     * Build a UserCR / GroupCR / AnyObjectCR out of connector object attributes and schema mapping.
      *
      * @param obj connector object
      * @param pullTask pull task
      * @param provision provision information
      * @param anyUtils utils
-     * @param <T> any object
      * @return UserTO for the user to be created
      */
     @Transactional(readOnly = true)
-    public <T extends AnyTO> T getAnyTO(
+    public AnyCR getAnyCR(
             final ConnectorObject obj,
             final PullTask pullTask,
             final Provision provision,
             final AnyUtils anyUtils) {
 
-        T anyTO = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
+        AnyTO anyTO = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
+        AnyCR anyCR = anyUtils.newAnyCR();
+        EntityTOUtils.toAnyCR(anyTO, anyCR);
 
         // (for users) if password was not set above, generate if resource is configured for that
-        if (anyTO instanceof UserTO
-                && StringUtils.isBlank(((UserTO) anyTO).getPassword())
+        if (anyCR instanceof UserCR
+                && StringUtils.isBlank(((UserCR) anyCR).getPassword())
                 && provision.getResource().isRandomPwdIfNotProvided()) {
 
-            UserTO userTO = (UserTO) anyTO;
-
+            UserCR userCR = (UserCR) anyCR;
             List<PasswordPolicy> passwordPolicies = new ArrayList<>();
 
-            Realm realm = realmDAO.findByFullPath(userTO.getRealm());
+            Realm realm = realmDAO.findByFullPath(userCR.getRealm());
             if (realm != null) {
                 realmDAO.findAncestors(realm).stream().
                         filter(ancestor -> ancestor.getPasswordPolicy() != null).
@@ -184,7 +187,7 @@ public class ConnObjectUtils {
                         });
             }
 
-            userTO.getResources().stream().
+            userCR.getResources().stream().
                     map(resource -> resourceDAO.find(resource)).
                     filter(resource -> resource != null && resource.getPasswordPolicy() != null).
                     forEach(resource -> {
@@ -195,24 +198,14 @@ public class ConnObjectUtils {
             try {
                 password = passwordGenerator.generate(passwordPolicies);
             } catch (InvalidPasswordRuleConf e) {
-                LOG.error("Could not generate policy-compliant random password for {}", userTO, e);
+                LOG.error("Could not generate policy-compliant random password for {}", userCR, e);
 
                 password = SecureRandomUtils.generateRandomPassword(16);
             }
-            userTO.setPassword(password);
+            userCR.setPassword(password);
         }
 
-        return anyTO;
-    }
-
-    public RealmTO getRealmTO(final ConnectorObject obj, final PullTask task, final OrgUnit orgUnit) {
-        RealmTO realmTO = new RealmTO();
-
-        MappingUtils.getPullItems(orgUnit.getItems()).forEach(item -> {
-            mappingManager.setIntValues(item, obj.getAttributeByName(item.getExtAttrName()), realmTO);
-        });
-
-        return realmTO;
+        return anyCR;
     }
 
     /**
@@ -224,12 +217,12 @@ public class ConnObjectUtils {
      * @param pullTask pull task
      * @param provision provision information
      * @param anyUtils utils
-     * @param <T> any object
+     * @param <U> any object
      * @return modifications for the any object to be updated
      */
     @SuppressWarnings("unchecked")
     @Transactional(readOnly = true)
-    public <T extends AnyUR> T getAnyUR(
+    public <U extends AnyUR> U getAnyUR(
             final String key,
             final ConnectorObject obj,
             final AnyTO original,
@@ -240,7 +233,7 @@ public class ConnObjectUtils {
         AnyTO updated = getAnyTOFromConnObject(obj, pullTask, provision, anyUtils);
         updated.setKey(key);
 
-        T anyUR = null;
+        U anyUR = null;
         if (null != anyUtils.anyTypeKind()) {
             switch (anyUtils.anyTypeKind()) {
                 case USER:
@@ -263,7 +256,7 @@ public class ConnObjectUtils {
                     updatedUser.setSecurityQuestion(updatedUser.getSecurityQuestion());
                     updatedUser.setMustChangePassword(originalUser.isMustChangePassword());
 
-                    anyUR = (T) AnyOperations.diff(updatedUser, originalUser, true);
+                    anyUR = (U) AnyOperations.diff(updatedUser, originalUser, true);
                     break;
 
                 case GROUP:
@@ -279,7 +272,7 @@ public class ConnObjectUtils {
                     updatedGroup.getADynMembershipConds().putAll(originalGroup.getADynMembershipConds());
                     updatedGroup.getTypeExtensions().addAll(originalGroup.getTypeExtensions());
 
-                    anyUR = (T) AnyOperations.diff(updatedGroup, originalGroup, true);
+                    anyUR = (U) AnyOperations.diff(updatedGroup, originalGroup, true);
                     break;
 
                 case ANY_OBJECT:
@@ -290,7 +283,7 @@ public class ConnObjectUtils {
                         updatedAnyObject.setName(originalAnyObject.getName());
                     }
 
-                    anyUR = (T) AnyOperations.diff(updatedAnyObject, originalAnyObject, true);
+                    anyUR = (U) AnyOperations.diff(updatedAnyObject, originalAnyObject, true);
                     break;
 
                 default:
@@ -323,4 +316,14 @@ public class ConnObjectUtils {
 
         return anyTO;
     }
+
+    public RealmTO getRealmTO(final ConnectorObject obj, final PullTask task, final OrgUnit orgUnit) {
+        RealmTO realmTO = new RealmTO();
+
+        MappingUtils.getPullItems(orgUnit.getItems()).forEach(item -> {
+            mappingManager.setIntValues(item, obj.getAttributeByName(item.getExtAttrName()), realmTO);
+        });
+
+        return realmTO;
+    }
 }
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
index 228952d..65abf2f 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java
@@ -24,9 +24,12 @@ import org.apache.commons.jexl3.MapContext;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.AttrTO;
+import org.apache.syncope.common.lib.to.AttributableReqEntity;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.GroupableRelatableTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -66,7 +69,7 @@ public class TemplateUtils {
         return result;
     }
 
-    private void fill(final AnyTO anyTO, final AnyTO template) {
+    private void fill(final AttributableReqEntity anyTO, final AttributableReqEntity template) {
         MapContext jexlContext = new MapContext();
         JexlUtils.addFieldsToContext(anyTO, jexlContext);
         JexlUtils.addAttrTOsToContext(anyTO.getPlainAttrs(), jexlContext);
@@ -138,61 +141,81 @@ public class TemplateUtils {
     }
 
     @Transactional(readOnly = true)
-    public <T extends AnyTO> void apply(final T anyTO, final Optional<? extends AnyTemplate> anyTemplate) {
-        if (anyTemplate.isPresent()) {
-            apply(anyTO, anyTemplate.get().get());
+    public void apply(final AttributableReqEntity reqEntity, final Optional<? extends AnyTemplate> template) {
+        if (template.isPresent()) {
+            apply(reqEntity, template.get().get());
         }
     }
 
     @Transactional(readOnly = true)
-    public <T extends AnyTO> void apply(final T anyTO, final AnyTO template) {
-        fill(anyTO, template);
+    public void apply(final AttributableReqEntity reqEntity, final AnyTO template) {
+        fill(reqEntity, template);
 
         MapContext jexlContext = new MapContext();
-        JexlUtils.addFieldsToContext(anyTO, jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getPlainAttrs(), jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getDerAttrs(), jexlContext);
-        JexlUtils.addAttrTOsToContext(anyTO.getVirAttrs(), jexlContext);
+        JexlUtils.addFieldsToContext(reqEntity, jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getPlainAttrs(), jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getDerAttrs(), jexlContext);
+        JexlUtils.addAttrTOsToContext(reqEntity.getVirAttrs(), jexlContext);
 
         if (template instanceof AnyObjectTO) {
-            fillRelationships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            fillMemberships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
+            fillRelationships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            fillMemberships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
         } else if (template instanceof UserTO) {
             if (StringUtils.isNotBlank(((UserTO) template).getUsername())) {
                 String evaluated = JexlUtils.evaluate(((UserTO) template).getUsername(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((UserTO) anyTO).setUsername(evaluated);
+                    if (reqEntity instanceof UserTO) {
+                        ((UserTO) reqEntity).setUsername(evaluated);
+                    } else if (reqEntity instanceof UserCR) {
+                        ((UserCR) reqEntity).setUsername(evaluated);
+                    }
                 }
             }
 
             if (StringUtils.isNotBlank(((UserTO) template).getPassword())) {
                 String evaluated = JexlUtils.evaluate(((UserTO) template).getPassword(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((UserTO) anyTO).setPassword(evaluated);
+                    if (reqEntity instanceof UserTO) {
+                        ((UserTO) reqEntity).setPassword(evaluated);
+                    } else if (reqEntity instanceof UserCR) {
+                        ((UserCR) reqEntity).setPassword(evaluated);
+                    }
                 }
             }
 
-            fillRelationships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            fillMemberships((GroupableRelatableTO) anyTO, ((GroupableRelatableTO) template));
-            ((UserTO) anyTO).getRoles().addAll(((UserTO) template).getRoles());
+            fillRelationships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            fillMemberships((GroupableRelatableTO) reqEntity, ((GroupableRelatableTO) template));
+            ((UserTO) reqEntity).getRoles().addAll(((UserTO) template).getRoles());
         } else if (template instanceof GroupTO) {
             if (StringUtils.isNotBlank(((GroupTO) template).getName())) {
                 String evaluated = JexlUtils.evaluate(((GroupTO) template).getName(), jexlContext);
                 if (StringUtils.isNotBlank(evaluated)) {
-                    ((GroupTO) anyTO).setName(evaluated);
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setName(evaluated);
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setName(evaluated);
+                    }
                 }
             }
 
             if (((GroupTO) template).getUserOwner() != null) {
                 final User userOwner = userDAO.find(((GroupTO) template).getUserOwner());
                 if (userOwner != null) {
-                    ((GroupTO) anyTO).setUserOwner(userOwner.getKey());
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setUserOwner(userOwner.getKey());
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setUserOwner(userOwner.getKey());
+                    }
                 }
             }
             if (((GroupTO) template).getGroupOwner() != null) {
                 final Group groupOwner = groupDAO.find(((GroupTO) template).getGroupOwner());
                 if (groupOwner != null) {
-                    ((GroupTO) anyTO).setGroupOwner(groupOwner.getKey());
+                    if (reqEntity instanceof GroupTO) {
+                        ((GroupTO) reqEntity).setGroupOwner(groupOwner.getKey());
+                    } else if (reqEntity instanceof GroupCR) {
+                        ((GroupCR) reqEntity).setGroupOwner(groupOwner.getKey());
+                    }
                 }
             }
         }
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
index 79a2ac3..3277109 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java
@@ -29,6 +29,7 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
@@ -55,13 +56,13 @@ import org.apache.syncope.core.persistence.api.dao.search.SearchCond;
 import org.apache.syncope.core.provisioning.api.serialization.POJOHelper;
 import org.apache.syncope.core.spring.security.SecureRandomUtils;
 
-public abstract class AbstractAnyService<TO extends AnyTO, UR extends AnyUR>
+public abstract class AbstractAnyService<TO extends AnyTO, CR extends AnyCR, UR extends AnyUR>
         extends AbstractServiceImpl
         implements AnyService<TO> {
 
     protected abstract AnyDAO<?> getAnyDAO();
 
-    protected abstract AbstractAnyLogic<TO, UR> getAnyLogic();
+    protected abstract AbstractAnyLogic<TO, CR, UR> getAnyLogic();
 
     protected abstract UR newUpdateReq(String key);
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
index 8bcb7be..7660562 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java
@@ -21,6 +21,7 @@ package org.apache.syncope.core.rest.cxf.service;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.search.SpecialAttr;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -37,7 +38,8 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObjectUR> implements AnyObjectService {
+public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObjectCR, AnyObjectUR>
+        implements AnyObjectService {
 
     @Autowired
     private AnyObjectDAO anyObjectDAO;
@@ -51,7 +53,7 @@ public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObj
     }
 
     @Override
-    protected AbstractAnyLogic<AnyObjectTO, AnyObjectUR> getAnyLogic() {
+    protected AbstractAnyLogic<AnyObjectTO, AnyObjectCR, AnyObjectUR> getAnyLogic() {
         return logic;
     }
 
@@ -61,8 +63,8 @@ public class AnyObjectServiceImpl extends AbstractAnyService<AnyObjectTO, AnyObj
     }
 
     @Override
-    public Response create(final AnyObjectTO anyObjectTO) {
-        ProvisioningResult<AnyObjectTO> created = logic.create(anyObjectTO, isNullPriorityAsync());
+    public Response create(final AnyObjectCR createReq) {
+        ProvisioningResult<AnyObjectTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
index 3f453c5..855dd87 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
@@ -20,6 +20,7 @@ package org.apache.syncope.core.rest.cxf.service;
 
 import java.util.List;
 import javax.ws.rs.core.Response;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.ExecTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -34,7 +35,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> implements GroupService {
+public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupCR, GroupUR> implements GroupService {
 
     @Autowired
     private GroupDAO groupDAO;
@@ -48,7 +49,7 @@ public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> imple
     }
 
     @Override
-    protected AbstractAnyLogic<GroupTO, GroupUR> getAnyLogic() {
+    protected AbstractAnyLogic<GroupTO, GroupCR, GroupUR> getAnyLogic() {
         return logic;
     }
 
@@ -58,8 +59,8 @@ public class GroupServiceImpl extends AbstractAnyService<GroupTO, GroupUR> imple
     }
 
     @Override
-    public Response create(final GroupTO groupTO) {
-        ProvisioningResult<GroupTO> created = logic.create(groupTO, isNullPriorityAsync());
+    public Response create(final GroupCR createReq) {
+        ProvisioningResult<GroupTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
index e6965e5..a0141c5 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RemediationServiceImpl.java
@@ -22,8 +22,8 @@ import java.util.Date;
 import java.util.List;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
-import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.RemediationTO;
@@ -72,8 +72,8 @@ public class RemediationServiceImpl extends AbstractServiceImpl implements Remed
     }
 
     @Override
-    public Response remedy(final String remediationKey, final AnyTO anyTO) {
-        ProvisioningResult<?> created = logic.remedy(remediationKey, anyTO, isNullPriorityAsync());
+    public Response remedy(final String remediationKey, final AnyCR anyCR) {
+        ProvisioningResult<?> created = logic.remedy(remediationKey, anyCR, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
index 1227609..2a0e2d3 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
@@ -23,6 +23,7 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -44,14 +45,14 @@ public class UserSelfServiceImpl extends AbstractServiceImpl implements UserSelf
     private SyncopeLogic syncopeLogic;
 
     @Override
-    public Response create(final UserTO userTO, final boolean storePassword) {
+    public Response create(final UserCR createReq) {
         if (!syncopeLogic.isSelfRegAllowed()) {
             SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.DelegatedAdministration);
             sce.getElements().add("Self registration forbidden by configuration");
             throw sce;
         }
 
-        ProvisioningResult<UserTO> created = logic.selfCreate(userTO, storePassword, isNullPriorityAsync());
+        ProvisioningResult<UserTO> created = logic.selfCreate(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
index 29648f1..79d4023 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
@@ -21,6 +21,7 @@ package org.apache.syncope.core.rest.cxf.service;
 import java.util.Date;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -33,7 +34,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 @Service
-public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implements UserService {
+public class UserServiceImpl extends AbstractAnyService<UserTO, UserCR, UserUR> implements UserService {
 
     @Autowired
     private UserDAO userDAO;
@@ -47,7 +48,7 @@ public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implemen
     }
 
     @Override
-    protected AbstractAnyLogic<UserTO, UserUR> getAnyLogic() {
+    protected AbstractAnyLogic<UserTO, UserCR, UserUR> getAnyLogic() {
         return logic;
     }
 
@@ -57,8 +58,8 @@ public class UserServiceImpl extends AbstractAnyService<UserTO, UserUR> implemen
     }
 
     @Override
-    public Response create(final UserTO userTO, final boolean storePassword) {
-        ProvisioningResult<UserTO> created = logic.create(userTO, storePassword, isNullPriorityAsync());
+    public Response create(final UserCR createReq) {
+        ProvisioningResult<UserTO> created = logic.create(createReq, isNullPriorityAsync());
         return createResponse(created);
     }
 
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
index 4b3bbf8..8aaaefc 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java
@@ -18,9 +18,9 @@
  */
 package org.apache.syncope.core.workflow.api;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -30,10 +30,10 @@ public interface AnyObjectWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create a anyObject.
      *
-     * @param anyObjectTO anyObject to be created and whether to propagate it as active
+     * @param anyObjectCR anyObject to be created and whether to propagate it as active
      * @return anyObject just created
      */
-    WorkflowResult<String> create(AnyObjectTO anyObjectTO);
+    WorkflowResult<String> create(AnyObjectCR anyObjectCR);
 
     /**
      * Update a anyObject.
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
index dd7fe61..8743d26 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java
@@ -18,9 +18,9 @@
  */
 package org.apache.syncope.core.workflow.api;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.GroupTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -30,10 +30,10 @@ public interface GroupWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create a group.
      *
-     * @param groupTO group to be created and whether to propagate it as active
+     * @param groupCR group to be created and whether to propagate it as active
      * @return group just created
      */
-    WorkflowResult<String> create(GroupTO groupTO);
+    WorkflowResult<String> create(GroupCR groupCR);
 
     /**
      * Update a group.
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
index 57cb249..2c728c3 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
@@ -19,9 +19,9 @@
 package org.apache.syncope.core.workflow.api;
 
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import org.apache.syncope.common.lib.to.UserTO;
 
 /**
  * Interface for calling underlying workflow implementations.
@@ -31,23 +31,20 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
     /**
      * Create an user.
      *
-     * @param userTO user to be created and whether to propagate it as active
-     * @param storePassword whether password shall be stored into the internal storage
+     * @param userCR user to be created and whether to propagate it as active
      * @return user just created
      */
-    WorkflowResult<Pair<String, Boolean>> create(UserTO userTO, boolean storePassword);
+    WorkflowResult<Pair<String, Boolean>> create(UserCR userCR);
 
     /**
      * Create an user, optionally disabling password policy check.
      *
-     * @param userTO user to be created and whether to propagate it as active
+     * @param userCR user to be created and whether to propagate it as active
      * @param disablePwdPolicyCheck disable password policy check?
      * @param enabled specify true/false to force active/supended status
-     * @param storePassword whether password shall be stored into the internal storage
      * @return user just created
      */
-    WorkflowResult<Pair<String, Boolean>> create(
-            UserTO userTO, boolean disablePwdPolicyCheck, final Boolean enabled, boolean storePassword);
+    WorkflowResult<Pair<String, Boolean>> create(UserCR userCR, boolean disablePwdPolicyCheck, final Boolean enabled);
 
     /**
      * Activate an user.
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
index 0b4b66d..5b4a975 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject;
@@ -47,11 +47,11 @@ public abstract class AbstractAnyObjectWorkflowAdapter implements AnyObjectWorkf
         return null;
     }
 
-    protected abstract WorkflowResult<String> doCreate(AnyObjectTO anyObjectTO);
+    protected abstract WorkflowResult<String> doCreate(AnyObjectCR anyObjectCR);
 
     @Override
-    public WorkflowResult<String> create(final AnyObjectTO anyObjectTO) {
-        return doCreate(anyObjectTO);
+    public WorkflowResult<String> create(final AnyObjectCR anyObjectCR) {
+        return doCreate(anyObjectCR);
     }
 
     protected abstract WorkflowResult<AnyObjectUR> doUpdate(AnyObject anyObject, AnyObjectUR anyObjectUR);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
index ca8c6bb..27d3adf 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.group.Group;
@@ -47,11 +47,11 @@ public abstract class AbstractGroupWorkflowAdapter implements GroupWorkflowAdapt
         return null;
     }
 
-    protected abstract WorkflowResult<String> doCreate(GroupTO groupTO);
+    protected abstract WorkflowResult<String> doCreate(GroupCR groupCR);
 
     @Override
-    public WorkflowResult<String> create(final GroupTO groupTO) {
-        return doCreate(groupTO);
+    public WorkflowResult<String> create(final GroupCR groupCR) {
+        return doCreate(groupCR);
     }
 
     protected abstract WorkflowResult<GroupUR> doUpdate(Group group, GroupUR groupUR);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
index 33433d9..52af9a2 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
@@ -20,8 +20,8 @@ package org.apache.syncope.core.workflow.java;
 
 import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.user.User;
@@ -54,21 +54,20 @@ public abstract class AbstractUserWorkflowAdapter implements UserWorkflowAdapter
     }
 
     @Override
-    public WorkflowResult<Pair<String, Boolean>> create(final UserTO userTO, final boolean storePassword) {
-        return create(userTO, false, null, storePassword);
+    public WorkflowResult<Pair<String, Boolean>> create(final UserCR userCR) {
+        return create(userCR, false, null);
     }
 
     protected abstract WorkflowResult<Pair<String, Boolean>> doCreate(
-            UserTO userTO, boolean disablePwdPolicyCheck, Boolean enabled, boolean storePassword);
+            UserCR userCR, boolean disablePwdPolicyCheck, Boolean enabled);
 
     @Override
     public WorkflowResult<Pair<String, Boolean>> create(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
-        return doCreate(userTO, disablePwdPolicyCheck, enabled, storePassword);
+        return doCreate(userCR, disablePwdPolicyCheck, enabled);
     }
 
     protected abstract WorkflowResult<String> doActivate(User user, String token);
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
index 0cc7dd9..1439f25 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject;
@@ -31,9 +31,9 @@ import org.apache.syncope.core.provisioning.api.WorkflowResult;
 public class DefaultAnyObjectWorkflowAdapter extends AbstractAnyObjectWorkflowAdapter {
 
     @Override
-    protected WorkflowResult<String> doCreate(final AnyObjectTO anyObjectTO) {
+    protected WorkflowResult<String> doCreate(final AnyObjectCR anyObjectCR) {
         AnyObject anyObject = entityFactory.newEntity(AnyObject.class);
-        dataBinder.create(anyObject, anyObjectTO);
+        dataBinder.create(anyObject, anyObjectCR);
         anyObject = anyObjectDAO.save(anyObject);
 
         PropagationByResource propByRes = new PropagationByResource();
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
index 262dabc..691ee97 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.entity.group.Group;
@@ -31,9 +31,9 @@ import org.apache.syncope.core.provisioning.api.WorkflowResult;
 public class DefaultGroupWorkflowAdapter extends AbstractGroupWorkflowAdapter {
 
     @Override
-    protected WorkflowResult<String> doCreate(final GroupTO groupTO) {
+    protected WorkflowResult<String> doCreate(final GroupCR groupCR) {
         Group group = entityFactory.newEntity(Group.class);
-        dataBinder.create(group, groupTO);
+        dataBinder.create(group, groupCR);
         group = groupDAO.saveAndRefreshDynMemberships(group);
 
         PropagationByResource propByRes = new PropagationByResource();
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
index 76b7f58..b71c515 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
@@ -20,8 +20,8 @@ package org.apache.syncope.core.workflow.java;
 
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.PasswordPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.core.persistence.api.dao.ConfDAO;
@@ -40,13 +40,12 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
 
     @Override
     protected WorkflowResult<Pair<String, Boolean>> doCreate(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
         User user = entityFactory.newEntity(User.class);
-        dataBinder.create(user, userTO, storePassword);
+        dataBinder.create(user, userCR);
 
         // this will make UserValidator not to consider password policies at all
         if (disablePwdPolicyCheck) {
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
index 8cdfa37..a513955 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelAnyObjectProvisioningManager.java
@@ -27,9 +27,9 @@ import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.core.provisioning.api.AnyObjectProvisioningManager;
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
@@ -38,15 +38,15 @@ public class CamelAnyObjectProvisioningManager
         extends AbstractCamelProvisioningManager implements AnyObjectProvisioningManager {
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final AnyObjectTO any, final boolean nullPriorityAsync) {
-        return create(any, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final AnyObjectCR req, final boolean nullPriorityAsync) {
+        return create(req, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final AnyObjectTO anyObjectTO, final Set<String> excludedResources, final boolean nullPriorityAsync) {
+            final AnyObjectCR req, final Set<String> excludedResources, final boolean nullPriorityAsync) {
 
         PollingConsumer pollingConsumer = getConsumer("direct:createAnyObjectPort");
 
@@ -54,7 +54,7 @@ public class CamelAnyObjectProvisioningManager
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createAnyObject", anyObjectTO, props);
+        sendMessage("direct:createAnyObject", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
index ebb563c..c66eeef 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
@@ -27,9 +27,9 @@ import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.core.provisioning.api.GroupProvisioningManager;
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
@@ -39,14 +39,14 @@ public class CamelGroupProvisioningManager
 
     @Override
     @SuppressWarnings("unchecked")
-    public Pair<String, List<PropagationStatus>> create(final GroupTO groupTO, final boolean nullPriorityAsync) {
+    public Pair<String, List<PropagationStatus>> create(final GroupCR req, final boolean nullPriorityAsync) {
         PollingConsumer pollingConsumer = getConsumer("direct:createGroupPort");
 
         Map<String, Object> props = new HashMap<>();
         props.put("excludedResources", Collections.<String>emptySet());
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createGroup", groupTO, props);
+        sendMessage("direct:createGroup", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
@@ -61,7 +61,7 @@ public class CamelGroupProvisioningManager
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final GroupTO groupTO,
+            final GroupCR req,
             final Map<String, String> groupOwnerMap,
             final Set<String> excludedResources,
             final boolean nullPriorityAsync) {
@@ -73,7 +73,7 @@ public class CamelGroupProvisioningManager
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createGroupInPull", groupTO, props);
+        sendMessage("direct:createGroupInPull", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
index b2ca24b..4540ac8 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
@@ -29,9 +29,9 @@ import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.StatusR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.PropagationStatus;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
 import org.apache.syncope.core.provisioning.api.UserProvisioningManager;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
@@ -46,23 +46,15 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
     private static final Logger LOG = LoggerFactory.getLogger(CamelUserProvisioningManager.class);
 
     @Override
-    public Pair<String, List<PropagationStatus>> create(final UserTO userTO, final boolean nullPriorityAsync) {
-        return create(userTO, true, false, null, Collections.<String>emptySet(), nullPriorityAsync);
-    }
-
-    @Override
-    public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO, final boolean storePassword, final boolean nullPriorityAsync) {
-
-        return create(userTO, storePassword, false, null, Collections.<String>emptySet(), nullPriorityAsync);
+    public Pair<String, List<PropagationStatus>> create(final UserCR req, final boolean nullPriorityAsync) {
+        return create(req, false, null, Collections.<String>emptySet(), nullPriorityAsync);
     }
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     @Override
     @SuppressWarnings("unchecked")
     public Pair<String, List<PropagationStatus>> create(
-            final UserTO userTO,
-            final boolean storePassword,
+            final UserCR req,
             final boolean disablePwdPolicyCheck,
             final Boolean enabled,
             final Set<String> excludedResources,
@@ -71,13 +63,12 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
         PollingConsumer pollingConsumer = getConsumer("direct:createPort");
 
         Map<String, Object> props = new HashMap<>();
-        props.put("storePassword", storePassword);
         props.put("disablePwdPolicyCheck", disablePwdPolicyCheck);
         props.put("enabled", enabled);
         props.put("excludedResources", excludedResources);
         props.put("nullPriorityAsync", nullPriorityAsync);
 
-        sendMessage("direct:createUser", userTO, props);
+        sendMessage("direct:createUser", req, props);
 
         Exchange exchange = pollingConsumer.receive();
 
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
index 95c1b2d..4f86cff 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/producer/CreateProducer.java
@@ -25,10 +25,10 @@ import org.apache.camel.Endpoint;
 import org.apache.camel.Exchange;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
-import org.apache.syncope.common.lib.to.AnyTO;
-import org.apache.syncope.common.lib.to.GroupTO;
-import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
 import org.apache.syncope.core.provisioning.api.propagation.PropagationReporter;
@@ -48,27 +48,27 @@ public class CreateProducer extends AbstractProducer {
             Set<String> excludedResources = exchange.getProperty("excludedResources", Set.class);
             Boolean nullPriorityAsync = exchange.getProperty("nullPriorityAsync", Boolean.class);
 
-            if (actual instanceof UserTO) {
+            if (actual instanceof UserCR) {
                 WorkflowResult<Pair<String, Boolean>> created =
                         (WorkflowResult<Pair<String, Boolean>>) exchange.getIn().getBody();
 
                 List<PropagationTaskInfo> taskInfos = getPropagationManager().getUserCreateTasks(
                         created.getResult().getKey(),
-                        ((UserTO) actual).getPassword(),
+                        ((UserCR) actual).getPassword(),
                         created.getResult().getValue(),
                         created.getPropByRes(),
-                        ((UserTO) actual).getVirAttrs(),
+                        ((UserCR) actual).getVirAttrs(),
                         excludedResources);
                 PropagationReporter reporter = getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
                 exchange.getOut().setBody(
                         Pair.of(created.getResult().getKey(), reporter.getStatuses()));
-            } else if (actual instanceof AnyTO) {
+            } else if (actual instanceof AnyCR) {
                 WorkflowResult<String> created = (WorkflowResult<String>) exchange.getIn().getBody();
 
-                if (actual instanceof GroupTO && isPull()) {
+                if (actual instanceof GroupCR && isPull()) {
                     Map<String, String> groupOwnerMap = exchange.getProperty("groupOwnerMap", Map.class);
-                    ((GroupTO) actual).getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
+                    ((GroupCR) actual).getPlainAttr(StringUtils.EMPTY).ifPresent(groupOwner
                             -> groupOwnerMap.put(created.getResult(), groupOwner.getValues().iterator().next()));
 
                     List<PropagationTaskInfo> taskInfos = getPropagationManager().getCreateTasks(
@@ -76,18 +76,18 @@ public class CreateProducer extends AbstractProducer {
                             created.getResult(),
                             null,
                             created.getPropByRes(),
-                            ((AnyTO) actual).getVirAttrs(),
+                            ((AnyCR) actual).getVirAttrs(),
                             excludedResources);
                     getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
                     exchange.getOut().setBody(Pair.of(created.getResult(), null));
                 } else {
                     List<PropagationTaskInfo> taskInfos = getPropagationManager().getCreateTasks(
-                            actual instanceof AnyObjectTO ? AnyTypeKind.ANY_OBJECT : AnyTypeKind.GROUP,
+                            actual instanceof AnyObjectCR ? AnyTypeKind.ANY_OBJECT : AnyTypeKind.GROUP,
                             created.getResult(),
                             null,
                             created.getPropByRes(),
-                            ((AnyTO) actual).getVirAttrs(),
+                            ((AnyCR) actual).getVirAttrs(),
                             excludedResources);
                     PropagationReporter reporter = getPropagationTaskExecutor().execute(taskInfos, nullPriorityAsync);
 
diff --git a/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml b/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
index 05f581c..d7c3afd 100644
--- a/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
+++ b/ext/camel/provisioning-camel/src/main/resources/userRoutes.xml
@@ -25,7 +25,7 @@ under the License.
       <simple>${body}</simple>
     </setProperty>
     <doTry>
-      <bean method="create(${body},${property.disablePwdPolicyCheck},${property.enabled},${property.storePassword})"
+      <bean method="create(${body},${property.disablePwdPolicyCheck},${property.enabled})"
             ref="uwfAdapter" />
       <to uri="propagate:create?anyTypeKind=USER"/>
       <to uri="direct:createPort"/>
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
index 093baf8..78f9e8f 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableRuntimeUtils.java
@@ -55,6 +55,8 @@ public final class FlowableRuntimeUtils {
 
     public static final String FORM_SUBMITTER = "formSubmitter";
 
+    public static final String USER_CR = "userCR";
+
     public static final String USER_TO = "userTO";
 
     public static final String ENABLED = "enabled";
@@ -73,8 +75,6 @@ public final class FlowableRuntimeUtils {
 
     public static final String ENCRYPTED_PWD = "encryptedPwd";
 
-    public static final String STORE_PASSWORD = "storePassword";
-
     public static final String EVENT = "event";
 
     public static String encrypt(final String clear) {
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
index 446aad4..6ab00df 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java
@@ -26,8 +26,8 @@ import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.to.WorkflowTask;
 import org.apache.syncope.common.lib.to.WorkflowTaskExecInput;
 import org.apache.syncope.core.provisioning.api.PropagationByResource;
@@ -82,16 +82,14 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
 
     @Override
     protected WorkflowResult<Pair<String, Boolean>> doCreate(
-            final UserTO userTO,
+            final UserCR userCR,
             final boolean disablePwdPolicyCheck,
-            final Boolean enabled,
-            final boolean storePassword) {
+            final Boolean enabled) {
 
         Map<String, Object> variables = new HashMap<>();
         variables.put(FlowableRuntimeUtils.WF_EXECUTOR, AuthContextUtils.getUsername());
-        variables.put(FlowableRuntimeUtils.USER_TO, userTO);
+        variables.put(FlowableRuntimeUtils.USER_CR, userCR);
         variables.put(FlowableRuntimeUtils.ENABLED, enabled);
-        variables.put(FlowableRuntimeUtils.STORE_PASSWORD, storePassword);
 
         ProcessInstance procInst = null;
         try {
@@ -105,9 +103,9 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
         engine.getRuntimeService().removeVariable(
                 procInst.getProcessInstanceId(), FlowableRuntimeUtils.WF_EXECUTOR);
         engine.getRuntimeService().removeVariable(
-                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_TO);
+                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_CR);
         engine.getRuntimeService().removeVariable(
-                procInst.getProcessInstanceId(), FlowableRuntimeUtils.STORE_PASSWORD);
+                procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER_TO);
 
         User user = engine.getRuntimeService().
                 getVariable(procInst.getProcessInstanceId(), FlowableRuntimeUtils.USER, User.class);
@@ -149,7 +147,7 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
                 procInst.getProcessInstanceId(),
                 created,
                 dataBinder.getUserTO(created, true),
-                userTO.getPassword(),
+                userCR.getPassword(),
                 enabled,
                 propByRes);
 
@@ -413,8 +411,8 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp
         FlowableRuntimeUtils.updateStatus(engine, procInstID, user);
         user = userDAO.save(user);
 
-        engine.getRuntimeService().setVariable(
-                procInstID, FlowableRuntimeUtils.USER_TO, dataBinder.getUserTO(user, true));
+        engine.getRuntimeService().setVariable(procInstID, FlowableRuntimeUtils.USER_TO, dataBinder.
+                getUserTO(user, true));
 
         if (engine.getRuntimeService().createProcessInstanceQuery().
                 processInstanceId(procInstID).active().list().isEmpty()) {
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
index d5fcd41..1d92553 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableWorkflowUtils.java
@@ -22,14 +22,12 @@ import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.flowable.support.DomainProcessEngine;
 import org.apache.syncope.core.persistence.api.entity.user.User;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.transaction.annotation.Transactional;
 
 public class FlowableWorkflowUtils {
 
     @Autowired
     protected DomainProcessEngine engine;
 
-    @Transactional(readOnly = true)
     public boolean isUserIngroup(final UserTO user, final String groupName) {
         return user.getMemberships().stream().
                 anyMatch(membership -> groupName != null && groupName.equals(membership.getGroupName()));
diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
index f3bd848..a31cdf4 100644
--- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
+++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/Create.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.core.flowable.task;
 
-import org.apache.syncope.common.lib.to.UserTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
 import org.apache.syncope.core.persistence.api.entity.user.User;
 import org.apache.syncope.core.provisioning.api.data.UserDataBinder;
@@ -38,12 +38,11 @@ public class Create extends FlowableServiceTask {
 
     @Override
     protected void doExecute(final DelegateExecution execution) {
-        UserTO userTO = execution.getVariable(FlowableRuntimeUtils.USER_TO, UserTO.class);
-        Boolean storePassword = execution.getVariable(FlowableRuntimeUtils.STORE_PASSWORD, Boolean.class);
+        UserCR userCR = execution.getVariable(FlowableRuntimeUtils.USER_CR, UserCR.class);
 
         // create user
         User user = entityFactory.newEntity(User.class);
-        dataBinder.create(user, userTO, storePassword == null ? true : storePassword);
+        dataBinder.create(user, userCR);
 
         // report user as result
         execution.setVariable(FlowableRuntimeUtils.USER, user);
diff --git a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
index 1d57761..2df0dfd 100644
--- a/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
+++ b/ext/oidcclient/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java
@@ -27,7 +27,9 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
@@ -238,27 +240,30 @@ public class OIDCUserManager {
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     public String create(final OIDCProvider op, final OIDCLoginResponseTO responseTO, final String email) {
-        UserTO userTO = new UserTO();
+        UserCR userCR = new UserCR();
+        userCR.setStorePassword(false);
 
         if (op.getUserTemplate() != null && op.getUserTemplate().get() != null) {
-            templateUtils.apply(userTO, op.getUserTemplate().get());
+            templateUtils.apply(userCR, op.getUserTemplate().get());
         }
 
         List<OIDCProviderActions> actions = getActions(op);
         for (OIDCProviderActions action : actions) {
-            userTO = action.beforeCreate(userTO, responseTO);
+            userCR = action.beforeCreate(userCR, responseTO);
         }
 
+        UserTO userTO = new UserTO();
+        EntityTOUtils.toAnyTO(userCR, userTO);
         fill(op, responseTO, userTO);
 
-        if (userTO.getRealm() == null) {
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        if (userCR.getRealm() == null) {
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
         }
-        if (userTO.getUsername() == null) {
-            userTO.setUsername(email);
+        if (userCR.getUsername() == null) {
+            userCR.setUsername(email);
         }
 
-        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userTO, false, false);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userCR, false);
         userTO = binder.getUserTO(created.getKey());
 
         for (OIDCProviderActions action : actions) {
diff --git a/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java b/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
index 05945b3..45a3f3b 100644
--- a/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
+++ b/ext/oidcclient/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/OIDCProviderActions.java
@@ -18,18 +18,18 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
 import org.apache.syncope.common.lib.to.UserTO;
 
 public interface OIDCProviderActions {
 
-    UserTO beforeCreate(UserTO input, OIDCLoginResponseTO loginResponse);
+    UserCR beforeCreate(UserCR input, OIDCLoginResponseTO loginResponse);
 
     UserTO afterCreate(UserTO input, OIDCLoginResponseTO loginResponse);
 
     UserUR beforeUpdate(UserUR input, OIDCLoginResponseTO loginResponse);
 
     UserTO afterUpdate(UserTO input, OIDCLoginResponseTO loginResponse);
-
 }
diff --git a/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java b/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java
deleted file mode 100644
index 2150567..0000000
--- a/ext/oidcclient/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultOIDCProviderActions.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.syncope.core.provisioning.java;
-
-import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.OIDCLoginResponseTO;
-import org.apache.syncope.common.lib.to.UserTO;
-import org.apache.syncope.core.provisioning.api.OIDCProviderActions;
-
-public class DefaultOIDCProviderActions implements OIDCProviderActions {
-
-    @Override
-    public UserTO beforeCreate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserTO afterCreate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserUR beforeUpdate(final UserUR input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-    @Override
-    public UserTO afterUpdate(final UserTO input, final OIDCLoginResponseTO loginResponse) {
-        return input;
-    }
-
-}
diff --git a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
index 1b48d10..7cc36e2 100644
--- a/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
+++ b/ext/saml2sp/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2UserManager.java
@@ -27,7 +27,9 @@ import java.util.stream.Collectors;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.AnyOperations;
+import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -252,27 +254,30 @@ public class SAML2UserManager {
 
     @Transactional(propagation = Propagation.REQUIRES_NEW)
     public String create(final SAML2IdPEntity idp, final SAML2LoginResponseTO responseTO, final String nameID) {
-        UserTO userTO = new UserTO();
+        UserCR userCR = new UserCR();
+        userCR.setStorePassword(false);
 
         if (idp.getUserTemplate() != null) {
-            templateUtils.apply(userTO, idp.getUserTemplate());
+            templateUtils.apply(userCR, idp.getUserTemplate());
         }
 
         List<SAML2IdPActions> actions = getActions(idp);
         for (SAML2IdPActions action : actions) {
-            userTO = action.beforeCreate(userTO, responseTO);
+            userCR = action.beforeCreate(userCR, responseTO);
         }
 
+        UserTO userTO = new UserTO();
+        EntityTOUtils.toAnyTO(userCR, userTO);
         fill(idp.getKey(), responseTO, userTO);
 
-        if (userTO.getRealm() == null) {
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        if (userCR.getRealm() == null) {
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
         }
-        if (userTO.getUsername() == null) {
-            userTO.setUsername(nameID);
+        if (userCR.getUsername() == null) {
+            userCR.setUsername(nameID);
         }
 
-        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userTO, false, false);
+        Pair<String, List<PropagationStatus>> created = provisioningManager.create(userCR, false);
         userTO = binder.getUserTO(created.getKey());
 
         for (SAML2IdPActions action : actions) {
diff --git a/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java b/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
index 0decd0c..dddc6dc 100644
--- a/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
+++ b/ext/saml2sp/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/SAML2IdPActions.java
@@ -18,13 +18,14 @@
  */
 package org.apache.syncope.core.provisioning.api;
 
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.SAML2LoginResponseTO;
 import org.apache.syncope.common.lib.to.UserTO;
 
 public interface SAML2IdPActions {
 
-    default UserTO beforeCreate(UserTO input, SAML2LoginResponseTO loginResponse) {
+    default UserCR beforeCreate(UserCR input, SAML2LoginResponseTO loginResponse) {
         return input;
     }
 
diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
index efb1b33..bf122d5 100644
--- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
+++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java
@@ -24,14 +24,15 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.scim.SCIMComplexConf;
 import org.apache.syncope.common.lib.scim.SCIMConf;
-import org.apache.syncope.common.lib.scim.SCIMUserAddressConf;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
@@ -491,36 +492,29 @@ public class SCIMDataBinder {
             }
 
             if (conf.getUserConf().getDisplayName() != null && user.getDisplayName() != null) {
-                setAttribute(userTO, conf.getUserConf().getDisplayName(),
-                        user.getDisplayName());
+                setAttribute(userTO, conf.getUserConf().getDisplayName(), user.getDisplayName());
             }
             if (conf.getUserConf().getNickName() != null && user.getNickName() != null) {
-                setAttribute(userTO, conf.getUserConf().getNickName(),
-                        user.getNickName());
+                setAttribute(userTO, conf.getUserConf().getNickName(), user.getNickName());
             }
             if (conf.getUserConf().getProfileUrl() != null && user.getProfileUrl() != null) {
-                setAttribute(userTO, conf.getUserConf().getProfileUrl(),
-                        user.getProfileUrl());
+                setAttribute(userTO, conf.getUserConf().getProfileUrl(), user.getProfileUrl());
             }
             if (conf.getUserConf().getTitle() != null && user.getTitle() != null) {
                 setAttribute(userTO, conf.getUserConf().getTitle(),
                         user.getTitle());
             }
             if (conf.getUserConf().getUserType() != null && user.getUserType() != null) {
-                setAttribute(userTO, conf.getUserConf().getUserType(),
-                        user.getUserType());
+                setAttribute(userTO, conf.getUserConf().getUserType(), user.getUserType());
             }
             if (conf.getUserConf().getPreferredLanguage() != null && user.getPreferredLanguage() != null) {
-                setAttribute(userTO, conf.getUserConf().getPreferredLanguage(),
-                        user.getPreferredLanguage());
+                setAttribute(userTO, conf.getUserConf().getPreferredLanguage(), user.getPreferredLanguage());
             }
             if (conf.getUserConf().getLocale() != null && user.getLocale() != null) {
-                setAttribute(userTO, conf.getUserConf().getLocale(),
-                        user.getLocale());
+                setAttribute(userTO, conf.getUserConf().getLocale(), user.getLocale());
             }
             if (conf.getUserConf().getTimezone() != null && user.getTimezone() != null) {
-                setAttribute(userTO, conf.getUserConf().getTimezone(),
-                        user.getTimezone());
+                setAttribute(userTO, conf.getUserConf().getTimezone(), user.getTimezone());
             }
 
             fill(userTO.getPlainAttrs(), conf.getUserConf().getEmails(), user.getEmails());
@@ -529,41 +523,34 @@ public class SCIMDataBinder {
             fill(userTO.getPlainAttrs(), conf.getUserConf().getPhotos(), user.getPhotos());
 
             user.getAddresses().stream().filter(address -> address.getType() != null).forEach(address -> {
-                Optional<SCIMUserAddressConf> addressConf = conf.getUserConf().getAddresses().stream().
-                        filter(object -> address.getType().equals(object.getType().name())).findFirst();
-                if (addressConf.isPresent()) {
-                    if (addressConf.get().getFormatted() != null && address.getFormatted() != null) {
-                        setAttribute(userTO, addressConf.get().getFormatted(),
-                                address.getFormatted());
-                    }
-                    if (addressConf.get().getStreetAddress() != null && address.getStreetAddress() != null) {
-                        setAttribute(userTO, addressConf.get().getStreetAddress(),
-                                address.getStreetAddress());
-                    }
-                    if (addressConf.get().getLocality() != null && address.getLocality() != null) {
-                        setAttribute(userTO, addressConf.get().getLocality(),
-                                address.getLocality());
-                    }
-                    if (addressConf.get().getRegion() != null && address.getRegion() != null) {
-                        setAttribute(userTO, addressConf.get().getRegion(),
-                                address.getRegion());
-                    }
-                    if (addressConf.get().getPostalCode() != null && address.getPostalCode() != null) {
-                        setAttribute(userTO, addressConf.get().getPostalCode(),
-                                address.getPostalCode());
-                    }
-                    if (addressConf.get().getCountry() != null && address.getCountry() != null) {
-                        setAttribute(userTO, addressConf.get().getCountry(),
-                                address.getCountry());
-                    }
-                }
+                conf.getUserConf().getAddresses().stream().
+                        filter(object -> address.getType().equals(object.getType().name())).findFirst().
+                        ifPresent(addressConf -> {
+                            if (addressConf.getFormatted() != null && address.getFormatted() != null) {
+                                setAttribute(userTO, addressConf.getFormatted(), address.getFormatted());
+                            }
+                            if (addressConf.getStreetAddress() != null && address.getStreetAddress() != null) {
+                                setAttribute(userTO, addressConf.getStreetAddress(), address.getStreetAddress());
+                            }
+                            if (addressConf.getLocality() != null && address.getLocality() != null) {
+                                setAttribute(userTO, addressConf.getLocality(), address.getLocality());
+                            }
+                            if (addressConf.getRegion() != null && address.getRegion() != null) {
+                                setAttribute(userTO, addressConf.getRegion(), address.getRegion());
+                            }
+                            if (addressConf.getPostalCode() != null && address.getPostalCode() != null) {
+                                setAttribute(userTO, addressConf.getPostalCode(), address.getPostalCode());
+                            }
+                            if (addressConf.getCountry() != null && address.getCountry() != null) {
+                                setAttribute(userTO, addressConf.getCountry(), address.getCountry());
+                            }
+                        });
             });
 
             for (int i = 0; i < user.getX509Certificates().size(); i++) {
                 Value certificate = user.getX509Certificates().get(i);
                 if (conf.getUserConf().getX509Certificates().size() > i) {
-                    setAttribute(userTO, conf.getUserConf().getX509Certificates().get(i),
-                            certificate.getValue());
+                    setAttribute(userTO, conf.getUserConf().getX509Certificates().get(i), certificate.getValue());
                 }
             }
         }
@@ -609,17 +596,30 @@ public class SCIMDataBinder {
             }
         }
 
-        user.getGroups().forEach(group -> {
-            userTO.getMemberships().add(new MembershipTO.Builder().group(group.getValue()).build());
-        });
+        userTO.getMemberships().addAll(user.getGroups().stream().
+                map(group -> new MembershipTO.Builder().group(group.getValue()).build()).
+                collect(Collectors.toList()));
 
-        user.getRoles().forEach(role -> {
-            userTO.getRoles().add(role.getValue());
-        });
+        userTO.getRoles().addAll(user.getRoles().stream().
+                map(Value::getValue).
+                collect(Collectors.toList()));
 
         return userTO;
     }
 
+    public UserCR toUserCR(final SCIMUser user) {
+        UserTO userTO = toUserTO(user);
+
+        return new UserCR.Builder().
+                username(userTO.getUsername()).
+                password(userTO.getPassword()).
+                realm(userTO.getRealm()).
+                plainAttrs(userTO.getPlainAttrs()).
+                memberships(userTO.getMemberships()).
+                roles(userTO.getRoles()).
+                build();
+    }
+
     private void setAttribute(final UserTO userTO, final String schema, final String value) {
         switch (schema) {
             case "username":
@@ -690,4 +690,11 @@ public class SCIMDataBinder {
         return groupTO;
     }
 
+    public GroupCR toGroupCR(final SCIMGroup group) {
+        if (!GROUP_SCHEMAS.equals(group.getSchemas())) {
+            throw new BadRequestException(ErrorType.invalidValue);
+        }
+
+        return new GroupCR.Builder().realm(SyncopeConstants.ROOT_REALM).name(group.getDisplayName()).build();
+    }
 }
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
index 6bec6e2..6ab1e8d 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java
@@ -136,7 +136,7 @@ abstract class AbstractService<R extends SCIMResource> {
         }
     }
 
-    protected AbstractAnyLogic<?, ?> anyLogic(final Resource type) {
+    protected AbstractAnyLogic<?, ?, ?> anyLogic(final Resource type) {
         switch (type) {
             case User:
                 return userLogic();
@@ -239,8 +239,7 @@ abstract class AbstractService<R extends SCIMResource> {
                         request.getAttributes(),
                         request.getExcludedAttributes());
             } else if (anyTO instanceof GroupTO) {
-                resource = binder().toSCIMGroup(
-                        (GroupTO) anyTO,
+                resource = binder().toSCIMGroup((GroupTO) anyTO,
                         uriInfo.getAbsolutePathBuilder().path(anyTO.getKey()).build().toASCIIString(),
                         request.getAttributes(),
                         request.getExcludedAttributes());
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
index 7938b52..0a7a747 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java
@@ -29,7 +29,7 @@ import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.SyncopeConstants;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -53,13 +53,13 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
     @Override
     public Response create(final SCIMGroup group) {
         // first create group, no members assigned
-        ProvisioningResult<GroupTO> result = groupLogic().create(binder().toGroupTO(group), false);
+        ProvisioningResult<GroupTO> result = groupLogic().create(binder().toGroupCR(group), false);
 
         // then assign members
         group.getMembers().forEach(member -> {
             UserUR req = new UserUR.Builder().
                     key(member.getValue()).
-                    membership(new MembershipPatch.Builder().
+                    membership(new MembershipUR.Builder().
                             operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
                     build();
             try {
@@ -138,7 +138,7 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
             if (!beforeMembers.contains(member.getValue())) {
                 UserUR req = new UserUR.Builder().
                         key(member.getValue()).
-                        membership(new MembershipPatch.Builder().
+                        membership(new MembershipUR.Builder().
                                 operation(PatchOperation.ADD_REPLACE).group(result.getEntity().getKey()).build()).
                         build();
                 try {
@@ -153,7 +153,7 @@ public class GroupServiceImpl extends AbstractService<SCIMGroup> implements Grou
         beforeMembers.stream().filter(member -> !afterMembers.contains(member)).forEach(user -> {
             UserUR req = new UserUR.Builder().
                     key(user).
-                    membership(new MembershipPatch.Builder().
+                    membership(new MembershipUR.Builder().
                             operation(PatchOperation.DELETE).group(result.getEntity().getKey()).build()).
                     build();
             try {
diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
index 4ecc966..51deffd 100644
--- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
+++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java
@@ -40,7 +40,7 @@ public class UserServiceImpl extends AbstractService<SCIMUser> implements UserSe
 
     @Override
     public Response create(final SCIMUser user) {
-        ProvisioningResult<UserTO> result = userLogic().create(binder().toUserTO(user), true, false);
+        ProvisioningResult<UserTO> result = userLogic().create(binder().toUserCR(user), false);
         return createResponse(
                 result.getEntity().getKey(),
                 binder().toSCIMUser(
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
index d4c17ed..a2fb529 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/AssignDirectorGroup.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.fit.core.reference.flowable;
 
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.core.flowable.impl.FlowableRuntimeUtils;
 import org.apache.syncope.core.flowable.task.FlowableServiceTask;
@@ -50,7 +50,7 @@ public class AssignDirectorGroup extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getMemberships().add(new MembershipPatch.Builder().
+            userUR.getMemberships().add(new MembershipUR.Builder().
                     group("ebf97068-aa4b-4a85-9f01-680e8c4cf227").build());
 
             PropagationByResource propByRes = dataBinder.update(user, userUR);
diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
index 9c9b33e..1944255 100644
--- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
+++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.fit.core.reference.flowable;
 
-import org.apache.syncope.common.lib.request.RelationshipPatch;
+import org.apache.syncope.common.lib.request.RelationshipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.RelationshipTO;
 import org.apache.syncope.core.flowable.impl.FlowableRuntimeUtils;
@@ -53,7 +53,7 @@ public class CreateARelationship extends FlowableServiceTask {
 
             UserUR userUR = new UserUR();
             userUR.setKey(user.getKey());
-            userUR.getRelationships().add(new RelationshipPatch.Builder().
+            userUR.getRelationships().add(new RelationshipUR.Builder().
                     relationshipTO(new RelationshipTO.Builder().
                             otherEnd("PRINTER", printer).type("neighborhood").build()).
                     build());
diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
index de1d8f3..ab33943 100644
--- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
+++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java
@@ -19,12 +19,12 @@
 package org.apache.syncope.fit.core.reference;
 
 import java.util.Optional;
+import org.apache.syncope.common.lib.request.AnyCR;
 import org.apache.syncope.common.lib.request.AnyUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.to.AnyTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.EntityTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.PatchOperation;
 import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException;
 import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile;
@@ -41,39 +41,36 @@ public class TestPullActions implements PullActions {
 
     @Override
     public void beforeProvision(
-            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final EntityTO entity)
+            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final AnyCR anyCR)
             throws JobExecutionException {
 
-        if (entity instanceof AnyTO) {
-            AnyTO any = (AnyTO) entity;
-
-            Optional<AttrTO> attrTO = any.getPlainAttr("fullname");
-            if (!attrTO.isPresent()) {
-                attrTO = Optional.of(new AttrTO());
-                attrTO.get().setSchema("fullname");
-                any.getPlainAttrs().add(attrTO.get());
-            }
-            attrTO.get().getValues().clear();
-            attrTO.get().getValues().add(String.valueOf(counter++));
+        Optional<AttrTO> attrTO = anyCR.getPlainAttrs().stream().
+                filter(attr -> "fullname".equals(attr.getSchema())).findFirst();
+        if (!attrTO.isPresent()) {
+            attrTO = Optional.of(new AttrTO());
+            attrTO.get().setSchema("fullname");
+            anyCR.getPlainAttrs().add(attrTO.get());
         }
+        attrTO.get().getValues().clear();
+        attrTO.get().getValues().add(String.valueOf(counter++));
     }
 
     @Override
     public void beforeAssign(
-            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final EntityTO entity)
+            final ProvisioningProfile<?, ?> profile, final SyncDelta delta, final AnyCR anyCR)
             throws JobExecutionException {
 
-        if (entity instanceof UserTO && "test2".equals(UserTO.class.cast(entity).getUsername())) {
+        if (anyCR instanceof UserCR && "test2".equals(UserCR.class.cast(anyCR).getUsername())) {
             throw new IgnoreProvisionException();
         }
     }
 
     @Override
-    public <M extends AnyUR> void beforeUpdate(
+    public void beforeUpdate(
             final ProvisioningProfile<?, ?> profile,
             final SyncDelta delta,
             final EntityTO entityTO,
-            final M anyUR) throws JobExecutionException {
+            final AnyUR anyUR) throws JobExecutionException {
 
         AttrPatch fullnamePatch = null;
         for (AttrPatch attrPatch : anyUR.getPlainAttrs()) {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index ca444ab..2d61758 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -52,6 +52,9 @@ import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.PolicyTO;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.SchemaTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -435,21 +438,17 @@ public abstract class AbstractITCase {
         assertNotNull(notification);
 
         // 2. create user
-        UserTO userTO = UserITCase.getUniqueSampleTO("notificationtest@syncope.apache.org");
-        userTO.getMemberships().add(
+        UserCR req = UserITCase.getUniqueSample("notificationtest@syncope.apache.org");
+        req.getMemberships().add(
                 new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(req).getEntity();
         assertNotNull(userTO);
-        return Pair.of(notification.getKey(), userTO.getUsername());
+        return Pair.of(notification.getKey(), req.getUsername());
     }
 
-    protected ProvisioningResult<UserTO> createUser(final UserTO userTO) {
-        return createUser(userTO, true);
-    }
-
-    protected ProvisioningResult<UserTO> createUser(final UserTO userTO, final boolean storePassword) {
-        Response response = userService.create(userTO, storePassword);
+    protected ProvisioningResult<UserTO> createUser(final UserCR req) {
+        Response response = userService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
@@ -472,8 +471,8 @@ public abstract class AbstractITCase {
                 });
     }
 
-    protected ProvisioningResult<AnyObjectTO> createAnyObject(final AnyObjectTO anyObjectTO) {
-        Response response = anyObjectService.create(anyObjectTO);
+    protected ProvisioningResult<AnyObjectTO> createAnyObject(final AnyObjectCR req) {
+        Response response = anyObjectService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
@@ -496,8 +495,8 @@ public abstract class AbstractITCase {
                 });
     }
 
-    protected ProvisioningResult<GroupTO> createGroup(final GroupTO groupTO) {
-        Response response = groupService.create(groupTO);
+    protected ProvisioningResult<GroupTO> createGroup(final GroupCR req) {
+        Response response = groupService.create(req);
         if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) {
             Exception ex = clientFactory.getExceptionMapper().fromResponse(response);
             if (ex != null) {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
index 8c98ccf..38fcc3d 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java
@@ -30,6 +30,7 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -46,22 +47,20 @@ import org.junit.jupiter.api.Test;
 
 public class AnyObjectITCase extends AbstractITCase {
 
-    public static AnyObjectTO getSampleTO(final String location) {
-        AnyObjectTO anyObjectTO = new AnyObjectTO();
-        anyObjectTO.setName(location + getUUIDString());
-        anyObjectTO.setRealm(SyncopeConstants.ROOT_REALM);
-        anyObjectTO.setType("PRINTER");
-        anyObjectTO.getPlainAttrs().add(attrTO("location", location + getUUIDString()));
-
-        anyObjectTO.getResources().add(RESOURCE_NAME_DBSCRIPTED);
-        return anyObjectTO;
+    public static AnyObjectCR getSample(final String location) {
+        return new AnyObjectCR.Builder("PRINTER").
+                name(location + getUUIDString()).
+                realm(SyncopeConstants.ROOT_REALM).
+                plainAttr(attrTO("location", location + getUUIDString())).
+                resource(RESOURCE_NAME_DBSCRIPTED).
+                build();
     }
 
     @Test
     public void create() {
-        AnyObjectTO anyObjectTO = getSampleTO("create");
+        AnyObjectCR anyObjectCR = getSample("create");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         ConnObjectTO connObjectTO =
@@ -76,22 +75,22 @@ public class AnyObjectITCase extends AbstractITCase {
     @Test
     public void createInvalidMembership() {
         // 1. create anyObject in realm /odd and attempt to assign group 15, from realm /even => exception
-        AnyObjectTO anyObjectTO = getSampleTO("createInvalidMembership");
-        anyObjectTO.setRealm("/odd");
-        anyObjectTO.getMemberships().add(
+        AnyObjectCR anyObjectCR = getSample("createInvalidMembership");
+        anyObjectCR.setRealm("/odd");
+        anyObjectCR.getMemberships().add(
                 new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build());
 
         try {
-            createAnyObject(anyObjectTO);
+            createAnyObject(anyObjectCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidMembership, e.getType());
         }
 
         // 2. change anyObject's realm to /even/two, now it works
-        anyObjectTO.setRealm("/even/two");
+        anyObjectCR.setRealm("/even/two");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1"));
     }
 
@@ -103,10 +102,10 @@ public class AnyObjectITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        AnyObjectTO anyObjectTO = getSampleTO("deletable");
-        anyObjectTO.setRealm("/even");
+        AnyObjectCR anyObjectCR = getSample("deletable");
+        anyObjectCR.setRealm("/even");
 
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         AnyObjectTO deletedAnyObject = deleteAnyObject(anyObjectTO.getKey()).getEntity();
@@ -140,8 +139,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        AnyObjectTO anyObjectTO = getSampleTO("update");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("update");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
 
         assertEquals(1, anyObjectTO.getPlainAttrs().size());
 
@@ -157,8 +156,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void readAttrs() {
-        AnyObjectTO anyObjectTO = getSampleTO("readAttrs");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("readAttrs");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         Set<AttrTO> attrs = anyObjectService.read(anyObjectTO.getKey(), SchemaType.PLAIN);
@@ -170,8 +169,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void updateAttr() {
-        AnyObjectTO anyObjectTO = getSampleTO("updateAttr");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("updateAttr");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
 
         AttrTO updated = attrTO("location", "newlocation");
@@ -183,8 +182,8 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void deleteAttr() {
-        AnyObjectTO anyObjectTO = getSampleTO("deleteAttr");
-        anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+        AnyObjectCR anyObjectCR = getSample("deleteAttr");
+        AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
         assertNotNull(anyObjectTO);
         assertNotNull(anyObjectTO.getPlainAttr("location"));
 
@@ -200,12 +199,12 @@ public class AnyObjectITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE756() {
-        AnyObjectTO anyObjectTO = getSampleTO("issueSYNCOPE756");
-        anyObjectTO.getRelationships().add(new RelationshipTO.Builder().otherEnd(
+        AnyObjectCR anyObjectCR = getSample("issueSYNCOPE756");
+        anyObjectCR.getRelationships().add(new RelationshipTO.Builder().otherEnd(
                 AnyTypeKind.USER.name(), "1417acbe-cbf6-4277-9372-e75e04f97000").build());
 
         try {
-            createAnyObject(anyObjectTO).getEntity();
+            createAnyObject(anyObjectCR).getEntity();
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidAnyType, e.getType());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
index b9dbfb5..3a167f5 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
@@ -39,13 +39,14 @@ import org.apache.syncope.client.lib.BasicAuthenticationHandler;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
-import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
 import org.apache.syncope.common.lib.to.MembershipTO;
@@ -135,8 +136,8 @@ public class AuthenticationITCase extends AbstractITCase {
         assertEquals(schemaTO, newPlainSchemaTO);
 
         // 2. create an user with the role created above (as admin)
-        UserTO userTO = UserITCase.getUniqueSampleTO("auth@test.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("auth@test.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 3. read the schema created above (as admin) - success
@@ -162,10 +163,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void userRead() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("testuserread@test.org");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("testuserread@test.org");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserService userService2 = clientFactory.create(userTO.getUsername(), "password123").
@@ -187,10 +188,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void userSearch() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("testusersearch@test.org");
-        userTO.getRoles().add("User reviewer");
+        UserCR userCR = UserITCase.getUniqueSample("testusersearch@test.org");
+        userCR.getRoles().add("User reviewer");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 1. user assigned to role 1, with search entitlement on realms /odd and /even: won't find anything with 
@@ -237,9 +238,9 @@ public class AuthenticationITCase extends AbstractITCase {
             assertNotNull(roleKey);
 
             // 2. as admin, create delegated admin user, and assign the role just created
-            UserTO delegatedAdmin = UserITCase.getUniqueSampleTO("admin@syncope.apache.org");
-            delegatedAdmin.getRoles().add(roleKey);
-            delegatedAdmin = createUser(delegatedAdmin).getEntity();
+            UserCR delegatedAdminCR = UserITCase.getUniqueSample("admin@syncope.apache.org");
+            delegatedAdminCR.getRoles().add(roleKey);
+            UserTO delegatedAdmin = createUser(delegatedAdminCR).getEntity();
             delegatedAdminKey = delegatedAdmin.getKey();
 
             // 3. instantiate a delegate user service client, for further operatins
@@ -247,21 +248,21 @@ public class AuthenticationITCase extends AbstractITCase {
                     clientFactory.create(delegatedAdmin.getUsername(), "password123").getService(UserService.class);
 
             // 4. as delegated, create user under realm / -> fail
-            UserTO user = UserITCase.getUniqueSampleTO("delegated@syncope.apache.org");
+            UserCR userCR = UserITCase.getUniqueSample("delegated@syncope.apache.org");
             try {
-                delegatedUserService.create(user, true);
+                delegatedUserService.create(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.DelegatedAdministration, e.getType());
             }
 
             // 5. set realm to /even/two -> succeed
-            user.setRealm("/even/two");
+            userCR.setRealm("/even/two");
 
-            Response response = delegatedUserService.create(user, true);
+            Response response = delegatedUserService.create(userCR);
             assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
 
-            user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
+            UserTO user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
             }).getEntity();
             assertEquals("surname", user.getPlainAttr("surname").get().getValues().get(0));
 
@@ -309,10 +310,10 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void checkFailedLogins() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("checkFailedLogin@syncope.apache.org");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("checkFailedLogin@syncope.apache.org");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         String userKey = userTO.getKey();
 
@@ -342,11 +343,11 @@ public class AuthenticationITCase extends AbstractITCase {
 
     @Test
     public void checkUserSuspension() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("checkSuspension@syncope.apache.org");
-        userTO.setRealm("/odd");
-        userTO.getRoles().add("User manager");
+        UserCR userCR = UserITCase.getUniqueSample("checkSuspension@syncope.apache.org");
+        userCR.setRealm("/odd");
+        userCR.getRoles().add("User manager");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         String userKey = userTO.getKey();
         assertNotNull(userTO);
 
@@ -437,7 +438,7 @@ public class AuthenticationITCase extends AbstractITCase {
                 anyMatch(entitlement -> entitlement.contains(anyTypeKey)));
 
         // 3. attempt to create an instance of the type above: fail because no entitlement was assigned
-        AnyObjectTO folder = new AnyObjectTO();
+        AnyObjectCR folder = new AnyObjectCR();
         folder.setName("home");
         folder.setRealm(SyncopeConstants.ROOT_REALM);
         folder.setType(anyTypeKey);
@@ -479,11 +480,11 @@ public class AuthenticationITCase extends AbstractITCase {
 
         // 1. create user with group 'groupForWorkflowApproval' 
         // (users with group groupForWorkflowApproval are defined in workflow as subject to approval)
-        UserTO userTO = UserITCase.getUniqueSampleTO("createWithReject@syncope.apache.org");
-        userTO.getMemberships().add(
+        UserCR userCR = UserITCase.getUniqueSample("createWithReject@syncope.apache.org");
+        userCR.getMemberships().add(
                 new MembershipTO.Builder().group("0cbcabd2-4410-4b6b-8f05-a052b451d18f").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals("createApproval", userTO.getStatus());
 
@@ -515,11 +516,11 @@ public class AuthenticationITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE164() throws Exception {
         // 1. create user with db resource
-        UserTO user = UserITCase.getUniqueSampleTO("syncope164@syncope.apache.org");
-        user.setRealm("/even/two");
-        user.setPassword("password123");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope164@syncope.apache.org");
+        userCR.setRealm("/even/two");
+        userCR.setPassword("password123");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
 
         // 2. unlink the resource from the created user
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
index 0d621b0..6935935 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java
@@ -50,7 +50,9 @@ import org.apache.cxf.jaxrs.client.Client;
 import org.apache.cxf.jaxrs.client.WebClient;
 import org.apache.syncope.client.lib.batch.BatchRequest;
 import org.apache.syncope.client.lib.batch.BatchResponse;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
@@ -75,9 +77,9 @@ public class BatchITCase extends AbstractITCase {
         List<BatchRequestItem> reqItems = new ArrayList<>();
 
         // 1. create user as JSON
-        UserTO user = UserITCase.getUniqueSampleTO("batch@syncope.apache.org");
-        assertNotEquals("/odd", user.getRealm());
-        String createUserPayload = MAPPER.writeValueAsString(user);
+        UserCR userCR = UserITCase.getUniqueSample("batch@syncope.apache.org");
+        assertNotEquals("/odd", userCR.getRealm());
+        String createUserPayload = MAPPER.writeValueAsString(userCR);
 
         BatchRequestItem createUser = new BatchRequestItem();
         createUser.setMethod(HttpMethod.POST);
@@ -90,11 +92,11 @@ public class BatchITCase extends AbstractITCase {
         reqItems.add(createUser);
 
         // 2. create group as XML
-        GroupTO group = GroupITCase.getBasicSampleTO("batch");
-        JAXBContext context = JAXBContext.newInstance(GroupTO.class);
+        GroupCR groupCR = GroupITCase.getBasicSample("batch");
+        JAXBContext context = JAXBContext.newInstance(GroupCR.class);
         Marshaller marshaller = context.createMarshaller();
         StringWriter writer = new StringWriter();
-        marshaller.marshal(group, writer);
+        marshaller.marshal(groupCR, writer);
         String createGroupPayload = writer.toString();
 
         BatchRequestItem createGroup = new BatchRequestItem();
@@ -109,13 +111,13 @@ public class BatchITCase extends AbstractITCase {
 
         // 3. update the user above as JSON, request for no user data being returned
         UserUR userUR = new UserUR();
-        userUR.setKey(user.getUsername());
+        userUR.setKey(userCR.getUsername());
         userUR.setRealm(new StringReplacePatchItem.Builder().value("/odd").build());
         String updateUserPayload = MAPPER.writeValueAsString(userUR);
 
         BatchRequestItem updateUser = new BatchRequestItem();
         updateUser.setMethod(HttpMethod.PATCH);
-        updateUser.setRequestURI("/users/" + user.getUsername());
+        updateUser.setRequestURI("/users/" + userCR.getUsername());
         updateUser.setHeaders(new HashMap<>());
         updateUser.getHeaders().put(RESTHeaders.PREFER, Arrays.asList(Preference.RETURN_NO_CONTENT.toString()));
         updateUser.getHeaders().put(HttpHeaders.ACCEPT, Arrays.asList(MediaType.APPLICATION_JSON));
@@ -139,7 +141,7 @@ public class BatchITCase extends AbstractITCase {
         // 6, delete the group created above, expect deleted group as JSON
         BatchRequestItem deleteGroup = new BatchRequestItem();
         deleteGroup.setMethod(HttpMethod.DELETE);
-        deleteGroup.setRequestURI("/groups/" + group.getName());
+        deleteGroup.setRequestURI("/groups/" + groupCR.getName());
         reqItems.add(deleteGroup);
 
         String body = BatchPayloadGenerator.generate(reqItems, boundary);
@@ -169,7 +171,7 @@ public class BatchITCase extends AbstractITCase {
         assertNotNull(resItems.get(1).getHeaders().get(RESTHeaders.RESOURCE_KEY));
         assertEquals(MediaType.APPLICATION_XML, resItems.get(1).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0));
 
-        JAXBContext context = JAXBContext.newInstance(ProvisioningResult.class, GroupTO.class);
+        JAXBContext context = JAXBContext.newInstance(ProvisioningResult.class, GroupCR.class);
         Unmarshaller unmarshaller = context.createUnmarshaller();
         @SuppressWarnings("unchecked")
         ProvisioningResult<GroupTO> group = (ProvisioningResult<GroupTO>) unmarshaller.unmarshal(
@@ -193,8 +195,7 @@ public class BatchITCase extends AbstractITCase {
         assertEquals(Response.Status.OK.getStatusCode(), resItems.get(5).getStatus());
         assertNotNull(resItems.get(5).getHeaders().get(RESTHeaders.DOMAIN));
         assertEquals(MediaType.APPLICATION_JSON, resItems.get(5).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0));
-        group = MAPPER.readValue(
-                resItems.get(5).getContent(), new TypeReference<ProvisioningResult<GroupTO>>() {
+        group = MAPPER.readValue(resItems.get(5).getContent(), new TypeReference<ProvisioningResult<GroupTO>>() {
         });
         assertNotNull(group);
     }
@@ -273,23 +274,23 @@ public class BatchITCase extends AbstractITCase {
 
         // 1. create user as JSON
         UserService batchUserService = batchRequest.getService(UserService.class);
-        UserTO user = UserITCase.getUniqueSampleTO("batch@syncope.apache.org");
-        assertNotEquals("/odd", user.getRealm());
-        batchUserService.create(user, true);
+        UserCR userCR = UserITCase.getUniqueSample("batch@syncope.apache.org");
+        assertNotEquals("/odd", userCR.getRealm());
+        batchUserService.create(userCR);
 
         // 2. create group as XML
         GroupService batchGroupService = batchRequest.getService(GroupService.class);
         Client client = WebClient.client(batchGroupService).reset();
         client.type(MediaType.APPLICATION_XML).accept(MediaType.APPLICATION_XML);
-        GroupTO group = GroupITCase.getBasicSampleTO("batch");
-        batchGroupService.create(group);
+        GroupCR groupCR = GroupITCase.getBasicSample("batch");
+        batchGroupService.create(groupCR);
 
         // 3. update the user above as JSON, request for no user data being returned
         client = WebClient.client(batchUserService).reset();
         client.type(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON);
         client.header(RESTHeaders.PREFER, Preference.RETURN_NO_CONTENT.toString());
         UserUR userUR = new UserUR();
-        userUR.setKey(user.getUsername());
+        userUR.setKey(userCR.getUsername());
         userUR.setRealm(new StringReplacePatchItem.Builder().value("/odd").build());
         batchUserService.update(userUR);
 
@@ -302,7 +303,7 @@ public class BatchITCase extends AbstractITCase {
         batchGroupService.delete(UUID.randomUUID().toString());
 
         // 6, delete the group created above, expect deleted group as JSON
-        batchGroupService.delete(group.getName());
+        batchGroupService.delete(groupCR.getName());
 
         return batchRequest;
     }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
index 8112cf8..1bfe609 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CamelRouteITCase.java
@@ -25,6 +25,7 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 import java.util.List;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.CamelRouteTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
@@ -78,7 +79,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "  </setProperty>\n"
                 + "  <doTry>\n"
                 + "    <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                             ${property.enabled},${property.storePassword})\"/>\n"
+                + "                             ${property.enabled})\"/>\n"
                 + "    <to uri=\"propagate:create?anyTypeKind=USER\"/>\n"
                 + "    <to uri=\"direct:createPort\"/>\n"
                 + "    <to uri=\"log:myLog\"/>\n"
@@ -118,7 +119,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "    </setBody>\n"
                 + "    <doTry>\n"
                 + "      <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                                     ${property.enabled},${property.storePassword})\"/>\n"
+                + "                                     ${property.enabled})\"/>\n"
                 + "      <to uri=\"propagate:create?anyTypeKind=USER\"/>\n"
                 + "      <to uri=\"direct:createPort\"/>\n"
                 + "      <doCatch>        \n"
@@ -144,18 +145,18 @@ public class CamelRouteITCase extends AbstractITCase {
             typeClass.getPlainSchemas().add(schemaTO.getKey());
             anyTypeClassService.create(typeClass);
 
-            UserTO userTO = new UserTO();
-            userTO.setRealm(SyncopeConstants.ROOT_REALM);
-            userTO.getAuxClasses().add(typeClass.getKey());
+            UserCR userCR = new UserCR();
+            userCR.setRealm(SyncopeConstants.ROOT_REALM);
+            userCR.getAuxClasses().add(typeClass.getKey());
             String userId = getUUIDString() + "camelUser@syncope.apache.org";
-            userTO.setUsername(userId);
-            userTO.setPassword("password123");
-            userTO.getPlainAttrs().add(attrTO("userId", userId));
-            userTO.getPlainAttrs().add(attrTO("fullname", userId));
-            userTO.getPlainAttrs().add(attrTO("surname", userId));
-            userTO.getPlainAttrs().add(attrTO("camelAttribute", "false"));
-
-            userTO = createUser(userTO).getEntity();
+            userCR.setUsername(userId);
+            userCR.setPassword("password123");
+            userCR.getPlainAttrs().add(attrTO("userId", userId));
+            userCR.getPlainAttrs().add(attrTO("fullname", userId));
+            userCR.getPlainAttrs().add(attrTO("surname", userId));
+            userCR.getPlainAttrs().add(attrTO("camelAttribute", "false"));
+
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
             assertEquals("true", userTO.getPlainAttr("camelAttribute").get().getValues().get(0));
         } finally {
@@ -174,7 +175,7 @@ public class CamelRouteITCase extends AbstractITCase {
                 + "  </setProperty>\n"
                 + "  <doTry>\n"
                 + "    <bean ref=\"uwfAdapter\" method=\"create(${body},${property.disablePwdPolicyCheck},\n"
-                + "                             ${property.enabled},${property.storePassword})\"/>\n"
+                + "                             ${property.enabled})\"/>\n"
                 + "    <to uri=\"propagate:create123?anyTypeKind=USER\"/>\n"
                 + "    <to uri=\"direct:createPort\"/>\n"
                 + "    <to uri=\"log:myLog\"/>\n"
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
index f4d368b..a8bf513 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java
@@ -29,8 +29,10 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.DynRealmTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -116,26 +118,25 @@ public class DynRealmITCase extends AbstractITCase {
             assertNotNull(role);
 
             // 3. create new user and assign the new role
-            UserTO dynRealmAdmin = UserITCase.getUniqueSampleTO("dynRealmAdmin@apache.org");
+            UserCR dynRealmAdmin = UserITCase.getUniqueSample("dynRealmAdmin@apache.org");
             dynRealmAdmin.setPassword("password123");
             dynRealmAdmin.getRoles().add(role.getKey());
-            dynRealmAdmin = createUser(dynRealmAdmin).getEntity();
-            assertNotNull(dynRealmAdmin);
+            assertNotNull(createUser(dynRealmAdmin).getEntity());
 
             // 4. create new user and group, assign resource-ldap
-            UserTO user = UserITCase.getUniqueSampleTO("dynRealmUser@apache.org");
-            user.setRealm("/even/two");
-            user.getResources().clear();
-            user.getResources().add(RESOURCE_NAME_LDAP);
-            user = createUser(user).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("dynRealmUser@apache.org");
+            userCR.setRealm("/even/two");
+            userCR.getResources().clear();
+            userCR.getResources().add(RESOURCE_NAME_LDAP);
+            UserTO user = createUser(userCR).getEntity();
             assertNotNull(user);
             final String userKey = user.getKey();
 
-            GroupTO group = GroupITCase.getSampleTO("dynRealmGroup");
-            group.setRealm("/odd");
-            group.getResources().clear();
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getSample("dynRealmGroup");
+            groupCR.setRealm("/odd");
+            groupCR.getResources().clear();
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             assertNotNull(group);
             final String groupKey = group.getKey();
 
@@ -197,9 +198,8 @@ public class DynRealmITCase extends AbstractITCase {
             GroupUR groupUR = new GroupUR();
             groupUR.setKey(groupKey);
             groupUR.getPlainAttrs().add(new AttrPatch.Builder().attrTO(attrTO("icon", "modified")).build());
-            group = delegatedGroupService.update(groupUR).
-                    readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
-                    }).getEntity();
+            group = delegatedGroupService.update(groupUR).readEntity(new GenericType<ProvisioningResult<GroupTO>>() {
+            }).getEntity();
             assertNotNull(group);
             assertEquals("modified", group.getPlainAttr("icon").get().getValues().get(0));
         } finally {
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
index 9566e8f..516de1a 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
@@ -27,12 +27,12 @@ import java.util.Properties;
 import org.apache.syncope.common.lib.SyncopeClientCompositeException;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
-import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ItemTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
 import org.apache.syncope.common.lib.to.ResourceTO;
-import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.AttrSchemaType;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
@@ -73,7 +73,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         anyTypeClassService.create(typeClass);
 
         // 2. create an user with mandatory attributes and unique
-        UserTO userTO1 = new UserTO();
+        UserCR userTO1 = new UserCR();
         userTO1.setRealm(SyncopeConstants.ROOT_REALM);
         userTO1.getAuxClasses().add(typeClass.getKey());
         String userId1 = getUUIDString() + "issue654_1@syncope.apache.org";
@@ -88,7 +88,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         createUser(userTO1);
 
         // 3. create an other user with mandatory attributes and unique with the same value of userTO1
-        UserTO userTO2 = new UserTO();
+        UserCR userTO2 = new UserCR();
         userTO2.setRealm(SyncopeConstants.ROOT_REALM);
         userTO2.getAuxClasses().add(typeClass.getKey());
         String userId2 = getUUIDString() + "issue654_2@syncope.apache.org";
@@ -114,13 +114,13 @@ public class ExceptionMapperITCase extends AbstractITCase {
         String groupUUID = getUUIDString();
 
         // Create the first group
-        GroupTO groupTO1 = new GroupTO();
+        GroupCR groupTO1 = new GroupCR();
         groupTO1.setName("child1" + groupUUID);
         groupTO1.setRealm(SyncopeConstants.ROOT_REALM);
         createGroup(groupTO1);
 
         // Create the second group, with the same name of groupTO1
-        GroupTO groupTO2 = new GroupTO();
+        GroupCR groupTO2 = new GroupCR();
         groupTO2.setName("child1" + groupUUID);
         groupTO2.setRealm(SyncopeConstants.ROOT_REALM);
         try {
@@ -135,18 +135,18 @@ public class ExceptionMapperITCase extends AbstractITCase {
 
     @Test
     public void headersMultiValue() {
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "issue654@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", "issue654"));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", "issue654"));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientCompositeException e) {
             assertEquals(2, e.getExceptions().size());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
index 1dc462a..c5221ed 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java
@@ -46,13 +46,16 @@ import org.apache.syncope.common.lib.AnyOperations;
 import org.apache.syncope.common.lib.EntityTOUtils;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
@@ -95,29 +98,29 @@ import org.junit.jupiter.api.Test;
 
 public class GroupITCase extends AbstractITCase {
 
-    public static GroupTO getBasicSampleTO(final String name) {
-        GroupTO groupTO = new GroupTO();
-        groupTO.setRealm(SyncopeConstants.ROOT_REALM);
-        groupTO.setName(name + getUUIDString());
-        return groupTO;
+    public static GroupCR getBasicSample(final String name) {
+        return new GroupCR.Builder().
+                realm(SyncopeConstants.ROOT_REALM).
+                name(name + getUUIDString()).
+                build();
     }
 
-    public static GroupTO getSampleTO(final String name) {
-        GroupTO groupTO = getBasicSampleTO(name);
+    public static GroupCR getSample(final String name) {
+        GroupCR groupCR = getBasicSample(name);
 
-        groupTO.getPlainAttrs().add(attrTO("icon", "anIcon"));
+        groupCR.getPlainAttrs().add(attrTO("icon", "anIcon"));
 
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
-        return groupTO;
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
+        return groupCR;
     }
 
     @Test
     public void create() {
-        GroupTO groupTO = getSampleTO("lastGroup");
-        groupTO.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
-        groupTO.setGroupOwner("f779c0d4-633b-4be5-8f57-32eb478a3ca5");
+        GroupCR groupCR = getSample("lastGroup");
+        groupCR.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
+        groupCR.setGroupOwner("f779c0d4-633b-4be5-8f57-32eb478a3ca5");
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         assertNotNull(groupTO.getVirAttr("rvirtualdata").get().getValues());
@@ -141,9 +144,9 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void createWithInternationalCharacters() {
-        GroupTO groupTO = getSampleTO("räksmörgås");
+        GroupCR groupCR = getSample("räksmörgås");
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
     }
 
@@ -155,13 +158,13 @@ public class GroupITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("toBeDeleted" + getUUIDString());
-        groupTO.setRealm("/even");
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("toBeDeleted" + getUUIDString());
+        groupCR.setRealm("/even");
 
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         GroupTO deletedGroup = deleteGroup(groupTO.getKey()).getEntity();
@@ -217,8 +220,8 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        GroupTO groupTO = getSampleTO("latestGroup" + getUUIDString());
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getSample("latestGroup" + getUUIDString());
+        GroupTO groupTO = createGroup(groupCR).getEntity();
 
         assertEquals(1, groupTO.getPlainAttrs().size());
 
@@ -246,13 +249,13 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void patch() {
-        GroupTO original = getBasicSampleTO("patch");
-        original.setUDynMembershipCond("(($groups==3;$resources!=ws-target-resource-1);aLong==1)");
-        original.getADynMembershipConds().put(
+        GroupCR createReq = getBasicSample("patch");
+        createReq.setUDynMembershipCond("(($groups==3;$resources!=ws-target-resource-1);aLong==1)");
+        createReq.getADynMembershipConds().put(
                 "PRINTER",
                 "(($groups==7;cool==ss);$resources==ws-target-resource-2);$type==PRINTER");
 
-        GroupTO created = createGroup(original).getEntity();
+        GroupTO created = createGroup(createReq).getEntity();
 
         created.getPlainAttrs().add(new AttrTO.Builder().schema("icon").build());
         created.getPlainAttrs().add(new AttrTO.Builder().schema("show").build());
@@ -260,7 +263,7 @@ public class GroupITCase extends AbstractITCase {
         created.getPlainAttrs().add(new AttrTO.Builder().schema("rderived_dx").value("dx").build());
         created.getPlainAttrs().add(new AttrTO.Builder().schema("title").value("mr").build());
 
-        original = groupService.read(created.getKey());
+        GroupTO original = groupService.read(created.getKey());
 
         GroupUR groupUR = AnyOperations.diff(created, original, true);
         GroupTO updated = updateGroup(groupUR).getEntity();
@@ -316,7 +319,7 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void unlink() throws IOException {
-        GroupTO actual = createGroup(getSampleTO("unlink")).getEntity();
+        GroupTO actual = createGroup(getSample("unlink")).getEntity();
         assertNotNull(actual);
 
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), actual.getKey()));
@@ -335,10 +338,10 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void link() throws IOException {
-        GroupTO groupTO = getSampleTO("link");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("link");
+        groupCR.getResources().clear();
 
-        GroupTO actual = createGroup(groupTO).getEntity();
+        GroupTO actual = createGroup(groupCR).getEntity();
         assertNotNull(actual);
 
         try {
@@ -369,7 +372,7 @@ public class GroupITCase extends AbstractITCase {
         GroupTO groupTO = null;
 
         try {
-            groupTO = createGroup(getSampleTO("unassign")).getEntity();
+            groupTO = createGroup(getSample("unassign")).getEntity();
             assertNotNull(groupTO);
 
             assertNotNull(resourceService.readConnObject(
@@ -401,11 +404,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void assign() throws IOException {
-        GroupTO groupTO = getSampleTO("assign");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("assign");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -425,7 +429,7 @@ public class GroupITCase extends AbstractITCase {
             assertNotNull(resourceService.readConnObject(
                     RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), groupTO.getKey()));
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -436,7 +440,7 @@ public class GroupITCase extends AbstractITCase {
         GroupTO groupTO = null;
 
         try {
-            groupTO = createGroup(getSampleTO("deprovision")).getEntity();
+            groupTO = createGroup(getSample("deprovision")).getEntity();
             assertNotNull(groupTO);
             assertNotNull(groupTO.getKey());
 
@@ -466,11 +470,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void provision() throws IOException {
-        GroupTO groupTO = getSampleTO("provision");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("provision");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -491,7 +496,7 @@ public class GroupITCase extends AbstractITCase {
             assertNotNull(resourceService.readConnObject(
                     RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), groupTO.getKey()));
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -499,11 +504,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void deprovisionUnlinked() throws IOException {
-        GroupTO groupTO = getSampleTO("deprovision");
-        groupTO.getResources().clear();
+        GroupCR groupCR = getSample("deprovision");
+        groupCR.getResources().clear();
 
+        GroupTO groupTO = null;
         try {
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             try {
@@ -540,7 +546,7 @@ public class GroupITCase extends AbstractITCase {
                 assertNotNull(e);
             }
         } finally {
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
         }
@@ -555,9 +561,8 @@ public class GroupITCase extends AbstractITCase {
         schemaService.create(SchemaType.PLAIN, badge);
 
         // 2. create a group *without* an attribute for that schema: it works
-        GroupTO groupTO = getSampleTO("lastGroup");
-        assertFalse(groupTO.getPlainAttr(badge.getKey()).isPresent());
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getSample("lastGroup");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertFalse(groupTO.getPlainAttr(badge.getKey()).isPresent());
 
@@ -625,9 +630,9 @@ public class GroupITCase extends AbstractITCase {
     public void uDynMembership() {
         assertTrue(userService.read("c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships().isEmpty());
 
-        GroupTO group = getBasicSampleTO("uDynMembership");
-        group.setUDynMembershipCond("cool==true");
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = getBasicSample("uDynMembership");
+        groupCR.setUDynMembershipCond("cool==true");
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
         final String groupKey = group.getKey();
 
@@ -650,9 +655,9 @@ public class GroupITCase extends AbstractITCase {
         String fiql = SyncopeClient.getAnyObjectSearchConditionBuilder("PRINTER").is("location").notNullValue().query();
 
         // 1. create group with a given aDynMembership condition
-        GroupTO group = getBasicSampleTO("aDynMembership");
-        group.getADynMembershipConds().put("PRINTER", fiql);
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = getBasicSample("aDynMembership");
+        groupCR.getADynMembershipConds().put("PRINTER", fiql);
+        GroupTO group = createGroup(groupCR).getEntity();
         assertEquals(fiql, group.getADynMembershipConds().get("PRINTER"));
 
         group = groupService.read(group.getKey());
@@ -660,9 +665,9 @@ public class GroupITCase extends AbstractITCase {
         assertEquals(fiql, group.getADynMembershipConds().get("PRINTER"));
 
         // verify that the condition is dynamically applied
-        AnyObjectTO newAny = AnyObjectITCase.getSampleTO("aDynMembership");
-        newAny.getResources().clear();
-        newAny = createAnyObject(newAny).getEntity();
+        AnyObjectCR newAnyCR = AnyObjectITCase.getSample("aDynMembership");
+        newAnyCR.getResources().clear();
+        AnyObjectTO newAny = createAnyObject(newAnyCR).getEntity();
         assertNotNull(newAny.getPlainAttr("location"));
         List<MembershipTO> memberships = anyObjectService.read(
                 "fc6dbc3a-6c07-4965-8781-921e7401a4a5").getDynMemberships();
@@ -711,18 +716,17 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void aDynMembershipCount() {
         // Create a new printer as a dynamic member of a new group
-        GroupTO group = getBasicSampleTO("aDynamicMembership");
+        GroupCR groupCR = getBasicSample("aDynamicMembership");
         String fiql = SyncopeClient.getAnyObjectSearchConditionBuilder("PRINTER").is("location").equalTo("home").query();
-        group.getADynMembershipConds().put("PRINTER", fiql);
-        group = createGroup(group).getEntity();
+        groupCR.getADynMembershipConds().put("PRINTER", fiql);
+        GroupTO group = createGroup(groupCR).getEntity();
 
-        AnyObjectTO printer = new AnyObjectTO();
-        printer.setRealm(SyncopeConstants.ROOT_REALM);
-        printer.setName("Printer_" + getUUIDString());
-        printer.setType("PRINTER");
-        AttrTO location = new AttrTO.Builder().schema("location").value("home").build();
-        printer.getPlainAttrs().add(location);
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = new AnyObjectCR();
+        printerCR.setRealm(SyncopeConstants.ROOT_REALM);
+        printerCR.setName("Printer_" + getUUIDString());
+        printerCR.setType("PRINTER");
+        printerCR.getPlainAttrs().add(new AttrTO.Builder().schema("location").value("home").build());
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
         assertEquals(0, group.getStaticAnyObjectMembershipCount());
@@ -735,17 +739,15 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void aStaticMembershipCount() {
         // Create a new printer as a static member of a new group
-        GroupTO group = getBasicSampleTO("aStaticMembership");
-        group = createGroup(group).getEntity();
-
-        AnyObjectTO printer = new AnyObjectTO();
-        printer.setRealm(SyncopeConstants.ROOT_REALM);
-        printer.setName("Printer_" + getUUIDString());
-        printer.setType("PRINTER");
-        MembershipTO membership = new MembershipTO();
-        membership.setGroupKey(group.getKey());
-        printer.getMemberships().add(membership);
-        printer = createAnyObject(printer).getEntity();
+        GroupCR groupCR = getBasicSample("aStaticMembership");
+        GroupTO group = createGroup(groupCR).getEntity();
+
+        AnyObjectCR printerCR = new AnyObjectCR();
+        printerCR.setRealm(SyncopeConstants.ROOT_REALM);
+        printerCR.setName("Printer_" + getUUIDString());
+        printerCR.setType("PRINTER");
+        printerCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
 
         group = groupService.read(group.getKey());
         assertEquals(0, group.getDynamicAnyObjectMembershipCount());
@@ -771,16 +773,16 @@ public class GroupITCase extends AbstractITCase {
 
         try {
             // 1. create succeeds
-            GroupTO group = getSampleTO("syncope714");
-            group.getPlainAttrs().add(attrTO("title", "first"));
-            group.getResources().add(RESOURCE_NAME_LDAP);
+            GroupCR groupCR = getSample("syncope714");
+            groupCR.getPlainAttrs().add(attrTO("title", "first"));
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-            ProvisioningResult<GroupTO> result = createGroup(group);
+            ProvisioningResult<GroupTO> result = createGroup(groupCR);
             assertNotNull(result);
             assertEquals(1, result.getPropagationStatuses().size());
             assertEquals(RESOURCE_NAME_LDAP, result.getPropagationStatuses().get(0).getResource());
             assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-            group = result.getEntity();
+            GroupTO group = result.getEntity();
 
             // 2. update succeeds
             GroupUR groupUR = new GroupUR();
@@ -850,10 +852,10 @@ public class GroupITCase extends AbstractITCase {
         typeExtension.setAnyType(AnyTypeKind.USER.name());
         typeExtension.getAuxClasses().add("csv");
 
-        GroupTO groupTO = getBasicSampleTO("typeExtensions");
-        groupTO.getTypeExtensions().add(typeExtension);
+        GroupCR groupCR = getBasicSample("typeExtensions");
+        groupCR.getTypeExtensions().add(typeExtension);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertEquals(1, groupTO.getTypeExtensions().size());
         assertEquals(1, groupTO.getTypeExtension(AnyTypeKind.USER.name()).get().getAuxClasses().size());
@@ -879,13 +881,13 @@ public class GroupITCase extends AbstractITCase {
     @Test
     public void provisionMembers() throws InterruptedException {
         // 1. create group without resources
-        GroupTO groupTO = getBasicSampleTO("forProvision");
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = getBasicSample("forProvision");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
 
         // 2. create user with such group assigned
-        UserTO userTO = UserITCase.getUniqueSampleTO("forProvision@syncope.apache.org");
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("forProvision@syncope.apache.org");
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        UserTO userTO = createUser(userCR).getEntity();
 
         // 3. modify the group by assiging the LDAP resource
         GroupUR groupUR = new GroupUR();
@@ -941,12 +943,12 @@ public class GroupITCase extends AbstractITCase {
 
     @Test
     public void issue178() {
-        GroupTO groupTO = new GroupTO();
+        GroupCR groupCR = new GroupCR();
         String groupName = "torename" + getUUIDString();
-        groupTO.setName(groupName);
-        groupTO.setRealm("/");
+        groupCR.setName(groupName);
+        groupCR.setRealm("/");
 
-        GroupTO actual = createGroup(groupTO).getEntity();
+        GroupTO actual = createGroup(groupCR).getEntity();
 
         assertNotNull(actual);
         assertEquals(groupName, actual.getName());
@@ -967,16 +969,17 @@ public class GroupITCase extends AbstractITCase {
         DerSchemaTO modified = SerializationUtils.clone(orig);
         modified.setExpression("icon + '_' + show");
 
-        GroupTO groupTO = GroupITCase.getSampleTO("lastGroup");
+        GroupCR groupCR = GroupITCase.getSample("lastGroup");
+        GroupTO groupTO = null;
         try {
             schemaService.update(SchemaType.DERIVED, modified);
 
             // 0. create group
-            groupTO.getPlainAttrs().add(attrTO("icon", "anIcon"));
-            groupTO.getPlainAttrs().add(attrTO("show", "true"));
-            groupTO.getResources().clear();
+            groupCR.getPlainAttrs().add(attrTO("icon", "anIcon"));
+            groupCR.getPlainAttrs().add(attrTO("show", "true"));
+            groupCR.getResources().clear();
 
-            groupTO = createGroup(groupTO).getEntity();
+            groupTO = createGroup(groupCR).getEntity();
             assertNotNull(groupTO);
 
             // 1. create new LDAP resource having ConnObjectKey mapped to a derived attribute
@@ -1054,7 +1057,7 @@ public class GroupITCase extends AbstractITCase {
             assertEquals(1, entries);
         } finally {
             schemaService.update(SchemaType.DERIVED, orig);
-            if (groupTO.getKey() != null) {
+            if (groupTO != null) {
                 groupService.delete(groupTO.getKey());
             }
             resourceService.delete("new-ldap");
@@ -1080,10 +1083,10 @@ public class GroupITCase extends AbstractITCase {
         anyTypeClassService.update(minimalGroup);
 
         // 2. create group, provide valid input value
-        GroupTO groupTO = GroupITCase.getBasicSampleTO("syncope717");
-        groupTO.getPlainAttrs().add(attrTO(doubleSchemaName, "11.23"));
+        GroupCR groupCR = GroupITCase.getBasicSample("syncope717");
+        groupCR.getPlainAttrs().add(attrTO(doubleSchemaName, "11.23"));
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
         assertEquals("11.23", groupTO.getPlainAttr(doubleSchemaName).get().getValues().get(0));
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
index bea6fba..6a2bd53 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java
@@ -29,8 +29,10 @@ import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.ResourceDR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -65,10 +67,10 @@ public class MembershipITCase extends AbstractITCase {
 
     @Test
     public void misc() {
-        UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-        user.setRealm("/even/two");
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
-        user.getPlainAttrs().remove(user.getPlainAttr("ctype").get());
+        UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+        userCR.setRealm("/even/two");
+        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        userCR.getPlainAttrs().removeIf(attr -> "ctype".equals(attr.getSchema()));
 
         // the group 034740a9-fa10-453b-af37-dc7897e98fb1 has USER type extensions for 'csv' and 'other' 
         // any type classes
@@ -78,11 +80,11 @@ public class MembershipITCase extends AbstractITCase {
         // 'fullname' is in 'minimal user', so it is not allowed for this membership
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("fullname").value("discarded").build());
 
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
         // user creation fails because of fullname
         try {
-            createUser(user);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
@@ -91,16 +93,17 @@ public class MembershipITCase extends AbstractITCase {
 
         // remove fullname and try again
         membership.getPlainAttrs().remove(membership.getPlainAttr("fullname").get());
+        UserTO userTO = null;
         try {
-            user = createUser(user).getEntity();
+            userTO = createUser(userCR).getEntity();
 
             // 1. verify that 'aLong' is correctly populated for user
-            assertEquals(1, user.getPlainAttr("aLong").get().getValues().size());
-            assertEquals("1976", user.getPlainAttr("aLong").get().getValues().get(0));
+            assertEquals(1, userTO.getPlainAttr("aLong").get().getValues().size());
+            assertEquals("1976", userTO.getPlainAttr("aLong").get().getValues().get(0));
 
             // 2. verify that 'aLong' is correctly populated for user's membership
-            assertEquals(1, user.getMemberships().size());
-            membership = user.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
+            assertEquals(1, userCR.getMemberships().size());
+            membership = userTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
             assertNotNull(membership);
             assertEquals(1, membership.getPlainAttr("aLong").get().getValues().size());
             assertEquals("1977", membership.getPlainAttr("aLong").get().getValues().get(0));
@@ -111,28 +114,28 @@ public class MembershipITCase extends AbstractITCase {
 
             // update user - change some values and add new membership attribute
             UserUR userUR = new UserUR();
-            userUR.setKey(user.getKey());
+            userUR.setKey(userTO.getKey());
 
             userUR.getPlainAttrs().add(new AttrPatch.Builder().
                     attrTO(new AttrTO.Builder().schema("aLong").value("1977").build()).build());
 
-            MembershipPatch membershipPatch = new MembershipPatch.Builder().group(membership.getGroupKey()).build();
+            MembershipUR membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).build();
             membershipPatch.getPlainAttrs().add(
                     new AttrTO.Builder().schema("aLong").value("1976").build());
             membershipPatch.getPlainAttrs().add(
                     new AttrTO.Builder().schema("ctype").value("membership type").build());
             userUR.getMemberships().add(membershipPatch);
 
-            user = updateUser(userUR).getEntity();
+            userTO = updateUser(userUR).getEntity();
 
             // 4. verify that 'aLong' is correctly populated for user
-            assertEquals(1, user.getPlainAttr("aLong").get().getValues().size());
-            assertEquals("1977", user.getPlainAttr("aLong").get().getValues().get(0));
-            assertFalse(user.getPlainAttr("ctype").isPresent());
+            assertEquals(1, userTO.getPlainAttr("aLong").get().getValues().size());
+            assertEquals("1977", userTO.getPlainAttr("aLong").get().getValues().get(0));
+            assertFalse(userTO.getPlainAttr("ctype").isPresent());
 
             // 5. verify that 'aLong' is correctly populated for user's membership
-            assertEquals(1, user.getMemberships().size());
-            membership = user.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
+            assertEquals(1, userCR.getMemberships().size());
+            membership = userTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get();
             assertNotNull(membership);
             assertEquals(1, membership.getPlainAttr("aLong").get().getValues().size());
             assertEquals("1976", membership.getPlainAttr("aLong").get().getValues().get(0));
@@ -142,33 +145,33 @@ public class MembershipITCase extends AbstractITCase {
 
             // finally remove membership
             userUR = new UserUR();
-            userUR.setKey(user.getKey());
+            userUR.setKey(userTO.getKey());
 
-            membershipPatch = new MembershipPatch.Builder().group(membership.getGroupKey()).
+            membershipPatch = new MembershipUR.Builder().group(membership.getGroupKey()).
                     operation(PatchOperation.DELETE).build();
             userUR.getMemberships().add(membershipPatch);
 
-            user = updateUser(userUR).getEntity();
+            userTO = updateUser(userUR).getEntity();
 
-            assertTrue(user.getMemberships().isEmpty());
+            assertTrue(userTO.getMemberships().isEmpty());
         } finally {
-            if (user.getKey() != null) {
-                userService.delete(user.getKey());
+            if (userTO != null) {
+                userService.delete(userTO.getKey());
             }
         }
     }
 
     @Test
     public void deleteUserWithMembership() {
-        UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-        user.setRealm("/even/two");
-        user.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
+        UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+        userCR.setRealm("/even/two");
+        userCR.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1976").build());
 
         MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1977").build());
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user.getKey());
 
         userService.delete(user.getKey());
@@ -182,19 +185,19 @@ public class MembershipITCase extends AbstractITCase {
         typeExtension.getAuxClasses().add("csv");
         typeExtension.getAuxClasses().add("other");
 
-        GroupTO groupTO = GroupITCase.getBasicSampleTO("typeExt");
-        groupTO.getTypeExtensions().add(typeExtension);
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = GroupITCase.getBasicSample("typeExt");
+        groupCR.getTypeExtensions().add(typeExtension);
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // pre: create user with membership to such group
-        UserTO user = UserITCase.getUniqueSampleTO("typeExt@apache.org");
+        UserCR userCR = UserITCase.getUniqueSample("typeExt@apache.org");
 
         MembershipTO membership = new MembershipTO.Builder().group(groupTO.getKey()).build();
         membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("1454").build());
-        user.getMemberships().add(membership);
+        userCR.getMemberships().add(membership);
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
 
         // verify that 'aLong' is correctly populated for user's membership
         assertEquals(1, user.getMemberships().size());
@@ -238,17 +241,18 @@ public class MembershipITCase extends AbstractITCase {
             assertNotNull(newResource);
 
             // 1. create user with new resource assigned
-            UserTO user = UserITCase.getUniqueSampleTO("memb@apache.org");
-            user.setRealm("/even/two");
-            user.getPlainAttrs().remove(user.getPlainAttr("ctype").get());
-            user.getResources().clear();
-            user.getResources().add(newResource.getKey());
+            UserCR userCR = UserITCase.getUniqueSample("memb@apache.org");
+            userCR.setRealm("/even/two");
+            UserTO user;
+            userCR.getPlainAttrs().removeIf(attr -> "ctype".equals(attr.getSchema()));
+            userCR.getResources().clear();
+            userCR.getResources().add(newResource.getKey());
 
             MembershipTO membership = new MembershipTO.Builder().group("034740a9-fa10-453b-af37-dc7897e98fb1").build();
             membership.getPlainAttrs().add(new AttrTO.Builder().schema("aLong").value("5432").build());
-            user.getMemberships().add(membership);
+            userCR.getMemberships().add(membership);
 
-            user = createUser(user).getEntity();
+            user = createUser(userCR).getEntity();
             assertNotNull(user);
 
             // 2. verify that user was found on resource
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
index 8703d22..927ba4b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java
@@ -35,6 +35,7 @@ import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.client.lib.SyncopeClientFactoryBean;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.ConnInstanceTO;
 import org.apache.syncope.common.lib.to.ItemTO;
 import org.apache.syncope.common.lib.to.MappingTO;
@@ -133,15 +134,15 @@ public class MultitenancyITCase extends AbstractITCase {
     public void createUser() {
         assertNull(adminClient.getService(RealmService.class).list().get(0).getPasswordPolicy());
 
-        UserTO user = new UserTO();
-        user.setRealm(SyncopeConstants.ROOT_REALM);
-        user.setUsername(getUUIDString());
-        user.setPassword("password");
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setUsername(getUUIDString());
+        userCR.setPassword("password");
 
-        Response response = adminClient.getService(UserService.class).create(user, true);
+        Response response = adminClient.getService(UserService.class).create(userCR);
         assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
 
-        user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
+        UserTO user = response.readEntity(new GenericType<ProvisioningResult<UserTO>>() {
         }).getEntity();
         assertNotNull(user);
     }
@@ -260,7 +261,7 @@ public class MultitenancyITCase extends AbstractITCase {
         try {
             new SyncopeClientFactoryBean().setAddress(ADDRESS).setDomain("NotExisting").create().
                     getService(UserSelfService.class).
-                    create(UserITCase.getUniqueSampleTO("syncope1377@syncope.apache.org"), true);
+                    create(UserITCase.getUniqueSample("syncope1377@syncope.apache.org"));
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.NotFound, e.getType());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
index 62dc977..fa68c05 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java
@@ -27,6 +27,7 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.lib.SyncopeClient;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.NotificationTaskTO;
 import org.apache.syncope.common.lib.to.ExecTO;
@@ -265,10 +266,10 @@ public class NotificationTaskITCase extends AbstractNotificationTaskITCase {
         assertEquals(recipientsProvider.getKey(), notification.getRecipientsProvider());
 
         // 2. create group
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName(groupName);
-        groupTO.setRealm("/even/two");
-        groupTO = createGroup(groupTO).getEntity();
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName(groupName);
+        groupCR.setRealm("/even/two");
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 3. verify
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
index 5621c24..2b2fb84 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PlainSchemaITCase.java
@@ -32,7 +32,7 @@ import java.util.Locale;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
@@ -47,6 +47,7 @@ import org.apache.syncope.common.rest.api.beans.SchemaQuery;
 import org.apache.syncope.fit.AbstractITCase;
 import org.junit.jupiter.api.Test;
 import org.apache.cxf.helpers.IOUtils;
+import org.apache.syncope.common.lib.request.UserCR;
 
 public class PlainSchemaITCase extends AbstractITCase {
 
@@ -178,9 +179,9 @@ public class PlainSchemaITCase extends AbstractITCase {
 
         createSchema(SchemaType.PLAIN, schemaTOjson2);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("test@syncope.apache.org");
+        UserCR userCR = UserITCase.getUniqueSample("test@syncope.apache.org");
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -315,11 +316,11 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue258@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
+        UserCR userCR = UserITCase.getUniqueSample("issue258@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         schemaTO.setType(AttrSchemaType.Long);
@@ -344,14 +345,14 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue259@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1"));
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("issue259@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1"));
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR req = new UserUR.Builder().key(userTO.getKey()).
-                membership(new MembershipPatch.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
+                membership(new MembershipUR.Builder().group("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build()).build();
 
         UserTO newUserTO = updateUser(req).getEntity();
         assertNotNull(newUserTO);
@@ -370,10 +371,10 @@ public class PlainSchemaITCase extends AbstractITCase {
         typeClass.getPlainSchemas().add(schemaTO.getKey());
         anyTypeClassService.create(typeClass);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue260@syncope.apache.org");
-        userTO.getAuxClasses().add(typeClass.getKey());
-        userTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("issue260@syncope.apache.org");
+        userCR.getAuxClasses().add(typeClass.getKey());
+        userCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "1.2"));
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         schemaTO.setUniqueConstraint(false);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
index 30e49af..f07a546 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java
@@ -32,7 +32,9 @@ import java.util.Optional;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.SerializationUtils;
 import org.apache.syncope.client.lib.batch.BatchRequest;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AttrPatch;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.TaskTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
@@ -96,9 +98,9 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
     @Test
     public void batch() throws IOException {
         // create user with testdb resource
-        UserTO userTO = UserITCase.getUniqueSampleTO("taskBatch@apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("taskBatch@apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO userTO = createUser(userCR).getEntity();
 
         List<PropagationTaskTO> tasks = new ArrayList<>(
                 taskService.<PropagationTaskTO>search(new TaskQuery.Builder(TaskType.PROPAGATION).
@@ -139,11 +141,12 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
             resourceService.update(resource);
 
             // 1. create printer on external resource
-            AnyObjectTO anyObjectTO = AnyObjectITCase.getSampleTO("propagationJEXLTransformer");
-            String originalLocation = anyObjectTO.getPlainAttr("location").get().getValues().get(0);
+            AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("propagationJEXLTransformer");
+            String originalLocation = anyObjectCR.getPlainAttrs().stream().
+                    filter(attr -> "location".equals(attr.getSchema())).findFirst().get().getValues().get(0);
             assertFalse(originalLocation.endsWith(suffix));
 
-            anyObjectTO = createAnyObject(anyObjectTO).getEntity();
+            AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
             assertNotNull(anyObjectTO);
 
             // 2. verify that JEXL MappingItemTransformer was applied during propagation
@@ -179,11 +182,11 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
         ldap = createResource(ldap);
 
         try {
-            UserTO user = UserITCase.getUniqueSampleTO("privilege@syncope.apache.org");
-            user.getResources().add(ldap.getKey());
-            user.getRoles().add("Other");
+            UserCR userCR = UserITCase.getUniqueSample("privilege@syncope.apache.org");
+            userCR.getResources().add(ldap.getKey());
+            userCR.getRoles().add("Other");
 
-            ProvisioningResult<UserTO> result = createUser(user);
+            ProvisioningResult<UserTO> result = createUser(userCR);
             assertEquals(1, result.getPropagationStatuses().size());
             assertNotNull(result.getPropagationStatuses().get(0).getAfterObj());
 
@@ -245,10 +248,10 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
     @Test
     public void issueSYNCOPE1288() {
         // create a new user
-        UserTO userTO = UserITCase.getUniqueSampleTO("xxxyyy@xxx.xxx");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = UserITCase.getUniqueSample("xxxyyy@xxx.xxx");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // generate some PropagationTasks
@@ -312,5 +315,4 @@ public class PropagationTaskITCase extends AbstractTaskITCase {
 
         assertTrue(orderedTasks.getResult().equals(unorderedTasks.getResult()));
     }
-
 }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
index bb8a25c..1b850eb 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
@@ -52,6 +52,10 @@ import org.apache.syncope.common.lib.request.ResourceDR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.PullPolicyTO;
+import org.apache.syncope.common.lib.request.AnyCR;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.TaskTO;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
@@ -214,20 +218,20 @@ public class PullTaskITCase extends AbstractTaskITCase {
         // -----------------------------
         // Create a new user ... it should be updated applying pull policy
         // -----------------------------
-        UserTO inUserTO = new UserTO();
-        inUserTO.setRealm(SyncopeConstants.ROOT_REALM);
-        inUserTO.setPassword("password123");
+        UserCR inUserRC = new UserCR();
+        inUserRC.setRealm(SyncopeConstants.ROOT_REALM);
+        inUserRC.setPassword("password123");
         String userName = "test9";
-        inUserTO.setUsername(userName);
-        inUserTO.getPlainAttrs().add(attrTO("firstname", "nome9"));
-        inUserTO.getPlainAttrs().add(attrTO("surname", "cognome"));
-        inUserTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        inUserTO.getPlainAttrs().add(attrTO("fullname", "nome cognome"));
-        inUserTO.getPlainAttrs().add(attrTO("userId", "puccini@syncope.apache.org"));
-        inUserTO.getPlainAttrs().add(attrTO("email", "puccini@syncope.apache.org"));
-        inUserTO.getAuxClasses().add("csv");
-
-        inUserTO = createUser(inUserTO).getEntity();
+        inUserRC.setUsername(userName);
+        inUserRC.getPlainAttrs().add(attrTO("firstname", "nome9"));
+        inUserRC.getPlainAttrs().add(attrTO("surname", "cognome"));
+        inUserRC.getPlainAttrs().add(attrTO("ctype", "a type"));
+        inUserRC.getPlainAttrs().add(attrTO("fullname", "nome cognome"));
+        inUserRC.getPlainAttrs().add(attrTO("userId", "puccini@syncope.apache.org"));
+        inUserRC.getPlainAttrs().add(attrTO("email", "puccini@syncope.apache.org"));
+        inUserRC.getAuxClasses().add("csv");
+
+        UserTO inUserTO = createUser(inUserRC).getEntity();
         assertNotNull(inUserTO);
         assertFalse(inUserTO.getResources().contains(RESOURCE_NAME_CSV));
 
@@ -399,11 +403,11 @@ public class PullTaskITCase extends AbstractTaskITCase {
         // Check for SYNCOPE-1343
         assertEquals("odd", matchingUsers.getResult().get(0).getPlainAttr("title").get().getValues().get(0));
 
-        GroupTO groupTO = matchingGroups.getResult().iterator().next();
+        GroupTO groupTO = matchingGroups.getResult().get(0);
         assertNotNull(groupTO);
         assertEquals("testLDAPGroup", groupTO.getName());
         assertEquals("true", groupTO.getPlainAttr("show").get().getValues().get(0));
-        assertEquals(matchingUsers.getResult().iterator().next().getKey(), groupTO.getUserOwner());
+        assertEquals(matchingUsers.getResult().get(0).getKey(), groupTO.getUserOwner());
         assertNull(groupTO.getGroupOwner());
         // SYNCOPE-1343, set value title to null on LDAP
         ConnObjectTO userConnObject = resourceService.readConnObject(
@@ -518,13 +522,12 @@ public class PullTaskITCase extends AbstractTaskITCase {
                     UUID.randomUUID().toString(), "Mysterious Printer", "Nowhere", true, new Date());
 
             // 1. create printer on external resource
-            AnyObjectTO anyObjectTO = AnyObjectITCase.getSampleTO("pull");
+            AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("pull");
+            AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity();
+            assertNotNull(anyObjectTO);
             String originalLocation = anyObjectTO.getPlainAttr("location").get().getValues().get(0);
             assertFalse(originalLocation.startsWith(prefix));
 
-            anyObjectTO = createAnyObject(anyObjectTO).getEntity();
-            assertNotNull(anyObjectTO);
-
             // 2. verify that PrefixMappingItemTransformer was applied during propagation
             // (location starts with given prefix on external resource)
             ConnObjectTO connObjectTO = resourceService.
@@ -766,22 +769,23 @@ public class PullTaskITCase extends AbstractTaskITCase {
             assertTrue(remediation.isPresent());
             assertEquals(AnyTypeKind.USER.name(), remediation.get().getAnyType());
             assertEquals(ResourceOperation.CREATE, remediation.get().getOperation());
-            assertNotNull(remediation.get().getAnyTOPayload());
+            assertNotNull(remediation.get().getAnyCRPayload());
             assertNull(remediation.get().getAnyURPayload());
             assertNull(remediation.get().getKeyPayload());
             assertTrue(remediation.get().getError().contains("RequiredValuesMissing [userId]"));
 
             // 4. remedy by copying the email value to userId
-            UserTO user = (UserTO) remediation.get().getAnyTOPayload();
-            user.getResources().clear();
+            AnyCR userCR = remediation.get().getAnyCRPayload();
+            userCR.getResources().clear();
 
-            String email = user.getPlainAttr("email").get().getValues().get(0);
-            user.getPlainAttrs().add(new AttrTO.Builder().schema("userId").value(email).build());
+            String email = userCR.getPlainAttrs().stream().
+                    filter(attr -> "email".equals(attr.getSchema())).findFirst().get().getValues().get(0);
+            userCR.getPlainAttrs().add(new AttrTO.Builder().schema("userId").value(email).build());
 
-            remediationService.remedy(remediation.get().getKey(), user);
+            remediationService.remedy(remediation.get().getKey(), userCR);
 
             // 5. user is now found
-            user = userService.read("pullFromLDAP");
+            UserTO user = userService.read("pullFromLDAP");
             assertNotNull(user);
             assertEquals(email, user.getPlainAttr("userId").get().getValues().get(0));
 
@@ -802,25 +806,25 @@ public class PullTaskITCase extends AbstractTaskITCase {
         //-----------------------------
         // Create a new user ... it should be updated applying pull policy
         //-----------------------------
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword("password123");
-        userTO.setUsername("testuser2");
-
-        userTO.getPlainAttrs().add(attrTO("firstname", "testuser2"));
-        userTO.getPlainAttrs().add(attrTO("surname", "testuser2"));
-        userTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        userTO.getPlainAttrs().add(attrTO("fullname", "a type"));
-        userTO.getPlainAttrs().add(attrTO("userId", "testuser2@syncope.apache.org"));
-        userTO.getPlainAttrs().add(attrTO("email", "testuser2@syncope.apache.org"));
-
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION2);
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
-
-        userTO.getMemberships().add(
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setPassword("password123");
+        userCR.setUsername("testuser2");
+
+        userCR.getPlainAttrs().add(attrTO("firstname", "testuser2"));
+        userCR.getPlainAttrs().add(attrTO("surname", "testuser2"));
+        userCR.getPlainAttrs().add(attrTO("ctype", "a type"));
+        userCR.getPlainAttrs().add(attrTO("fullname", "a type"));
+        userCR.getPlainAttrs().add(attrTO("userId", "testuser2@syncope.apache.org"));
+        userCR.getPlainAttrs().add(attrTO("email", "testuser2@syncope.apache.org"));
+
+        userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION2);
+        userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION4);
+
+        userCR.getMemberships().add(
                 new MembershipTO.Builder().group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals("testuser2", userTO.getUsername());
         assertEquals(1, userTO.getMemberships().size());
@@ -941,17 +945,17 @@ public class PullTaskITCase extends AbstractTaskITCase {
         Response response = taskService.create(TaskType.PULL, task);
         task = getObject(response.getLocation(), TaskService.class, PullTaskTO.class);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("s258_1@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        UserCR userCR = UserITCase.getUniqueSample("s258_1@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        createUser(userTO);
+        createUser(userCR);
 
-        userTO = UserITCase.getUniqueSampleTO("s258_2@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        userCR = UserITCase.getUniqueSample("s258_2@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         // change email in order to unmatch the second user
         UserUR userUR = new UserUR();
@@ -975,11 +979,11 @@ public class PullTaskITCase extends AbstractTaskITCase {
         removeTestUsers();
 
         // create user with testdb resource
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope272@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        UserCR userCR = UserITCase.getUniqueSample("syncope272@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
-        userTO = result.getEntity();
+        ProvisioningResult<UserTO> result = createUser(userCR);
+        UserTO userTO = result.getEntity();
         try {
             assertNotNull(userTO);
             assertEquals(1, result.getPropagationStatuses().size());
@@ -1001,16 +1005,16 @@ public class PullTaskITCase extends AbstractTaskITCase {
 
     @Test
     public void issueSYNCOPE307() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("s307@apache.org");
-        userTO.setUsername("test0");
-        userTO.getPlainAttr("firstname").get().getValues().clear();
-        userTO.getPlainAttr("firstname").get().getValues().add("nome0");
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("s307@apache.org");
+        userCR.setUsername("test0");
+        userCR.getPlainAttrs().removeIf(attr -> "firstname".equals(attr.getSchema()));
+        userCR.getPlainAttrs().add(attrTO("firstname", "nome0"));
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_WS2);
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_WS2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         userTO = userService.read(userTO.getKey());
@@ -1046,10 +1050,10 @@ public class PullTaskITCase extends AbstractTaskITCase {
     @Test
     public void issueSYNCOPE313DB() throws Exception {
         // 1. create user in DB
-        UserTO user = UserITCase.getUniqueSampleTO("syncope313-db@syncope.apache.org");
-        user.setPassword("security123");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope313-db@syncope.apache.org");
+        userCR.setPassword("security123");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertFalse(user.getResources().isEmpty());
 
@@ -1118,10 +1122,10 @@ public class PullTaskITCase extends AbstractTaskITCase {
         try {
             // 1. create user in LDAP
             String oldCleanPassword = "security123";
-            user = UserITCase.getUniqueSampleTO("syncope313-ldap@syncope.apache.org");
-            user.setPassword(oldCleanPassword);
-            user.getResources().add(RESOURCE_NAME_LDAP);
-            user = createUser(user).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("syncope313-ldap@syncope.apache.org");
+            userCR.setPassword(oldCleanPassword);
+            userCR.getResources().add(RESOURCE_NAME_LDAP);
+            user = createUser(userCR).getEntity();
             assertNotNull(user);
             assertFalse(user.getResources().isEmpty());
 
@@ -1213,9 +1217,9 @@ public class PullTaskITCase extends AbstractTaskITCase {
         GroupTO group = null;
         try {
             // 1. create group with resource for propagation
-            propagationGroup = GroupITCase.getBasicSampleTO("SYNCOPE1062");
-            propagationGroup.getResources().add(RESOURCE_NAME_DBPULL);
-            propagationGroup = createGroup(propagationGroup).getEntity();
+            GroupCR propagationGroupCR = GroupITCase.getBasicSample("SYNCOPE1062");
+            propagationGroupCR.getResources().add(RESOURCE_NAME_DBPULL);
+            propagationGroup = createGroup(propagationGroupCR).getEntity();
 
             // 2. create pull task for another resource, with user template assigning the group above
             pullTask = new PullTaskTO();
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
index da4570b..4988a8b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java
@@ -33,6 +33,7 @@ import javax.sql.DataSource;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AnyTypeClassTO;
 import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.PushTaskTO;
@@ -365,14 +366,14 @@ public class PushTaskITCase extends AbstractTaskITCase {
         anyTypeClassService.create(typeClass);
 
         // create a new sample group
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("all" + getUUIDString());
-        groupTO.setRealm("/even");
-        groupTO.getAuxClasses().add(typeClass.getKey());
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("all" + getUUIDString());
+        groupCR.setRealm("/even");
+        groupCR.getAuxClasses().add(typeClass.getKey());
 
-        groupTO.getPlainAttrs().add(attrTO(schemaTO.getKey(), "all"));
+        groupCR.getPlainAttrs().add(attrTO(schemaTO.getKey(), "all"));
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         String resourceName = "resource-ldap-grouponly";
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
index 523ef51..a0326a3 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java
@@ -44,6 +44,7 @@ import org.apache.syncope.client.lib.BasicAuthenticationHandler;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.client.lib.SyncopeClientFactoryBean;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.request.GroupUR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
 import org.apache.syncope.common.lib.request.UserUR;
@@ -102,16 +103,16 @@ public class RESTITCase extends AbstractITCase {
         GroupService noContentService = noContentclient.prefer(
                 noContentclient.getService(GroupService.class), Preference.RETURN_NO_CONTENT);
 
-        GroupTO group = GroupITCase.getSampleTO("noContent");
+        GroupCR groupCR = GroupITCase.getSample("noContent");
 
-        Response response = noContentService.create(group);
+        Response response = noContentService.create(groupCR);
         assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
         assertEquals(Preference.RETURN_NO_CONTENT.toString(), response.getHeaderString(RESTHeaders.PREFERENCE_APPLIED));
         assertEquals(
                 StringUtils.EMPTY,
                 IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8));
 
-        group = getObject(response.getLocation(), GroupService.class, GroupTO.class);
+        GroupTO group = getObject(response.getLocation(), GroupService.class, GroupTO.class);
         assertNotNull(group);
 
         GroupUR groupUR = new GroupUR();
@@ -135,7 +136,7 @@ public class RESTITCase extends AbstractITCase {
 
     @Test
     public void ifMatch() {
-        UserTO userTO = userService.create(UserITCase.getUniqueSampleTO("ifmatch@syncope.apache.org"), true).
+        UserTO userTO = userService.create(UserITCase.getUniqueSample("ifmatch@syncope.apache.org")).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
         assertNotNull(userTO);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
index c8fd044..4374459 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java
@@ -26,6 +26,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.util.Date;
 import javax.sql.DataSource;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.PullTaskTO;
@@ -49,9 +50,9 @@ public class ReconciliationITCase extends AbstractITCase {
     @Test
     public void push() {
         // 1. create printer, with no resources
-        AnyObjectTO printer = AnyObjectITCase.getSampleTO("reconciliation");
-        printer.getResources().clear();
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = AnyObjectITCase.getSample("reconciliation");
+        printerCR.getResources().clear();
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
         assertNotNull(printer.getKey());
 
         // 2. verify no printer with that name is on the external resource's db
@@ -97,9 +98,9 @@ public class ReconciliationITCase extends AbstractITCase {
     @Test
     public void pull() {
         // 1. create printer, with no resources
-        AnyObjectTO printer = AnyObjectITCase.getSampleTO("reconciliation");
-        printer.getResources().clear();
-        printer = createAnyObject(printer).getEntity();
+        AnyObjectCR printerCR = AnyObjectITCase.getSample("reconciliation");
+        printerCR.getResources().clear();
+        AnyObjectTO printer = createAnyObject(printerCR).getEntity();
         assertNotNull(printer.getKey());
         assertNotEquals("Nowhere", printer.getPlainAttr("location").get().getValues().get(0));
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
index 2515264..8e92368 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java
@@ -40,6 +40,8 @@ import org.apache.commons.lang3.SerializationUtils;
 import org.apache.syncope.client.console.commons.ConnIdSpecialName;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
+import org.apache.syncope.common.lib.request.GroupCR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.ItemTO;
@@ -406,16 +408,18 @@ public class ResourceITCase extends AbstractITCase {
         ResourceTO resource = resourceService.read(RESOURCE_NAME_DBSCRIPTED);
         resource.setKey(resource.getKey() + getUUIDString());
 
-        AnyObjectTO anyObject = AnyObjectITCase.getSampleTO("syncToken");
-        anyObject.getResources().clear();
-        anyObject.getResources().add(resource.getKey());
+        AnyObjectCR anyObjectCR = AnyObjectITCase.getSample("syncToken");
+        anyObjectCR.getResources().clear();
+        anyObjectCR.getResources().add(resource.getKey());
+
+        AnyObjectTO anyObject = null;
         try {
             // create a new resource
             resource = createResource(resource);
             assertNull(resource.getProvision("PRINTER").get().getSyncToken());
 
             // create some object on the new resource
-            anyObject = createAnyObject(anyObject).getEntity();
+            anyObject = createAnyObject(anyObjectCR).getEntity();
 
             // update sync token
             resourceService.setLatestSyncToken(resource.getKey(), "PRINTER");
@@ -429,7 +433,7 @@ public class ResourceITCase extends AbstractITCase {
             resource = resourceService.read(resource.getKey());
             assertNull(resource.getProvision("PRINTER").get().getSyncToken());
         } finally {
-            if (anyObject.getKey() != null) {
+            if (anyObject != null) {
                 anyObjectService.delete(anyObject.getKey());
             }
             resourceService.delete(resource.getKey());
@@ -517,9 +521,9 @@ public class ResourceITCase extends AbstractITCase {
     public void listConnObjects() {
         List<String> groupKeys = new ArrayList<>();
         for (int i = 0; i < 10; i++) {
-            GroupTO group = GroupITCase.getSampleTO("group");
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getSample("group");
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             groupKeys.add(group.getKey());
         }
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
index 3994005..27f691a 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
@@ -321,7 +321,7 @@ public class SCIMITCase extends AbstractITCase {
         assertEquals("additional", additional.getDisplayName());
 
         // gt
-        UserTO newUser = userService.create(UserITCase.getUniqueSampleTO("scimsearch@syncope.apache.org"), true).
+        UserTO newUser = userService.create(UserITCase.getUniqueSample("scimsearch@syncope.apache.org")).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
 
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
index e803378..840da6e 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java
@@ -28,9 +28,12 @@ import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeConstants;
+import org.apache.syncope.common.lib.request.AnyObjectCR;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.MembershipUR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.to.AnyObjectTO;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
@@ -133,9 +136,9 @@ public class SearchITCase extends AbstractITCase {
 
     @Test
     public void searchByDynGroup() {
-        GroupTO group = GroupITCase.getBasicSampleTO("dynMembership");
-        group.setUDynMembershipCond("cool==true");
-        group = createGroup(group).getEntity();
+        GroupCR groupCR = GroupITCase.getBasicSample("dynMembership");
+        groupCR.setUDynMembershipCond("cool==true");
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
 
         if (ElasticsearchDetector.isElasticSearchEnabled(syncopeService)) {
@@ -373,11 +376,11 @@ public class SearchITCase extends AbstractITCase {
     @Test
     public void searchBySecurityAnswer() {
         String securityAnswer = RandomStringUtils.randomAlphanumeric(10);
-        UserTO userTO = UserITCase.getUniqueSampleTO("securityAnswer@syncope.apache.org");
-        userTO.setSecurityQuestion("887028ea-66fc-41e7-b397-620d7ea6dfbb");
-        userTO.setSecurityAnswer(securityAnswer);
+        UserCR userCR = UserITCase.getUniqueSample("securityAnswer@syncope.apache.org");
+        userCR.setSecurityQuestion("887028ea-66fc-41e7-b397-620d7ea6dfbb");
+        userCR.setSecurityAnswer(securityAnswer);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO.getSecurityQuestion());
 
         PagedResult<UserTO> matchingUsers = userService.search(
@@ -477,18 +480,18 @@ public class SearchITCase extends AbstractITCase {
 
         String serviceKey = null;
         try {
-            AnyObjectTO anyObjectTO = new AnyObjectTO();
-            anyObjectTO.setName("one");
-            anyObjectTO.setRealm(SyncopeConstants.ROOT_REALM);
-            anyObjectTO.setType(service.getKey());
-            anyObjectTO.getMemberships().add(
+            AnyObjectCR anyObjectCR = new AnyObjectCR();
+            anyObjectCR.setName("one");
+            anyObjectCR.setRealm(SyncopeConstants.ROOT_REALM);
+            anyObjectCR.setType(service.getKey());
+            anyObjectCR.getMemberships().add(
                     new MembershipTO.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
-            serviceKey = createAnyObject(anyObjectTO).getEntity().getKey();
+            serviceKey = createAnyObject(anyObjectCR).getEntity().getKey();
 
             AnyObjectUR anyObjectUR = new AnyObjectUR();
             anyObjectUR.setKey("fc6dbc3a-6c07-4965-8781-921e7401a4a5");
-            anyObjectUR.getMemberships().add(
-                    new MembershipPatch.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").build());
+            anyObjectUR.getMemberships().add(new MembershipUR.Builder().group("29f96485-729e-4d31-88a1-6fc60e4677f3").
+                    build());
             updateAnyObject(anyObjectUR);
 
             PagedResult<AnyObjectTO> matching = anyObjectService.search(new AnyQuery.Builder().fiql(
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
index ceb82a3..e5d3d37 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
@@ -51,7 +51,7 @@ import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.request.ResourceAR;
 import org.apache.syncope.common.lib.request.AttrPatch;
 import org.apache.syncope.common.lib.request.ResourceDR;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StatusR;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
@@ -59,6 +59,7 @@ import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.AccountPolicyTO;
 import org.apache.syncope.common.lib.policy.HaveIBeenPwnedPasswordRuleConf;
 import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.ImplementationTO;
@@ -102,26 +103,23 @@ public class UserITCase extends AbstractITCase {
         return Boolean.parseBoolean(connObjectTO.getAttr(attrName).get().getValues().get(0));
     }
 
-    public static UserTO getUniqueSampleTO(final String email) {
-        return getSampleTO(getUUIDString() + email);
+    public static UserCR getUniqueSample(final String email) {
+        return getSample(getUUIDString() + email);
     }
 
-    public static UserTO getSampleTO(final String email) {
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword("password123");
-        userTO.setUsername(email);
-
-        userTO.getPlainAttrs().add(attrTO("fullname", email));
-        userTO.getPlainAttrs().add(attrTO("firstname", email));
-        userTO.getPlainAttrs().add(attrTO("surname", "surname"));
-        userTO.getPlainAttrs().add(attrTO("ctype", "a type"));
-        userTO.getPlainAttrs().add(attrTO("userId", email));
-        userTO.getPlainAttrs().add(attrTO("email", email));
-        userTO.getPlainAttrs().add(
-                attrTO("loginDate", DateFormatUtils.ISO_8601_EXTENDED_DATETIME_FORMAT.format(new Date())));
-
-        return userTO;
+    public static UserCR getSample(final String email) {
+        return new UserCR.Builder().
+                realm(SyncopeConstants.ROOT_REALM).
+                password("password123").
+                username(email).
+                plainAttr(attrTO("fullname", email)).
+                plainAttr(attrTO("firstname", email)).
+                plainAttr(attrTO("surname", "surname")).
+                plainAttr(attrTO("ctype", "a type")).
+                plainAttr(attrTO("userId", email)).
+                plainAttr(attrTO("email", email)).
+                plainAttr(attrTO("loginDate", DateFormatUtils.ISO_8601_EXTENDED_DATETIME_FORMAT.format(new Date()))).
+                build();
     }
 
     @Test
@@ -134,11 +132,11 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void createUserWithNoPropagation() {
         // create a new user
-        UserTO userTO = getUniqueSampleTO("xxx@xxx.xxx");
-        userTO.setPassword("password123");
-        userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION);
+        UserCR req = getUniqueSample("xxx@xxx.xxx");
+        req.setPassword("password123");
+        req.getResources().add(RESOURCE_NAME_NOPROPAGATION);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(req).getEntity();
 
         // get the propagation task just created
         PagedResult<PropagationTaskTO> tasks = taskService.search(new TaskQuery.Builder(TaskType.PROPAGATION).
@@ -154,28 +152,28 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void enforceMandatoryCondition() {
-        UserTO userTO = getUniqueSampleTO("enforce@apache.org");
-        userTO.getResources().add(RESOURCE_NAME_WS2);
-        userTO.setPassword("newPassword12");
+        UserCR userCR = getUniqueSample("enforce@apache.org");
+        userCR.getResources().add(RESOURCE_NAME_WS2);
+        userCR.setPassword("newPassword12");
 
         AttrTO type = null;
-        for (AttrTO attr : userTO.getPlainAttrs()) {
+        for (AttrTO attr : userCR.getPlainAttrs()) {
             if ("ctype".equals(attr.getSchema())) {
                 type = attr;
             }
         }
         assertNotNull(type);
-        userTO.getPlainAttrs().remove(type);
+        userCR.getPlainAttrs().remove(type);
 
         try {
-            userTO = createUser(userTO).getEntity();
+            createUser(userCR).getEntity();
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
         }
 
-        userTO.getPlainAttrs().add(type);
-        userTO = createUser(userTO).getEntity();
+        userCR.getPlainAttrs().add(type);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
     }
 
@@ -191,20 +189,20 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(resourceTO);
 
         try {
-            UserTO userTO = getUniqueSampleTO("syncope222@apache.org");
-            userTO.getResources().add(resourceTO.getKey());
-            userTO.setPassword("newPassword12");
+            UserCR userCR = getUniqueSample("syncope222@apache.org");
+            userCR.getResources().add(resourceTO.getKey());
+            userCR.setPassword("newPassword12");
 
             try {
-                userTO = createUser(userTO).getEntity();
+                createUser(userCR).getEntity();
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
             }
 
-            userTO.getAuxClasses().add("csv");
+            userCR.getAuxClasses().add("csv");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
             assertEquals(Collections.singleton(resourceTO.getKey()), userTO.getResources());
         } finally {
@@ -214,9 +212,9 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void createUserWithDbPropagation() {
-        UserTO userTO = getUniqueSampleTO("yyy@yyy.yyy");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        UserCR userCR = getUniqueSample("yyy@yyy.yyy");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
@@ -225,56 +223,56 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void createWithInvalidPassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidpasswd@syncope.apache.org");
-            userTO.setPassword("pass");
-            createUser(userTO);
+            UserCR userCR = getSample("invalidpasswd@syncope.apache.org");
+            userCR.setPassword("pass");
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidUsername() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidusername@syncope.apache.org");
-            userTO.setUsername("us");
-            userTO.setRealm("/odd");
+            UserCR userCR = getSample("invalidusername@syncope.apache.org");
+            userCR.setUsername("us");
+            userCR.setRealm("/odd");
 
-            createUser(userTO);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidPasswordByRes() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidPwdByRes@passwd.com");
+            UserCR userCR = getSample("invalidPwdByRes@passwd.com");
 
             // configured to be minLength=16
-            userTO.setPassword("password1");
-            userTO.getResources().add(RESOURCE_NAME_NOPROPAGATION);
-            createUser(userTO);
+            userCR.setPassword("password1");
+            userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithInvalidPasswordByGroup() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("invalidPwdByGroup@passwd.com");
+            UserCR userCR = getSample("invalidPwdByGroup@passwd.com");
 
             // configured to be minLength=16
-            userTO.setPassword("password1");
+            userCR.setPassword("password1");
 
-            userTO.getMemberships().add(new MembershipTO.Builder().
+            userCR.getMemberships().add(new MembershipTO.Builder().
                     group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-            createUser(userTO);
+            createUser(userCR);
         });
     }
 
     @Test
     public void createWithException() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO newUserTO = new UserTO();
-            newUserTO.getPlainAttrs().add(attrTO("userId", "userId@nowhere.org"));
-            createUser(newUserTO);
+            UserCR userCR = new UserCR();
+            userCR.getPlainAttrs().add(attrTO("userId", "userId@nowhere.org"));
+            createUser(userCR);
         });
     }
 
@@ -292,35 +290,35 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(taskTO);
         int maxTaskExecutions = taskTO.getExecutions().size();
 
-        UserTO userTO = getUniqueSampleTO("a.b@c.com");
+        UserCR userCR = getUniqueSample("a.b@c.com");
 
         // add a membership
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // add an attribute with a non-existing schema: must be ignored
         AttrTO attrWithInvalidSchemaTO = attrTO("invalid schema", "a value");
-        userTO.getPlainAttrs().add(attrWithInvalidSchemaTO);
+        userCR.getPlainAttrs().add(attrWithInvalidSchemaTO);
 
         // add an attribute with null value: must be ignored
-        userTO.getPlainAttrs().add(attrTO("activationDate", null));
+        userCR.getPlainAttrs().add(attrTO("activationDate", null));
 
         // 1. create user
-        UserTO newUserTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
-        assertNotNull(newUserTO);
+        assertNotNull(userTO);
 
         // issue SYNCOPE-15
-        assertNotNull(newUserTO.getCreationDate());
-        assertNotNull(newUserTO.getCreator());
-        assertNotNull(newUserTO.getLastChangeDate());
-        assertNotNull(newUserTO.getLastModifier());
-        assertTrue(newUserTO.getLastChangeDate().getTime() - newUserTO.getCreationDate().getTime() < 3000);
+        assertNotNull(userTO.getCreationDate());
+        assertNotNull(userTO.getCreator());
+        assertNotNull(userTO.getLastChangeDate());
+        assertNotNull(userTO.getLastModifier());
+        assertTrue(userTO.getLastChangeDate().getTime() - userTO.getCreationDate().getTime() < 3000);
 
-        assertFalse(newUserTO.getPlainAttrs().contains(attrWithInvalidSchemaTO));
+        assertFalse(userTO.getPlainAttrs().contains(attrWithInvalidSchemaTO));
 
         // check for changePwdDate
-        assertNotNull(newUserTO.getCreationDate());
+        assertNotNull(userTO.getCreationDate());
 
         // get the new task list
         tasks = taskService.search(new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build());
@@ -343,27 +341,27 @@ public class UserITCase extends AbstractITCase {
         // 3. verify password
         try {
             Pair<Map<String, Set<String>>, UserTO> self =
-                    clientFactory.create(newUserTO.getUsername(), "password123").self();
+                    clientFactory.create(userTO.getUsername(), "password123").self();
             assertNotNull(self);
         } catch (AccessControlException e) {
             fail("Credentials should be valid and not cause AccessControlException");
         }
 
         try {
-            clientFactory.create(newUserTO.getUsername(), "passwordXX").getService(UserSelfService.class);
+            clientFactory.create(userTO.getUsername(), "passwordXX").getService(UserSelfService.class);
             fail("Credentials are invalid, thus request should raise AccessControlException");
         } catch (AccessControlException e) {
             assertNotNull(e);
         }
 
         // 4. try (and fail) to create another user with same (unique) values
-        userTO = getSampleTO(userTO.getUsername());
+        userCR = getSample(userTO.getUsername());
         AttrTO userIdAttr = userTO.getPlainAttr("userId").get();
         userIdAttr.getValues().clear();
         userIdAttr.getValues().add("a.b@c.com");
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.EntityExists, e.getType());
@@ -372,30 +370,32 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void createWithRequiredValueMissing() {
-        UserTO userTO = getUniqueSampleTO("a.b@c.it");
+        UserCR userCR = getUniqueSample("a.b@c.it");
 
-        AttrTO type = userTO.getPlainAttr("ctype").get();
-        userTO.getPlainAttrs().remove(type);
+        AttrTO type = userCR.getPlainAttrs().stream().
+                filter(attr -> "ctype".equals(attr.getSchema())).findFirst().get();
+        userCR.getPlainAttrs().remove(type);
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user without type (mandatory by UserSchema)
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
         }
 
-        userTO.getPlainAttrs().add(attrTO("ctype", "F"));
+        userCR.getPlainAttrs().add(attrTO("ctype", "F"));
 
-        AttrTO surname = userTO.getPlainAttr("surname").get();
-        userTO.getPlainAttrs().remove(surname);
+        AttrTO surname = userCR.getPlainAttrs().stream().
+                filter(attr -> "surname".equals(attr.getSchema())).findFirst().get();
+        userCR.getPlainAttrs().remove(surname);
 
         // 2. create user without surname (mandatory when type == 'F')
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType());
@@ -410,12 +410,12 @@ public class UserITCase extends AbstractITCase {
             assertEquals(Response.Status.NOT_FOUND, e.getType().getResponseStatus());
         }
 
-        UserTO userTO = getSampleTO("qqgf.z@nn.com");
+        UserCR userCR = getSample("qqgf.z@nn.com");
 
         // specify a propagation
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         String key = userTO.getKey();
 
@@ -438,12 +438,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deleteByUsername() {
-        UserTO userTO = getSampleTO("delete.by.username@apache.org");
+        UserCR userCR = getSample("delete.by.username@apache.org");
 
         // specify a propagation
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         String key = userTO.getKey();
         userTO = userService.read(key);
@@ -501,10 +501,9 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void updateWithoutPassword() {
-        UserTO userTO = getUniqueSampleTO("updatewithout@password.com");
-
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("updatewithout@password.com");
 
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR.Builder().key(userTO.getKey()).
@@ -521,9 +520,9 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void updateInvalidPassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getSampleTO("updateinvalid@password.com");
+            UserCR userCR = getSample("updateinvalid@password.com");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             UserUR userUR = new UserUR();
@@ -537,10 +536,10 @@ public class UserITCase extends AbstractITCase {
     @Test
     public void updateSamePassword() {
         assertThrows(SyncopeClientException.class, () -> {
-            UserTO userTO = getUniqueSampleTO("updatesame@password.com");
-            userTO.setRealm("/even/two");
+            UserCR userCR = getUniqueSample("updatesame@password.com");
+            userCR.setRealm("/even/two");
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             UserUR userUR = new UserUR();
@@ -553,12 +552,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void update() {
-        UserTO userTO = getUniqueSampleTO("g.h@t.com");
+        UserCR userCR = getUniqueSample("g.h@t.com");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertFalse(userTO.getDerAttrs().isEmpty());
         assertEquals(1, userTO.getMemberships().size());
@@ -573,9 +572,9 @@ public class UserITCase extends AbstractITCase {
         String newFullName = getUUIDString() + "g.h@t.com";
         userUR.getPlainAttrs().add(attrAddReplacePatch("fullname", newFullName));
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                 group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -614,10 +613,10 @@ public class UserITCase extends AbstractITCase {
                 new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()).getTotalCount();
         assertFalse(beforeTasks <= 0);
 
-        UserTO userTO = getUniqueSampleTO("pwdonly@t.com");
-        userTO.getMemberships().add(new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
+        UserCR userCR = getUniqueSample("pwdonly@t.com");
+        userCR.getMemberships().add(new MembershipTO.Builder().group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
@@ -649,14 +648,14 @@ public class UserITCase extends AbstractITCase {
         // --------------------------------------
         // Create operation
         // --------------------------------------
-        UserTO userTO = getUniqueSampleTO("t@p.mode");
+        UserCR userCR = getUniqueSample("t@p.mode");
 
         // add a membership
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("f779c0d4-633b-4be5-8f57-32eb478a3ca5").build());
 
         // 1. create user
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // get the new task list
@@ -715,12 +714,12 @@ public class UserITCase extends AbstractITCase {
     public void createActivate() {
         assumeTrue(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService));
 
-        UserTO userTO = getUniqueSampleTO("createActivate@syncope.apache.org");
+        UserCR userCR = getUniqueSample("createActivate@syncope.apache.org");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("268fed79-f440-4390-9435-b273768eb5d6").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertNotNull(userTO);
         assertNotNull(userTO.getToken());
@@ -742,12 +741,12 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void suspendReactivate() {
-        UserTO userTO = getUniqueSampleTO("suspendReactivate@syncope.apache.org");
+        UserCR userCR = getUniqueSample("suspendReactivate@syncope.apache.org");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("bf825fe1-7320-4a54-bd64-143b5c18ab97").build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
 
         assertNotNull(userTO);
         assertEquals(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService)
@@ -779,12 +778,12 @@ public class UserITCase extends AbstractITCase {
         assertNotNull(ldap);
 
         // Create user with reference to resources
-        UserTO userTO = getUniqueSampleTO("suspreactonresource@syncope.apache.org");
-        userTO.getMemberships().clear();
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("suspreactonresource@syncope.apache.org");
+        userCR.getMemberships().clear();
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService)
                 ? "active"
@@ -842,11 +841,11 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void updateMultivalueAttribute() {
-        UserTO userTO = getUniqueSampleTO("multivalue@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getVirAttrs().clear();
+        UserCR userCR = getUniqueSample("multivalue@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getVirAttrs().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         AttrTO loginDate = userTO.getPlainAttr("loginDate").get();
@@ -887,12 +886,12 @@ public class UserITCase extends AbstractITCase {
         SyncopeClient asyncClient = clientFactory.create(ADMIN_UNAME, ADMIN_PWD);
         UserService asyncService = asyncClient.nullPriorityAsync(asyncClient.getService(UserService.class), true);
 
-        UserTO user = getUniqueSampleTO("async@syncope.apache.org");
-        user.getResources().add(RESOURCE_NAME_TESTDB);
-        user.getResources().add(RESOURCE_NAME_TESTDB2);
-        user.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = getUniqueSample("async@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB2);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        ProvisioningResult<UserTO> result = asyncService.create(user, true).readEntity(
+        ProvisioningResult<UserTO> result = asyncService.create(userCR).readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
         });
         assertNotNull(result);
@@ -919,19 +918,19 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void groupAttrPropagation() {
-        UserTO userTO = getUniqueSampleTO("checkGroupAttrPropagation@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
+        UserCR userCR = getUniqueSample("checkGroupAttrPropagation@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
 
-        userTO.getAuxClasses().add("csv");
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("37d15e4c-cdc1-460b-a591-8505c8133806").build());
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertNotNull(userTO.getDerAttr("csvuserid"));
 
@@ -985,28 +984,28 @@ public class UserITCase extends AbstractITCase {
         realmService.update(realm);
 
         try {
-            UserTO user = getUniqueSampleTO("custompolicyrules@syncope.apache.org");
-            user.setRealm(realm.getFullPath());
+            UserCR userCR = getUniqueSample("custompolicyrules@syncope.apache.org");
+            userCR.setRealm(realm.getFullPath());
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword"));
             }
 
-            user.setPassword(user.getPassword() + "XXX");
+            userCR.setPassword(userCR.getPassword() + "XXX");
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidUsername"));
             }
 
-            user.setUsername("YYY" + user.getUsername());
-            user = createUser(user).getEntity();
-            assertNotNull(user);
+            userCR.setUsername("YYY" + userCR.getUsername());
+            UserTO userTO = createUser(userCR).getEntity();
+            assertNotNull(userTO);
         } finally {
             realm.setAccountPolicy(oldAccountPolicy);
             realm.setPasswordPolicy(oldPasswordPolicy);
@@ -1019,13 +1018,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void mappingPurpose() {
-        UserTO userTO = getUniqueSampleTO("mpurpose@apache.org");
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("mpurpose@apache.org");
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         ConnObjectTO connObjectTO =
@@ -1037,8 +1036,8 @@ public class UserITCase extends AbstractITCase {
     public void batch() throws IOException {
         List<String> users = new ArrayList<>();
         for (int i = 0; i < 10; i++) {
-            UserTO userTO = getUniqueSampleTO("batch_" + i + "@apache.org");
-            users.add(String.valueOf(createUser(userTO).getEntity().getKey()));
+            UserCR userCR = getUniqueSample("batch_" + i + "@apache.org");
+            users.add(createUser(userCR).getEntity().getKey());
         }
 
         // check for a fail
@@ -1092,14 +1091,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void unlink() throws IOException {
-        UserTO userTO = getUniqueSampleTO("unlink@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("unlink@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1117,13 +1116,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void link() throws IOException {
-        UserTO userTO = getUniqueSampleTO("link@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("link@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1153,14 +1152,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void unassign() throws IOException {
-        UserTO userTO = getUniqueSampleTO("unassign@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("unassign@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1183,13 +1182,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void assign() throws IOException {
-        UserTO userTO = getUniqueSampleTO("assign@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("assign@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1213,14 +1212,14 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deprovision() throws IOException {
-        UserTO userTO = getUniqueSampleTO("deprovision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-
-        UserTO actual = createUser(userTO).getEntity();
+        UserCR userCR = getUniqueSample("deprovision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), actual.getKey()));
 
@@ -1243,13 +1242,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void provision() throws IOException {
-        UserTO userTO = getUniqueSampleTO("provision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("provision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1273,13 +1272,13 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void deprovisionUnlinked() throws IOException {
-        UserTO userTO = getUniqueSampleTO("provision@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = getUniqueSample("provision@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertTrue(actual.getResources().isEmpty());
 
@@ -1319,18 +1318,18 @@ public class UserITCase extends AbstractITCase {
 
     @Test
     public void restResource() {
-        UserTO userTO = getUniqueSampleTO("rest@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add("rest-target-resource");
+        UserCR userCR = getUniqueSample("rest@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add("rest-target-resource");
 
         // 1. create
-        ProvisioningResult<UserTO> result = userService.create(userTO, true).readEntity(
+        ProvisioningResult<UserTO> result = userService.create(userCR).readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
         });
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
         assertEquals("rest-target-resource", result.getPropagationStatuses().get(0).getResource());
-        assertEquals("surname", userTO.getPlainAttr("surname").get().getValues().get(0));
+        assertEquals("surname", result.getEntity().getPlainAttr("surname").get().getValues().get(0));
 
         // verify user exists on the backend REST service
         WebClient webClient = WebClient.create(
@@ -1390,18 +1389,18 @@ public class UserITCase extends AbstractITCase {
         realm.setPasswordPolicy(pwdPolicy.getKey());
         realmService.create(SyncopeConstants.ROOT_REALM, realm);
 
-        UserTO user = getUniqueSampleTO("hibp@syncope.apache.org");
-        user.setRealm("/hibp");
-        user.setPassword("password");
+        UserCR userCR = getUniqueSample("hibp@syncope.apache.org");
+        userCR.setRealm("/hibp");
+        userCR.setPassword("password");
         try {
-            createUser(user);
+            createUser(userCR);
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
             assertEquals("InvalidPassword: Password pwned", e.getElements().iterator().next());
         }
 
-        user.setPassword("1" + RandomStringUtils.randomAlphanumeric(10));
-        user = createUser(user).getEntity();
-        assertNotNull(user.getKey());
+        userCR.setPassword("1" + RandomStringUtils.randomAlphanumeric(10));
+        UserTO userTO = createUser(userCR).getEntity();
+        assertNotNull(userTO.getKey());
     }
 }
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
index d3b6463..4ac01df 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
@@ -46,13 +46,15 @@ import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.request.AttrPatch;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
 import org.apache.syncope.common.lib.request.StringReplacePatchItem;
 import org.apache.syncope.common.lib.request.UserUR;
 import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf;
 import org.apache.syncope.common.lib.policy.PasswordPolicyTO;
+import org.apache.syncope.common.lib.request.GroupCR;
+import org.apache.syncope.common.lib.request.UserCR;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.ConnObjectTO;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -97,17 +99,17 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issue186() {
         // 1. create an user with strict mandatory attributes only
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "issue186@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", userId));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", userId));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().isEmpty());
 
@@ -151,10 +153,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue213() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue213@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
+        UserCR userCR = UserITCase.getUniqueSample("issue213@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(1, userTO.getResources().size());
 
@@ -182,7 +184,7 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue234() {
-        UserTO inUserTO = UserITCase.getUniqueSampleTO("issue234@syncope.apache.org");
+        UserCR inUserTO = UserITCase.getUniqueSample("issue234@syncope.apache.org");
         inUserTO.getResources().add(RESOURCE_NAME_LDAP);
 
         UserTO userTO = createUser(inUserTO).getEntity();
@@ -200,11 +202,11 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue280() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue280@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
+        UserCR userCR = UserITCase.getUniqueSample("issue280@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -229,12 +231,12 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue281() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("issue281@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        UserCR userCR = UserITCase.getUniqueSample("issue281@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
 
         List<PropagationStatus> propagations = result.getPropagationStatuses();
@@ -248,7 +250,7 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issue288() {
-        UserTO userTO = UserITCase.getSampleTO("issue288@syncope.apache.org");
+        UserCR userTO = UserITCase.getSample("issue288@syncope.apache.org");
         userTO.getPlainAttrs().add(attrTO("aLong", "STRING"));
 
         try {
@@ -261,20 +263,20 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE108() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope108@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("syncope108@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("0626100b-a4ba-4e00-9971-86fad52a6216").build());
-        userTO.getMemberships().add(new MembershipTO.Builder().
+        userCR.getMemberships().add(new MembershipTO.Builder().
                 group("ba9ed509-b1f5-48ab-a334-c8530a6422dc").build());
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertEquals(2, userTO.getMemberships().size());
         assertEquals(1, userTO.getResources().size());
@@ -289,7 +291,7 @@ public class UserIssuesITCase extends AbstractITCase {
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().
+        userUR.getMemberships().add(new MembershipUR.Builder().
                 operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -324,7 +326,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userUR = new UserUR();
         userUR.setKey(userTO.getKey());
 
-        userUR.getMemberships().add(new MembershipPatch.Builder().
+        userUR.getMemberships().add(new MembershipUR.Builder().
                 operation(PatchOperation.DELETE).group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -343,16 +345,16 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE185() {
         // 1. create user with LDAP resource, succesfully propagated
-        UserTO userTO = UserITCase.getSampleTO("syncope185@syncope.apache.org");
-        userTO.getVirAttrs().clear();
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        UserCR userCR = UserITCase.getSample("syncope185@syncope.apache.org");
+        userCR.getVirAttrs().clear();
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertFalse(result.getPropagationStatuses().isEmpty());
         assertEquals(RESOURCE_NAME_LDAP, result.getPropagationStatuses().get(0).getResource());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         // 2. delete this user
         userService.delete(userTO.getKey());
@@ -376,11 +378,11 @@ public class UserIssuesITCase extends AbstractITCase {
         AttrTO newCA = configurationService.get(defaultCA.getSchema());
         assertEquals(defaultCA, newCA);
 
-        UserTO userTO = UserITCase.getSampleTO("syncope51@syncope.apache.org");
-        userTO.setPassword("password");
+        UserCR userCR = UserITCase.getSample("syncope51@syncope.apache.org");
+        userCR.setPassword("password");
 
         try {
-            createUser(userTO);
+            createUser(userCR);
             fail("Create user should not succeed");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.NotFound, e.getType());
@@ -399,17 +401,17 @@ public class UserIssuesITCase extends AbstractITCase {
         // ----------------------------------
         // create user and check virtual attribute value propagation
         // ----------------------------------
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope267@apache.org");
-        userTO.getVirAttrs().add(attrTO("virtualdata", "virtualvalue"));
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_DBVIRATTR);
+        UserCR userCR = UserITCase.getUniqueSample("syncope267@apache.org");
+        userCR.getVirAttrs().add(attrTO("virtualdata", "virtualvalue"));
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_DBVIRATTR);
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertNotNull(result);
         assertFalse(result.getPropagationStatuses().isEmpty());
         assertEquals(RESOURCE_NAME_DBVIRATTR, result.getPropagationStatuses().get(0).getResource());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         ConnObjectTO connObjectTO =
                 resourceService.readConnObject(RESOURCE_NAME_DBVIRATTR, AnyTypeKind.USER.name(), userTO.getKey());
@@ -426,10 +428,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE266() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope266@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope266@apache.org");
+        userCR.getResources().clear();
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -445,10 +447,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE279() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope279@apache.org");
-        userTO.getResources().clear();
-        userTO.getResources().add(RESOURCE_NAME_TIMEOUT);
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        UserCR userCR = UserITCase.getUniqueSample("syncope279@apache.org");
+        userCR.getResources().clear();
+        userCR.getResources().add(RESOURCE_NAME_TIMEOUT);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertEquals(RESOURCE_NAME_TIMEOUT, result.getPropagationStatuses().get(0).getResource());
         assertNotNull(result.getPropagationStatuses().get(0).getFailureReason());
         assertEquals(ExecStatus.FAILURE, result.getPropagationStatuses().get(0).getStatus());
@@ -457,13 +459,13 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE122() {
         // 1. create user on testdb and testdb2
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope122@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope122@apache.org");
+        userCR.getResources().clear();
 
-        userTO.getResources().add(RESOURCE_NAME_TESTDB);
-        userTO.getResources().add(RESOURCE_NAME_TESTDB2);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB);
+        userCR.getResources().add(RESOURCE_NAME_TESTDB2);
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_TESTDB));
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_TESTDB2));
@@ -476,7 +478,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDbAttr);
         assertNotNull(pwdOnTestDbAttr.getValues());
         assertFalse(pwdOnTestDbAttr.getValues().isEmpty());
-        String pwdOnTestDb = pwdOnTestDbAttr.getValues().iterator().next();
+        String pwdOnTestDb = pwdOnTestDbAttr.getValues().get(0);
 
         ConnObjectTO userOnDb2 = resourceService.readConnObject(
                 RESOURCE_NAME_TESTDB2, AnyTypeKind.USER.name(), userTO.getKey());
@@ -484,7 +486,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDb2Attr);
         assertNotNull(pwdOnTestDb2Attr.getValues());
         assertFalse(pwdOnTestDb2Attr.getValues().isEmpty());
-        String pwdOnTestDb2 = pwdOnTestDb2Attr.getValues().iterator().next();
+        String pwdOnTestDb2 = pwdOnTestDb2Attr.getValues().get(0);
 
         // 2. request to change password only on testdb (no Syncope, no testdb2)
         UserUR userUR = new UserUR();
@@ -498,7 +500,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 3a. Chech that only a single propagation took place
         assertNotNull(result.getPropagationStatuses());
         assertEquals(1, result.getPropagationStatuses().size());
-        assertEquals(RESOURCE_NAME_TESTDB, result.getPropagationStatuses().iterator().next().getResource());
+        assertEquals(RESOURCE_NAME_TESTDB, result.getPropagationStatuses().get(0).getResource());
 
         // 3b. verify that password hasn't changed on Syncope
         assertEquals(pwdOnSyncope, userTO.getPassword());
@@ -509,7 +511,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDbAttrAfter);
         assertNotNull(pwdOnTestDbAttrAfter.getValues());
         assertFalse(pwdOnTestDbAttrAfter.getValues().isEmpty());
-        assertNotEquals(pwdOnTestDb, pwdOnTestDbAttrAfter.getValues().iterator().next());
+        assertNotEquals(pwdOnTestDb, pwdOnTestDbAttrAfter.getValues().get(0));
 
         // 3d. verify that password hasn't changed on testdb2
         userOnDb2 = resourceService.readConnObject(RESOURCE_NAME_TESTDB2, AnyTypeKind.USER.name(), userTO.getKey());
@@ -517,7 +519,7 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNotNull(pwdOnTestDb2AttrAfter);
         assertNotNull(pwdOnTestDb2AttrAfter.getValues());
         assertFalse(pwdOnTestDb2AttrAfter.getValues().isEmpty());
-        assertEquals(pwdOnTestDb2, pwdOnTestDb2AttrAfter.getValues().iterator().next());
+        assertEquals(pwdOnTestDb2, pwdOnTestDb2AttrAfter.getValues().get(0));
     }
 
     @Test
@@ -533,10 +535,10 @@ public class UserIssuesITCase extends AbstractITCase {
         UserTO userTO = null;
         try {
             // 3. create user with no resources
-            userTO = UserITCase.getUniqueSampleTO("syncope136_AES@apache.org");
-            userTO.getResources().clear();
+            UserCR userCR = UserITCase.getUniqueSample("syncope136_AES@apache.org");
+            userCR.getResources().clear();
 
-            userTO = createUser(userTO).getEntity();
+            userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 4. update user, assign a propagation priority resource but don't provide any password
@@ -555,7 +557,7 @@ public class UserIssuesITCase extends AbstractITCase {
             List<PropagationStatus> props = result.getPropagationStatuses();
             assertNotNull(props);
             assertEquals(1, props.size());
-            PropagationStatus prop = props.iterator().next();
+            PropagationStatus prop = props.get(0);
             assertNotNull(prop);
             assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
             assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -573,9 +575,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE136Random() {
         // 1. create user with no resources
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope136_Random@apache.org");
-        userTO.getResources().clear();
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope136_Random@apache.org");
+        userCR.getResources().clear();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. update user, assign a propagation priority resource but don't provide any password
@@ -592,7 +594,7 @@ public class UserIssuesITCase extends AbstractITCase {
         List<PropagationStatus> props = result.getPropagationStatuses();
         assertNotNull(props);
         assertEquals(1, props.size());
-        PropagationStatus prop = props.iterator().next();
+        PropagationStatus prop = props.get(0);
         assertNotNull(prop);
         assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
         assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -628,20 +630,20 @@ public class UserIssuesITCase extends AbstractITCase {
         resourceService.update(ldap);
 
         // 1. create group with LDAP resource
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("SYNCOPE354-" + getUUIDString());
-        groupTO.setRealm("/");
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("SYNCOPE354-" + getUUIDString());
+        groupCR.setRealm("/");
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 2. create user with LDAP resource and membership of the above group
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope354@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope354@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.USER.name(), userTO.getKey()));
 
@@ -655,7 +657,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 4. remove membership
         UserUR userUR = new UserUR();
         userUR.setKey(userTO.getKey());
-        userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.DELETE).
+        userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.DELETE).
                 group(userTO.getMemberships().get(0).getGroupKey()).build());
 
         userTO = updateUser(userUR).getEntity();
@@ -684,22 +686,22 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE357() throws IOException {
         // 1. create group with LDAP resource
-        GroupTO groupTO = new GroupTO();
-        groupTO.setName("SYNCOPE357-" + getUUIDString());
-        groupTO.setRealm("/");
-        groupTO.getResources().add(RESOURCE_NAME_LDAP);
+        GroupCR groupCR = new GroupCR();
+        groupCR.setName("SYNCOPE357-" + getUUIDString());
+        groupCR.setRealm("/");
+        groupCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        groupTO = createGroup(groupTO).getEntity();
+        GroupTO groupTO = createGroup(groupCR).getEntity();
         assertNotNull(groupTO);
 
         // 2. create user with membership of the above group
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope357@syncope.apache.org");
-        userTO.getPlainAttrs().add(attrTO("obscure", "valueToBeObscured"));
-        userTO.getPlainAttrs().add(attrTO("photo", Base64.getEncoder().encodeToString(
+        UserCR userCR = UserITCase.getUniqueSample("syncope357@syncope.apache.org");
+        userCR.getPlainAttrs().add(attrTO("obscure", "valueToBeObscured"));
+        userCR.getPlainAttrs().add(attrTO("photo", Base64.getEncoder().encodeToString(
                 IOUtils.readBytesFromStream(getClass().getResourceAsStream("/favicon.jpg")))));
-        userTO.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder().group(groupTO.getKey()).build());
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP));
         assertNotNull(userTO.getPlainAttr("obscure"));
         assertNotNull(userTO.getPlainAttr("photo"));
@@ -730,9 +732,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE383() {
         // 1. create user without resources
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope383@apache.org");
-        userTO.getResources().clear();
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope383@apache.org");
+        userCR.getResources().clear();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. assign resource without specifying a new pwd and check propagation failure
@@ -764,17 +766,17 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE402() {
         // 1. create an user with strict mandatory attributes only
-        UserTO userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
+        UserCR userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "syncope402@syncope.apache.org";
-        userTO.setUsername(userId);
-        userTO.setPassword("password123");
+        userCR.setUsername(userId);
+        userCR.setPassword("password123");
 
-        userTO.getPlainAttrs().add(attrTO("userId", userId));
-        userTO.getPlainAttrs().add(attrTO("fullname", userId));
-        userTO.getPlainAttrs().add(attrTO("surname", userId));
+        userCR.getPlainAttrs().add(attrTO("userId", userId));
+        userCR.getPlainAttrs().add(attrTO("fullname", userId));
+        userCR.getPlainAttrs().add(attrTO("surname", userId));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertTrue(userTO.getResources().isEmpty());
 
@@ -816,16 +818,16 @@ public class UserIssuesITCase extends AbstractITCase {
         }
         assertNotNull(logicActions);
 
-        RealmTO realm = realmService.list("/even/two").iterator().next();
+        RealmTO realm = realmService.list("/even/two").get(0);
         assertNotNull(realm);
         realm.getActions().add(logicActions.getKey());
         realmService.update(realm);
 
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope420@syncope.apache.org");
-        userTO.setRealm(realm.getFullPath());
-        userTO.getPlainAttrs().add(attrTO("makeItDouble", "3"));
+        UserCR userCR = UserITCase.getUniqueSample("syncope420@syncope.apache.org");
+        userCR.setRealm(realm.getFullPath());
+        userCR.getPlainAttrs().add(attrTO("makeItDouble", "3"));
 
-        userTO = createUser(userTO).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertEquals("6", userTO.getPlainAttr("makeItDouble").get().getValues().get(0));
 
         UserUR userUR = new UserUR();
@@ -838,8 +840,8 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE426() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope426@syncope.apache.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope426@syncope.apache.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -853,9 +855,10 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE435() {
         // 1. create user without password
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope435@syncope.apache.org");
-        userTO.setPassword(null);
-        userTO = createUser(userTO, false).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope435@syncope.apache.org");
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. try to update user by subscribing a resource - works but propagation is not even attempted
@@ -876,9 +879,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE454() throws NamingException {
         // 1. create user with LDAP resource (with 'Generate password if missing' enabled)
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope454@syncope.apache.org");
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope454@syncope.apache.org");
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         // 2. read resource configuration for LDAP binding
@@ -909,13 +912,13 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE493() {
         // 1.  create user and check that firstname is not propagated on resource with mapping for firstname set to NONE
-        UserTO userTO = UserITCase.getUniqueSampleTO("493@test.org");
-        userTO.getResources().add(RESOURCE_NAME_WS1);
-        ProvisioningResult<UserTO> result = createUser(userTO);
-        assertNotNull(userTO);
+        UserCR userCR = UserITCase.getUniqueSample("493@test.org");
+        userCR.getResources().add(RESOURCE_NAME_WS1);
+        ProvisioningResult<UserTO> result = createUser(userCR);
+        assertNotNull(result);
         assertEquals(1, result.getPropagationStatuses().size());
         assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         ConnObjectTO actual =
                 resourceService.readConnObject(RESOURCE_NAME_WS1, AnyTypeKind.USER.name(), userTO.getKey());
@@ -981,9 +984,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE505DB() throws Exception {
         // 1. create user
-        UserTO user = UserITCase.getUniqueSampleTO("syncope505-db@syncope.apache.org");
-        user.setPassword("security123");
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope505-db@syncope.apache.org");
+        userCR.setPassword("security123");
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertTrue(user.getResources().isEmpty());
 
@@ -1031,9 +1034,9 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE505LDAP() throws Exception {
         // 1. create user
-        UserTO user = UserITCase.getUniqueSampleTO("syncope505-ldap@syncope.apache.org");
-        user.setPassword("security123");
-        user = createUser(user).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope505-ldap@syncope.apache.org");
+        userCR.setPassword("security123");
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
         assertTrue(user.getResources().isEmpty());
 
@@ -1086,28 +1089,30 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE391() {
         // 1. create user on Syncope with null password
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword(null);
+        UserCR userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
 
-        userTO = createUser(userTO, false).getEntity();
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
         assertNull(userTO.getPassword());
 
         // 2. create existing user on csv and check that password on Syncope is null and that password on resource
         // doesn't change
-        userTO = new UserTO();
-        userTO.setRealm(SyncopeConstants.ROOT_REALM);
-        userTO.setPassword(null);
-        userTO.setUsername("syncope391@syncope.apache.org");
-        userTO.getPlainAttrs().add(attrTO("fullname", "fullname"));
-        userTO.getPlainAttrs().add(attrTO("firstname", "nome0"));
-        userTO.getPlainAttrs().add(attrTO("surname", "cognome0"));
-        userTO.getPlainAttrs().add(attrTO("userId", "syncope391@syncope.apache.org"));
-        userTO.getPlainAttrs().add(attrTO("email", "syncope391@syncope.apache.org"));
-
-        userTO.getAuxClasses().add("csv");
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-        userTO = createUser(userTO, false).getEntity();
+        userCR = new UserCR();
+        userCR.setRealm(SyncopeConstants.ROOT_REALM);
+        userCR.setPassword(null);
+        userCR.setStorePassword(false);
+        userCR.setUsername("syncope391@syncope.apache.org");
+        userCR.getPlainAttrs().add(attrTO("fullname", "fullname"));
+        userCR.getPlainAttrs().add(attrTO("firstname", "nome0"));
+        userCR.getPlainAttrs().add(attrTO("surname", "cognome0"));
+        userCR.getPlainAttrs().add(attrTO("userId", "syncope391@syncope.apache.org"));
+        userCR.getPlainAttrs().add(attrTO("email", "syncope391@syncope.apache.org"));
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         ConnObjectTO connObjectTO =
@@ -1120,13 +1125,14 @@ public class UserIssuesITCase extends AbstractITCase {
 
         // 3. create user with not null password and propagate onto resource-csv, specify not to save password on
         // Syncope local storage
-        userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword("passwordTESTNULL1");
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
-
-        userTO.getResources().add(RESOURCE_NAME_CSV);
-        userTO = createUser(userTO, false).getEntity();
+        userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword("passwordTESTNULL1");
+        userCR.setStorePassword(false);
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
+
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         connObjectTO =
@@ -1140,14 +1146,14 @@ public class UserIssuesITCase extends AbstractITCase {
         assertNull(userTO.getPassword());
 
         // 4. create user and propagate password on resource-csv and on Syncope local storage
-        userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-        userTO.setPassword("passwordTESTNULL1");
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+        userCR.setPassword("passwordTESTNULL1");
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
+        userCR.getResources().add(RESOURCE_NAME_CSV);
 
-        userTO.getResources().add(RESOURCE_NAME_CSV);
         // storePassword true by default
-        userTO = createUser(userTO).getEntity();
+        userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         connObjectTO = resourceService.readConnObject(RESOURCE_NAME_CSV, AnyTypeKind.USER.name(), userTO.getKey());
@@ -1170,13 +1176,14 @@ public class UserIssuesITCase extends AbstractITCase {
             csv = resourceService.read(RESOURCE_NAME_CSV);
             assertEquals("55e5de0b-c79c-4e66-adda-251b6fb8579a", csv.getPasswordPolicy());
 
-            userTO = UserITCase.getUniqueSampleTO("syncope391@syncope.apache.org");
-            userTO.setPassword(null);
-            userTO.getVirAttrs().clear();
-            userTO.getAuxClasses().add("csv");
+            userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org");
+            userCR.setPassword(null);
+            userCR.setStorePassword(false);
+            userCR.getVirAttrs().clear();
+            userCR.getAuxClasses().add("csv");
+            userCR.getResources().add(RESOURCE_NAME_CSV);
 
-            userTO.getResources().add(RESOURCE_NAME_CSV);
-            createUser(userTO, false);
+            createUser(userCR);
             fail("This should not happen");
         } catch (SyncopeClientException e) {
             assertEquals(ClientExceptionType.InvalidUser, e.getType());
@@ -1190,18 +1197,18 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE647() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope647@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getVirAttrs().clear();
-        userTO.getAuxClasses().add("csv");
+        UserCR userCR = UserITCase.getUniqueSample("syncope647@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getVirAttrs().clear();
+        userCR.getAuxClasses().add("csv");
 
-        userTO.getAuxClasses().add("generic membership");
-        userTO.getPlainAttrs().add(attrTO("postalAddress", "postalAddress"));
+        userCR.getAuxClasses().add("generic membership");
+        userCR.getPlainAttrs().add(attrTO("postalAddress", "postalAddress"));
 
-        userTO.getResources().add(RESOURCE_NAME_LDAP);
+        userCR.getResources().add(RESOURCE_NAME_LDAP);
 
-        UserTO actual = createUser(userTO).getEntity();
+        UserTO actual = createUser(userCR).getEntity();
         assertNotNull(actual);
         assertNotNull(actual.getDerAttr("csvuserid"));
 
@@ -1247,19 +1254,19 @@ public class UserIssuesITCase extends AbstractITCase {
         realmService.update(realm);
 
         try {
-            UserTO user = UserITCase.getUniqueSampleTO("syncope626@syncope.apache.org");
-            user.setRealm(realm.getFullPath());
-            user.setPassword(user.getUsername());
+            UserCR userCR = UserITCase.getUniqueSample("syncope626@syncope.apache.org");
+            userCR.setRealm(realm.getFullPath());
+            userCR.setPassword(userCR.getUsername());
             try {
-                createUser(user);
+                createUser(userCR);
                 fail("This should not happen");
             } catch (SyncopeClientException e) {
                 assertEquals(ClientExceptionType.InvalidUser, e.getType());
                 assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword"));
             }
 
-            user.setPassword("password123");
-            user = createUser(user).getEntity();
+            userCR.setPassword("password123");
+            UserTO user = createUser(userCR).getEntity();
             assertNotNull(user);
         } finally {
             realm.setPasswordPolicy(oldPasswordPolicy);
@@ -1282,22 +1289,22 @@ public class UserIssuesITCase extends AbstractITCase {
 
         try {
             // 3. create group with LDAP resource assigned
-            GroupTO group = GroupITCase.getBasicSampleTO("syncope686");
-            group.getResources().add(RESOURCE_NAME_LDAP);
-            group = createGroup(group).getEntity();
+            GroupCR groupCR = GroupITCase.getBasicSample("syncope686");
+            groupCR.getResources().add(RESOURCE_NAME_LDAP);
+            GroupTO group = createGroup(groupCR).getEntity();
             assertNotNull(group);
 
             // 4. create user with no resources
-            UserTO userTO = UserITCase.getUniqueSampleTO("syncope686@apache.org");
-            userTO.getResources().clear();
+            UserCR userCR = UserITCase.getUniqueSample("syncope686@apache.org");
+            userCR.getResources().clear();
 
-            userTO = createUser(userTO).getEntity();
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 5. update user with the new group, and don't provide any password
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
-            userUR.getMemberships().add(new MembershipPatch.Builder().operation(PatchOperation.ADD_REPLACE).
+            userUR.getMemberships().add(new MembershipUR.Builder().operation(PatchOperation.ADD_REPLACE).
                     group(group.getKey()).build());
 
             ProvisioningResult<UserTO> result = updateUser(userUR);
@@ -1307,7 +1314,7 @@ public class UserIssuesITCase extends AbstractITCase {
             List<PropagationStatus> props = result.getPropagationStatuses();
             assertNotNull(props);
             assertEquals(1, props.size());
-            PropagationStatus prop = props.iterator().next();
+            PropagationStatus prop = props.get(0);
             assertNotNull(prop);
             assertEquals(RESOURCE_NAME_LDAP, prop.getResource());
             assertEquals(ExecStatus.SUCCESS, prop.getStatus());
@@ -1321,24 +1328,24 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE710() {
         // 1. create groups for indirect resource assignment
-        GroupTO ldapGroup = GroupITCase.getBasicSampleTO("syncope710.ldap");
-        ldapGroup.getResources().add(RESOURCE_NAME_LDAP);
-        ldapGroup = createGroup(ldapGroup).getEntity();
+        GroupCR ldapGroupCR = GroupITCase.getBasicSample("syncope710.ldap");
+        ldapGroupCR.getResources().add(RESOURCE_NAME_LDAP);
+        GroupTO ldapGroup = createGroup(ldapGroupCR).getEntity();
 
-        GroupTO dbGroup = GroupITCase.getBasicSampleTO("syncope710.db");
-        dbGroup.getResources().add(RESOURCE_NAME_TESTDB);
-        dbGroup = createGroup(dbGroup).getEntity();
+        GroupCR dbGroupCR = GroupITCase.getBasicSample("syncope710.db");
+        dbGroupCR.getResources().add(RESOURCE_NAME_TESTDB);
+        GroupTO dbGroup = createGroup(dbGroupCR).getEntity();
 
         // 2. create user with memberships for the groups created above
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope710@syncope.apache.org");
-        userTO.getResources().clear();
-        userTO.getMemberships().clear();
-        userTO.getMemberships().add(new MembershipTO.Builder().group(ldapGroup.getKey()).build());
-        userTO.getMemberships().add(new MembershipTO.Builder().group(dbGroup.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope710@syncope.apache.org");
+        userCR.getResources().clear();
+        userCR.getMemberships().clear();
+        userCR.getMemberships().add(new MembershipTO.Builder().group(ldapGroup.getKey()).build());
+        userCR.getMemberships().add(new MembershipTO.Builder().group(dbGroup.getKey()).build());
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertEquals(2, result.getPropagationStatuses().size());
-        userTO = result.getEntity();
+        UserTO userTO = result.getEntity();
 
         // 3. request to propagate password only to db
         UserUR userUR = new UserUR();
@@ -1354,19 +1361,19 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE881() {
         // 1. create group and assign LDAP
-        GroupTO group = GroupITCase.getSampleTO("syncope881G");
-        group.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
+        GroupCR groupCR = GroupITCase.getSample("syncope881G");
+        groupCR.getVirAttrs().add(attrTO("rvirtualdata", "rvirtualvalue"));
 
-        group = createGroup(group).getEntity();
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
         assertNotNull(resourceService.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), group.getKey()));
 
         // 2. create user and assign such group
-        UserTO user = UserITCase.getUniqueSampleTO("syncope881U@apache.org");
-        user.getMemberships().clear();
-        user.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
+        UserCR userCR = UserITCase.getUniqueSample("syncope881U@apache.org");
+        userCR.getMemberships().clear();
+        userCR.getMemberships().add(new MembershipTO.Builder().group(group.getKey()).build());
 
-        user = createUser(user).getEntity();
+        UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
 
         // 3. verify that user is in LDAP
@@ -1388,23 +1395,25 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE1099() {
         // 1. create group with dynamic condition and resource
-        GroupTO group = GroupITCase.getSampleTO("syncope1099G");
-        group.getResources().clear();
-        group.getResources().add(RESOURCE_NAME_TESTDB);
-        group.setUDynMembershipCond("firstname==issueSYNCOPE1099");
+        GroupCR groupCR = GroupITCase.getSample("syncope1099G");
+        groupCR.getResources().clear();
+        groupCR.getResources().add(RESOURCE_NAME_TESTDB);
+        groupCR.setUDynMembershipCond("firstname==issueSYNCOPE1099");
 
-        group = createGroup(group).getEntity();
+        GroupTO group = createGroup(groupCR).getEntity();
         assertNotNull(group);
 
         // 2. create user matching the condition above
-        UserTO user = UserITCase.getUniqueSampleTO("syncope1099U@apache.org");
-        user.getPlainAttr("firstname").get().getValues().set(0, "issueSYNCOPE1099");
+        UserCR userCR = UserITCase.getUniqueSample("syncope1099U@apache.org");
+        userCR.getPlainAttrs().stream().
+                filter(attr -> "firstname".equals(attr.getSchema())).findFirst().get().
+                getValues().set(0, "issueSYNCOPE1099");
 
-        ProvisioningResult<UserTO> created = createUser(user);
+        ProvisioningResult<UserTO> created = createUser(userCR);
         assertNotNull(created);
 
         // 3. verify that dynamic membership is set and that resource is consequently assigned
-        user = created.getEntity();
+        UserTO user = created.getEntity();
         String groupKey = group.getKey();
         assertTrue(user.getDynMemberships().stream().anyMatch(m -> m.getGroupKey().equals(groupKey)));
         assertTrue(user.getResources().contains(RESOURCE_NAME_TESTDB));
@@ -1416,8 +1425,8 @@ public class UserIssuesITCase extends AbstractITCase {
 
     @Test
     public void issueSYNCOPE1166() {
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope1166@apache.org");
-        userTO = createUser(userTO).getEntity();
+        UserCR userCR = UserITCase.getUniqueSample("syncope1166@apache.org");
+        UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
         UserUR userUR = new UserUR();
@@ -1445,18 +1454,18 @@ public class UserIssuesITCase extends AbstractITCase {
     @Test
     public void issueSYNCOPE1206() {
         // 1. create group with dynamic user condition 'cool==true'
-        GroupTO dynGroup = GroupITCase.getSampleTO("syncope1206");
-        dynGroup.setUDynMembershipCond(
+        GroupCR dynGroupCR = GroupITCase.getSample("syncope1206");
+        dynGroupCR.setUDynMembershipCond(
                 SyncopeClient.getUserSearchConditionBuilder().is("cool").equalTo("true").query());
-        dynGroup = createGroup(dynGroup).getEntity();
+        GroupTO dynGroup = createGroup(dynGroupCR).getEntity();
         assertNotNull(dynGroup);
         assertTrue(dynGroup.getResources().contains(RESOURCE_NAME_LDAP));
 
         // 2. create user (no value for cool, no dynamic membership, no propagation to LDAP)
-        UserTO userTO = UserITCase.getUniqueSampleTO("syncope1206@apache.org");
-        userTO.getResources().clear();
+        UserCR userCR = UserITCase.getUniqueSample("syncope1206@apache.org");
+        userCR.getResources().clear();
 
-        ProvisioningResult<UserTO> result = createUser(userTO);
+        ProvisioningResult<UserTO> result = createUser(userCR);
         assertTrue(result.getPropagationStatuses().isEmpty());
 
         // 3. update user to match the dynamic condition: expect propagation to LDAP
@@ -1489,10 +1498,10 @@ public class UserIssuesITCase extends AbstractITCase {
 
         try {
             // 2. create user under /even/two to get password policy with history length 1
-            UserTO userTO = UserITCase.getUniqueSampleTO("syncope1337@apache.org");
-            userTO.setPassword("Password123");
-            userTO.setRealm("/even/two");
-            userTO = createUser(userTO).getEntity();
+            UserCR userCR = UserITCase.getUniqueSample("syncope1337@apache.org");
+            userCR.setPassword("Password123");
+            userCR.setRealm("/even/two");
+            UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
 
             // 3. attempt to set the same password value: fails
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
index 77a01ae..dd5b907 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
@@ -60,7 +60,7 @@ public class UserRequestITCase extends AbstractITCase {
     public void twoLevelsApproval() {
         assumeTrue(FlowableDetector.isFlowableEnabledForUserWorkflow(syncopeService));
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("twoLevelsApproval@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("twoLevelsApproval@tirasa.net")).getEntity();
         assertNotNull(user);
         assertFalse(user.getMembership("ebf97068-aa4b-4a85-9f01-680e8c4cf227").isPresent());
 
@@ -144,7 +144,7 @@ public class UserRequestITCase extends AbstractITCase {
                 userRequestService.getForms(new UserRequestFormQuery.Builder().build());
         int preForms = forms.getTotalCount();
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("twoLevelsApproval@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("twoLevelsApproval@tirasa.net")).getEntity();
         assertNotNull(user);
         assertFalse(user.getMembership("ebf97068-aa4b-4a85-9f01-680e8c4cf227").isPresent());
 
@@ -178,7 +178,7 @@ public class UserRequestITCase extends AbstractITCase {
                 userRequestService.getForms(new UserRequestFormQuery.Builder().build());
         int preForms = forms.getTotalCount();
 
-        UserTO user = createUser(UserITCase.getUniqueSampleTO("userSelection@tirasa.net")).getEntity();
+        UserTO user = createUser(UserITCase.getUniqueSample("userSelection@tirasa.net")).getEntity();
         assertNotNull(user);
         List<RelationshipTO> relationships = userService.read(user.getKey()).getRelationships();
         assertTrue(relationships.isEmpty());
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
index 8b33f8c..90ba42b 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
@@ -41,10 +41,11 @@ import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.request.BooleanReplacePatchItem;
-import org.apache.syncope.common.lib.request.MembershipPatch;
+import org.apache.syncope.common.lib.request.MembershipUR;
 import org.apache.syncope.common.lib.request.PasswordPatch;
 import org.apache.syncope.common.lib.request.StringPatchItem;
... 537 lines suppressed ...