All modules that have attributes which accept AD users may have idempotence issue due to different representations of data in the module parameter and the IPA database.

The goal is to identify the AD user with minimal queries to the server(s) and not run modifications commands unless required.