--- pcs-0.9.137/pcs/pcs.py.acl-fix	2014-12-19 16:23:13.264292808 -0600
+++ pcs-0.9.137/pcs/pcs.py	2014-12-19 16:23:57.361816642 -0600
@@ -54,7 +54,7 @@ def main(argv):
                 pcs_short_options_with_args.append(prev_char)
             prev_char = c
 
-        pcs_long_options = ["local","start","all","clone","master","force","corosync_conf=", "defaults","debug","version","help","fullhelp","off","from=","to=", "name=", "wait", "group=","groups","full","enable","node=","nodesc","transport=", "addr0=","addr1=","bcast0=","bcast1=","mcast0=","mcast1=","mcastport0=","mcastport1=","ttl0=","ttl1=","rrpmode=", "broadcast0", "broadcast1","wait_for_all=","auto_tie_breaker=","last_man_standing=", "last_man_standing_window=","no-default-ops","ipv6","token=", "token_coefficient=", "consensus=", "miss_count_const=", "fail_recv_const=","join=", "disabled", "after=", "before=", "autocorrect", "interactive"]
+        pcs_long_options = ["local","start","all","clone","master","force","corosync_conf=", "defaults","debug","version","help","fullhelp","off","from=","to=", "name=", "wait", "group=","groups","full","enable","node=","nodesc","transport=", "addr0=","addr1=","bcast0=","bcast1=","mcast0=","mcast1=","mcastport0=","mcastport1=","ttl0=","ttl1=","rrpmode=", "broadcast0", "broadcast1","wait_for_all=","auto_tie_breaker=","last_man_standing=", "last_man_standing_window=","no-default-ops","ipv6","token=", "token_coefficient=", "consensus=", "miss_count_const=", "fail_recv_const=","join=", "disabled", "after=", "before=", "autocorrect", "interactive", "autodelete"]
         # pull out negative number arguments and add them back after getopt
         prev_arg = ""
         for arg in argv:
--- pcs-0.9.137/pcs/acl.py.acl-fix	2014-10-21 09:28:55.000000000 -0500
+++ pcs-0.9.137/pcs/acl.py	2014-12-19 16:23:13.264292808 -0600
@@ -58,6 +58,8 @@ def acl_role(argv):
         id_valid, id_error = utils.validate_xml_id(role_name, 'ACL role')
         if not id_valid:
             utils.err(id_error)
+        if utils.dom_get_element_with_id(dom, "acl_role", role_name):
+            utils.err("role %s already exists" % role_name)
         if utils.does_id_exist(dom,role_name):
             utils.err(role_name + " already exists")
 
@@ -178,8 +180,13 @@ def acl_role(argv):
 
         if not found:
             utils.err("cannot find role: %s, assigned to user/group: %s" % (role_id, ug_id))
+
+        if "--autodelete" in utils.pcs_options:
+            if not ug.getElementsByTagName("role"):
+                ug.parentNode.removeChild(ug)
+
         utils.replace_cib_configuration(dom)
-        
+
     else:
         utils.err("Unknown pcs acl role command: '" + command + "' (try create or delete)")
 
@@ -198,8 +205,14 @@ def acl_target(argv,group=False):
     command = argv.pop(0)
     tug_id = argv.pop(0)
     if command == "create":
+        # pcsd parses the error message in order to determine whether the id is
+        # assigned to user/group or some other cib element
+        if group and utils.dom_get_element_with_id(dom, "acl_group", tug_id):
+            utils.err("group %s already exists" % tug_id)
+        if not group and utils.dom_get_element_with_id(dom, "acl_target", tug_id):
+            utils.err("user %s already exists" % tug_id)
         if utils.does_id_exist(dom,tug_id):
-            utils.err(tug_id + " already exists in cib")
+            utils.err(tug_id + " already exists")
 
         if group:
             element = dom.createElement("acl_group")
--- pcs-0.9.137/pcsd/pcs.rb.acl-fix	2014-11-20 02:53:57.000000000 -0600
+++ pcs-0.9.137/pcsd/pcs.rb	2014-12-19 16:23:20.063219392 -0600
@@ -189,8 +189,8 @@ def add_acl_usergroup(acl_role_id, user_
     if retval == 0
       return ""
     end
-    if stderr.join("\n").strip.downcase != "error: #{name.to_s.downcase} already exists in cib"
-      return stderror.join("\n").strip
+    if not /^error: (user|group) #{name.to_s} already exists$/i.match(stderr.join("\n").strip)
+      return stderr.join("\n").strip
     end
   end
   stdout, stderror, retval = run_cmd(
@@ -211,7 +211,10 @@ def remove_acl_permission(acl_perm_id)
 end
 
 def remove_acl_usergroup(role_id, usergroup_id)
-  stdout, stderror, retval = run_cmd(PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s)
+  stdout, stderror, retval = run_cmd(
+    PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
+    "--autodelete"
+  )
   if retval != 0
     return stderror.join("\n").chomp
   end