diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceContentResourcePanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceContentResourcePanel.java
index 43457bcefdb..fe6912d1b35 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceContentResourcePanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/resources/ResourceContentResourcePanel.java
@@ -34,6 +34,7 @@
 import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.schema.GetOperationOptions;
 import com.evolveum.midpoint.schema.SelectorOptions;
+import com.evolveum.midpoint.schema.processor.ResourceAttributeDefinition;
 import com.evolveum.midpoint.schema.util.ResourceTypeUtil;
 import com.evolveum.midpoint.util.exception.SchemaException;
 import com.evolveum.midpoint.web.component.search.Search;
@@ -97,7 +98,7 @@ private <T extends ObjectType> List<SearchItemDefinition> createAttributeDefinit
 
 		ItemPath attributePath = ShadowType.F_ATTRIBUTES;
 
-		for (ItemDefinition def : (List<ItemDefinition>) ocDef.getDefinitions()) {
+		for (ResourceAttributeDefinition def : ocDef.getAttributeDefinitions()) {
 			if (!(def instanceof PrismPropertyDefinition) && !(def instanceof PrismReferenceDefinition)) {
 				continue;
 			}
diff --git a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
index 6d8eaebdd84..d788ae69c22 100644
--- a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
+++ b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
@@ -345,6 +345,10 @@ protected void cleanUpSecurity() {
 		securityContext.setAuthentication(null);
 	}
 
+	protected void initDummyResource(String name, DummyResourceContoller controller) {
+		dummyResourceCollection.initDummyResource(name, controller);
+	}
+	
 	protected DummyResourceContoller initDummyResource(String name, File resourceFile, String resourceOid,
 			FailableProcessor<DummyResourceContoller> controllerInitLambda,
 			Task task, OperationResult result) throws Exception {
@@ -3676,7 +3680,7 @@ protected <O extends ObjectType> String addObject(PrismObject<O> object, ModelEx
         ObjectDelta<O> addDelta = object.createAddDelta();
         assertFalse("Immutable object provided?",addDelta.getObjectToAdd().isImmutable());
         Collection<ObjectDeltaOperation<? extends ObjectType>> executedDeltas = executeChanges(addDelta, options, task, result);
-        object.setOid(ObjectDeltaOperation.findFocusDeltaOidInCollection(executedDeltas));
+        object.setOid(ObjectDeltaOperation.findAddDeltaOid(executedDeltas, object));
         return object.getOid();
 	}
 
diff --git a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/DummyResourceCollection.java b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/DummyResourceCollection.java
index 71052469bce..07d92236341 100644
--- a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/DummyResourceCollection.java
+++ b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/DummyResourceCollection.java
@@ -75,6 +75,13 @@ public DummyResourceContoller initDummyResource(String name, File resourceFile,
 		map.put(name, controller);
 		return controller;
 	}
+	
+	public void initDummyResource(String name, DummyResourceContoller controller) {
+		if (map.containsKey(name)) {
+			throw new IllegalArgumentException("Dummy resource "+name+" already initialized");
+		}
+		map.put(name, controller);
+	}
 
 	public DummyResourceContoller get(String name) {
 		DummyResourceContoller contoller = map.get(name);
diff --git a/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/AccessChecker.java b/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/AccessChecker.java
index adaaa88a052..6cd19ae7a1c 100644
--- a/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/AccessChecker.java
+++ b/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/AccessChecker.java
@@ -16,6 +16,7 @@
 package com.evolveum.midpoint.provisioning.impl;
 
 import java.util.Collection;
+import java.util.List;
 
 import javax.xml.namespace.QName;
 
@@ -96,12 +97,14 @@ public void checkAdd(ProvisioningContext ctx, PrismObject<ShadowType> shadow, Op
 		result.recordSuccess();
 	}
 
-	public void checkModify(ResourceType resource, PrismObject<ShadowType> shadow,
-			Collection<? extends ItemDelta> modifications, RefinedObjectClassDefinition objectClassDefinition,
-			OperationResult parentResult) throws SecurityViolationException, SchemaException {
+	public void checkModify(ProvisioningContext ctx, PrismObject<ShadowType> shadow,
+			Collection<? extends ItemDelta> modifications,
+			OperationResult parentResult) throws SecurityViolationException, SchemaException, ConfigurationException, ObjectNotFoundException, CommunicationException, ExpressionEvaluationException {
 
+		RefinedObjectClassDefinition objectClassDefinition = ctx.getObjectClassDefinition();
+		
 		OperationResult result = parentResult.createMinorSubresult(OPERATION_NAME);
-		for (ItemDelta modification: modifications) {
+		for (ItemDelta<?,?> modification: modifications) {
 			if (!(modification instanceof PropertyDelta<?>)) {
 				continue;
 			}
@@ -111,6 +114,7 @@ public void checkModify(ResourceType resource, PrismObject<ShadowType> shadow,
 				continue;
 			}
 			QName attrName = attrDelta.getElementName();
+			LOGGER.trace("Checking attribue {} definition present in {}", attrName, objectClassDefinition);
 			RefinedAttributeDefinition attrDef = objectClassDefinition.findAttributeDefinition(attrName);
 			if (attrDef == null) {
 				throw new SchemaException("Cannot find definition of attribute "+attrName+" in "+objectClassDefinition);
diff --git a/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/ShadowCache.java b/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/ShadowCache.java
index 0824b03b701..c81c1ed8f2d 100644
--- a/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/ShadowCache.java
+++ b/provisioning/provisioning-impl/src/main/java/com/evolveum/midpoint/provisioning/impl/ShadowCache.java
@@ -923,7 +923,7 @@ public String modifyShadow(PrismObject<ShadowType> repoShadow,
 
 		Collection<QName> additionalAuxiliaryObjectClassQNames = new ArrayList<>();
 		for (ItemDelta modification : modifications) {
-			if (ShadowType.F_AUXILIARY_OBJECT_CLASS.equals(modification.getPath())) {
+			if (ShadowType.F_AUXILIARY_OBJECT_CLASS.equivalent(modification.getPath())) {
 				PropertyDelta<QName> auxDelta = (PropertyDelta<QName>) modification;
 				for (PrismPropertyValue<QName> pval : auxDelta.getValues(QName.class)) {
 					additionalAuxiliaryObjectClassQNames.add(pval.getValue());
@@ -959,8 +959,7 @@ private String modifyShadowAttempt(ProvisioningContext ctx,
 
 		shadowCaretaker.applyAttributesDefinition(ctx, repoShadow);
 
-		accessChecker.checkModify(ctx.getResource(), repoShadow, modifications,
-				ctx.getObjectClassDefinition(), parentResult);
+		accessChecker.checkModify(ctx, repoShadow, modifications, parentResult);
 		
 		XMLGregorianCalendar now = clock.currentTimeXMLGregorianCalendar();
 		
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMachineIntelligence.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMachineIntelligence.java
index 76262859788..d37e0e06178 100644
--- a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMachineIntelligence.java
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMachineIntelligence.java
@@ -180,7 +180,7 @@ public void test010importActiveUserRUR() throws Exception {
 
 	@Test
     public void test011importInactiveUserChappie() throws Exception {
-		final String TEST_NAME = "test020ResourceOpenDjGet";
+		final String TEST_NAME = "test011importInactiveUserChappie";
         TestUtil.displayTestTitle(this, TEST_NAME);
         Task task = taskManager.createTaskInstance(TestTrafo.class.getName() + "." + TEST_NAME);
         OperationResult result = task.getResult();
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMapleLeaf.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMapleLeaf.java
index 473dd7aab02..514a0e3fcfe 100644
--- a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMapleLeaf.java
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestMapleLeaf.java
@@ -397,7 +397,7 @@ public void test100changePasswordForceChange() throws Exception {
 		passwd = new ProtectedStringType();
 		passwd.setClearValue("somenewValue");
 		userDelta = createModifyUserReplaceDelta(USER_JACK_OID, SchemaConstants.PATH_PASSWORD_VALUE, passwd);
-		userDelta.addModificationReplaceProperty(SchemaConstants.PATH_PASSWORD, PasswordType.F_FORCE_CHANGE, Boolean.TRUE);
+		userDelta.addModificationReplaceProperty(SchemaConstants.PATH_PASSWORD_FORCE_CHANGE, Boolean.TRUE);
 		
 		executeChanges(userDelta, null, task, result);
 		
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestScience.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestScience.java
index 1d297864a8c..720ec198b7c 100644
--- a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestScience.java
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestScience.java
@@ -296,9 +296,9 @@ public void test102AssignRoleStats() throws Exception{
 
 		// THEN
 		result.computeStatus();
-		if (!result.isSuccess() && !result.isPartialError()) {
+		if (!result.isInProgress()) {
 			display(result);
-			AssertJUnit.fail("Expected success or partial error, but got "+result.getStatus());
+			AssertJUnit.fail("Expected in progress result, but got "+result.getStatus());
 		}
 		PrismObject<UserType> userJack = repositoryService.getObject(UserType.class, USER_JACK_OID, null, result);
 		AssertJUnit.assertNotNull("User jack not found", userJack);
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestTrafo.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestTrafo.java
index e8354d17991..b08f4f345c6 100644
--- a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestTrafo.java
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestTrafo.java
@@ -168,6 +168,7 @@ public void initSystem(Task initTask, OperationResult initResult) throws Excepti
 		resourceDummyAd = importAndGetObjectFromFileIgnoreWarnings(ResourceType.class, RESOURCE_DUMMY_AD_FILE, RESOURCE_DUMMY_AD_OID, initTask, initResult);
 		resourceDummyAdType = resourceDummyAd.asObjectable();
 		dummyResourceCtlAd.setResource(resourceDummyAd);
+		initDummyResource(RESOURCE_DUMMY_AD_ID, dummyResourceCtlAd);
 
 		dummyResourceCtlMail = DummyResourceContoller.create(RESOURCE_DUMMY_MAIL_ID, resourceDummyMail);
 		dummyResourceCtlMail.populateWithDefaultSchema();
@@ -186,6 +187,7 @@ public void initSystem(Task initTask, OperationResult initResult) throws Excepti
 		resourceDummyMail = importAndGetObjectFromFile(ResourceType.class, RESOURCE_DUMMY_MAIL_FILE, RESOURCE_DUMMY_MAIL_OID, initTask, initResult);
 		resourceDummyMailType = resourceDummyMail.asObjectable();
 		dummyResourceCtlMail.setResource(resourceDummyMail);
+		initDummyResource(RESOURCE_DUMMY_MAIL_ID, dummyResourceCtlMail);
 
 	}
 
diff --git a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestUnix.java b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestUnix.java
index e4cb1e25165..8c57587b736 100644
--- a/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestUnix.java
+++ b/testing/story/src/test/java/com/evolveum/midpoint/testing/story/TestUnix.java
@@ -15,8 +15,8 @@
  */
 package com.evolveum.midpoint.testing.story;
 
-import static org.testng.AssertJUnit.assertFalse;
 import static org.testng.AssertJUnit.assertEquals;
+import static org.testng.AssertJUnit.assertFalse;
 import static org.testng.AssertJUnit.assertNotNull;
 import static org.testng.AssertJUnit.assertNull;
 import static org.testng.AssertJUnit.assertTrue;
@@ -24,12 +24,9 @@
 import java.io.File;
 import java.util.List;
 
+import javax.xml.datatype.XMLGregorianCalendar;
 import javax.xml.namespace.QName;
 
-import com.evolveum.midpoint.prism.delta.ItemDelta;
-import com.evolveum.midpoint.prism.path.ItemName;
-import com.evolveum.midpoint.prism.path.ItemPath;
-import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
 import org.jetbrains.annotations.Nullable;
 import org.opends.server.types.DirectoryException;
 import org.opends.server.types.Entry;
@@ -41,6 +38,7 @@
 import org.testng.annotations.AfterClass;
 import org.testng.annotations.Test;
 
+import com.evolveum.midpoint.common.Utils;
 import com.evolveum.midpoint.common.refinery.RefinedObjectClassDefinition;
 import com.evolveum.midpoint.common.refinery.RefinedResourceSchema;
 import com.evolveum.midpoint.model.impl.sync.ReconciliationTaskHandler;
@@ -49,6 +47,9 @@
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.PrismProperty;
 import com.evolveum.midpoint.prism.delta.ChangeType;
+import com.evolveum.midpoint.prism.delta.ItemDelta;
+import com.evolveum.midpoint.prism.path.ItemName;
+import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.prism.polystring.PolyString;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
 import com.evolveum.midpoint.prism.util.PrismAsserts;
@@ -67,8 +68,21 @@
 import com.evolveum.midpoint.test.util.MidPointTestConstants;
 import com.evolveum.midpoint.test.util.TestUtil;
 import com.evolveum.midpoint.util.DOMUtil;
+import com.evolveum.midpoint.util.MiscUtil;
 import com.evolveum.midpoint.util.exception.ExpressionEvaluationException;
 import com.evolveum.midpoint.util.exception.SchemaException;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationStatusType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationPhaseType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ResourceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.SequenceType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowAssociationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowKindType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
 import com.evolveum.prism.xml.ns._public.types_3.PolyStringType;
 
 /**
@@ -2121,7 +2135,7 @@ protected void assertModifyTimestamp(PrismObject<ShadowType> shadow, long startT
 	}
 
 	protected Long getTimestampAttribute(PrismObject<ShadowType> shadow) throws Exception {
-		Long attributeValue = ShadowUtil.getAttributeValue(shadow, OPENDJ_MODIFY_TIMESTAMP_ATTRIBUTE_QNAME);
-		return attributeValue;
+		XMLGregorianCalendar attributeValue = ShadowUtil.getAttributeValue(shadow, OPENDJ_MODIFY_TIMESTAMP_ATTRIBUTE_QNAME);
+		return MiscUtil.asLong(attributeValue);
 	}
 }
diff --git a/testing/story/src/test/resources/delayed-enable/object-template-user.xml b/testing/story/src/test/resources/delayed-enable/object-template-user.xml
index 343ada26c94..c5f464c5cbe 100644
--- a/testing/story/src/test/resources/delayed-enable/object-template-user.xml
+++ b/testing/story/src/test/resources/delayed-enable/object-template-user.xml
@@ -48,42 +48,37 @@
 
 						currentTimestamp = focus?.asPrismObject()?.findExtensionItem("hrStatusChangeTimestamp")
 						if (currentTimestamp == null) {
-						// No timestamp at all, e.g. the case of adding new object
-						return basic.currentDateTime()
+							// No timestamp at all, e.g. the case of adding new object
+							return basic.currentDateTime()
 						}
 
 						// Let's check whether the hrStatus is really changed
 						hrStatusDelta = midpoint.focusContext?.delta?.findPropertyDelta(ItemPath.create("extension","hrStatus"))
 
 						if (hrStatusDelta == null) {
-						// No hrStatus delta. Therefore this is phantom invocation of this mapping. hrStatus is not really
-						changing.
-						return currentTimestamp
+							// No hrStatus delta. Therefore this is phantom invocation of this mapping. hrStatus is not really changing.
+							return currentTimestamp
 						} else {
-						// Let's check whether we are not changing hrStatusChangeTimestamp already. We do not want create
-						different value in such case.
-						// Creating different value will mean that there will be too many triggers. And we may run into risk of
-						creating new
-						// triggers indefinitely if we are not careful here.
-						timestampSecondaryDelta =
-						midpoint.focusContext?.secondaryDelta?.findPropertyDelta(ItemPath.create("extension","hrStatusChangeTimestamp"))
-						if (timestampSecondaryDelta == null) {
-						// This is the "core" case: we really are changing hrStatus, and we do not have new timestamp
+							// Let's check whether we are not changing hrStatusChangeTimestamp already. We do not want create different value in such case.
+							// Creating different value will mean that there will be too many triggers. And we may run into risk of creating new
+							// triggers indefinitely if we are not careful here.
+							timestampSecondaryDelta = midpoint.focusContext?.secondaryDelta?.findPropertyDelta(ItemPath.create("extension","hrStatusChangeTimestamp"))
+							if (timestampSecondaryDelta == null) {
+							// This is the "core" case: we really are changing hrStatus, and we do not have new timestamp
+							
+							// Pretend that output for old value is null.
+							// Otherwise the script can produce the same value for old and new inputs if those two exections were done
+							// during the same millisecond. That midPoint will interpret that as "unchanged" and it will not update the timestamp.
+								if (!midpoint.isEvaluateNew()) {
+									return null;
+								}
+								
+								return basic.currentDateTime()
 
-						// Pretend that output for old value is null.
-						// Otherwise the script can produce the same value for old and new inputs if those two exections were done
-						// during the same millisecond. That midPoint will interpret that as "unchanged" and it will not update
-						the timestamp.
-						if (!midpoint.isEvaluateNew()) {
-						return null;
-						}
-						return basic.currentDateTime()
-
-						} else {
-						// We have already changed the timestamp. Therefore just return the value that we have created a moment
-						ago.
-						return currentTimestamp
-						}
+							} else {
+								// We have already changed the timestamp. Therefore just return the value that we have created a moment ago.
+								return currentTimestamp
+							}
 						}
 					</code>
 	            </script>
diff --git a/testing/story/src/test/resources/trafo/resource-dummy-ad.xml b/testing/story/src/test/resources/trafo/resource-dummy-ad.xml
index 1782aeeb533..ba6b21057d9 100644
--- a/testing/story/src/test/resources/trafo/resource-dummy-ad.xml
+++ b/testing/story/src/test/resources/trafo/resource-dummy-ad.xml
@@ -172,7 +172,6 @@ else {
 				<attribute>
 					<ref>ri:groups</ref>
 					<displayName>Groups</displayName>
-
 					<limitations>
 						<access>
 							<read>true</read>
@@ -180,8 +179,9 @@ else {
 							<modify>true</modify>
 						</access>
 					</limitations>
-					<tolerant>true</tolerant>
 					<matchingRule>mr:stringIgnoreCase</matchingRule>
+					<tolerant>true</tolerant>
+					
 					<outbound>
 						<strength>strong</strength><!-- See above -->
 						<source>
@@ -220,7 +220,6 @@ return null;
 				<attribute>
 					<ref>icfs:name</ref>
 					<displayName>Distinguished Name</displayName>
-
 					<limitations>
 						<access>
 							<read>true</read>
@@ -228,8 +227,8 @@ return null;
 							<modify>true</modify>
 						</access>
 					</limitations>
-
 					<matchingRule>mr:stringIgnoreCase</matchingRule>
+
 					<outbound>
 						<!--<strength>weak</strength>-->
 						<source>