diff --git a/shell/regression/empty.xml b/shell/regression/empty.xml
index 1ab73347d0..b9944a1115 100644
--- a/shell/regression/empty.xml
+++ b/shell/regression/empty.xml
@@ -1,11 +1,11 @@
-<cib remote-tls-port="0" validate-with="pacemaker-1.2" have-quorum="1" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" admin_epoch="0" epoch="0" num_updates="1" cib-last-written="Sun Apr 12 21:37:48 2009">
+<cib remote-tls-port="0" validate-with="pacemaker-1.1" have-quorum="1" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" admin_epoch="0" epoch="0" num_updates="1" cib-last-written="Sun Apr 12 21:37:48 2009">
   <configuration>
     <crm_config/>
     <nodes/>
     <resources/>
     <constraints/>
     <rsc_defaults/>
     <op_defaults/>
   </configuration>
   <status/>
 </cib>
diff --git a/shell/regression/testcases/confbasic-xml.exp b/shell/regression/testcases/confbasic-xml.exp
index 764e97e8ae..299f951983 100644
--- a/shell/regression/testcases/confbasic-xml.exp
+++ b/shell/regression/testcases/confbasic-xml.exp
@@ -1,133 +1,134 @@
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config>
       <cluster_property_set id="cib-bootstrap-options">
         <nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="true"/>
       </cluster_property_set>
       <cluster_property_set id="cpset2">
         <nvpair id="cpset2-maintenance-mode" name="maintenance-mode" value="true"/>
       </cluster_property_set>
     </crm_config>
     <rsc_defaults>
       <meta_attributes id="rsc-options">
         <nvpair id="rsc-options-failure-timeout" name="failure-timeout" value="10m"/>
       </meta_attributes>
     </rsc_defaults>
     <op_defaults>
       <meta_attributes id="opsdef2">
         <nvpair id="opsdef2-record-pending" name="record-pending" value="true"/>
       </meta_attributes>
     </op_defaults>
     <nodes>
       <node id="pingnode" type="ping" uname="pingnode"/>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="node1-instance_attributes">
           <nvpair id="node1-instance_attributes-mem" name="mem" value="16G"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources>
       <group id="g1">
         <primitive class="ocf" id="d1" provider="pacemaker" type="Dummy">
           <operations id="d1-ops">
             <op id="d1-monitor-60m" interval="60m" name="monitor"/>
             <op id="d1-monitor-120m" interval="120m" name="monitor">
               <instance_attributes id="d1-monitor-120m-instance_attributes">
                 <nvpair id="d1-monitor-120m-instance_attributes-OCF_CHECK_LEVEL" name="OCF_CHECK_LEVEL" value="10"/>
               </instance_attributes>
             </op>
             <op id="d1-monitor-60s" interval="60s" name="monitor" timeout="30s"/>
           </operations>
         </primitive>
         <primitive class="ocf" id="d2" provider="heartbeat" type="Delay">
           <instance_attributes id="d2-instance_attributes">
             <nvpair id="d2-instance_attributes-mondelay" name="mondelay" value="60"/>
           </instance_attributes>
           <operations>
             <op id="d2-start-0" interval="0" name="start" timeout="60s"/>
             <op id="d2-stop-0" interval="0" name="stop" timeout="60s"/>
             <op id="d2-monitor-60s" interval="60s" name="monitor" role="Started" timeout="30s"/>
           </operations>
         </primitive>
       </group>
       <master id="m">
         <primitive class="ocf" id="d4" provider="pacemaker" type="Dummy"/>
       </master>
       <primitive class="stonith" id="st" type="ssh">
         <instance_attributes id="st-instance_attributes">
           <nvpair id="st-instance_attributes-hostlist" name="hostlist" value="node1"/>
         </instance_attributes>
         <meta_attributes id="st-meta_attributes">
           <nvpair id="st-meta_attributes-target-role" name="target-role" value="Started"/>
         </meta_attributes>
         <operations>
           <op id="st-start-0" interval="0" name="start" requires="nothing" timeout="60s"/>
           <op id="st-monitor-60m" interval="60m" name="monitor" timeout="60s"/>
         </operations>
       </primitive>
       <clone id="c">
         <meta_attributes id="c-meta_attributes">
           <nvpair id="c-meta_attributes-clone-max" name="clone-max" value="1"/>
         </meta_attributes>
         <primitive class="ocf" id="d3" provider="pacemaker" type="Dummy"/>
       </clone>
       <primitive class="ocf" id="d5" provider="pacemaker" type="Dummy">
         <operations id-ref="d1-ops"/>
       </primitive>
       <primitive class="ocf" id="d6" provider="pacemaker" type="Dummy">
         <operations id-ref="d1-ops"/>
       </primitive>
     </resources>
     <constraints>
       <rsc_location id="l5" rsc="d5">
         <rule boolean-op="or" id="l5-rule" score="-INFINITY">
           <expression attribute="pingd" id="l5-expression" operation="not_defined"/>
           <expression attribute="pingd" id="l5-expression-0" operation="lte" value="0"/>
         </rule>
         <rule id="l5-rule-0" score="INFINITY">
           <expression attribute="#uname" id="l5-expression-1" operation="eq" value="node1"/>
           <expression attribute="pingd" id="l5-expression-2" operation="gt" value="0"/>
         </rule>
         <rule id="l5-rule-1" score="INFINITY">
           <date_expression end="2009-05-26" id="l5-expression-3" operation="lt"/>
           <date_expression end="2009-07-26" id="l5-expression-4" operation="in_range" start="2009-05-26"/>
           <date_expression id="l5-expression-5" operation="in_range" start="2009-05-26">
             <duration id="l5-duration" years="2009"/>
           </date_expression>
           <date_expression id="l5-expression-6" operation="date_spec">
             <date_spec hours="09-17" id="l5-date_spec" years="2009"/>
           </date_expression>
         </rule>
       </rsc_location>
       <rsc_location id="l1" node="node1" rsc="g1" score="100"/>
       <rsc_location id="l2" rsc="c">
         <rule id="l2-rule1" score="100">
           <expression attribute="#uname" id="l2-expression" operation="eq" value="node1"/>
         </rule>
       </rsc_location>
       <rsc_location id="l3" rsc="d5">
         <rule id="l3-rule" score="INFINITY">
           <expression attribute="#uname" id="l3-expression" operation="eq" value="node1"/>
           <expression attribute="pingd" id="l3-expression-0" operation="gt" value="0"/>
         </rule>
       </rsc_location>
       <rsc_location id="l4" rsc="d5">
         <rule boolean-op="or" id="l4-rule" score="-INFINITY">
           <expression attribute="pingd" id="l4-expression" operation="not_defined"/>
           <expression attribute="pingd" id="l4-expression-0" operation="lte" value="0"/>
         </rule>
       </rsc_location>
       <rsc_location id="l7" rsc="d5">
         <rule id-ref="l2-rule1"/>
       </rsc_location>
       <rsc_location id="l6" rsc="d5">
         <rule id-ref="l2-rule1"/>
       </rsc_location>
       <rsc_colocation id="c1" rsc="d5" score="INFINITY" with-rsc="d6"/>
       <rsc_colocation id="c2" rsc="d5" rsc-role="Started" score="INFINITY" with-rsc="d6" with-rsc-role="Started"/>
       <rsc_order first="d5" id="o1" score="INFINITY" then="d6"/>
       <rsc_order first="d5" first-action="start" id="o2" score="0" then="d6" then-action="promote"/>
     </constraints>
+    <acls/>
   </configuration>
 </cib>
diff --git a/shell/regression/testcases/node.exp b/shell/regression/testcases/node.exp
index b3b1165b2b..5bf360b2b6 100644
--- a/shell/regression/testcases/node.exp
+++ b/shell/regression/testcases/node.exp
@@ -1,195 +1,203 @@
 .TRY node show
 node1: normal
 .TRY node show node1
 node1: normal
 .SETENV showobj=node1
 .TRY node standby node1
 .EXT crm_attribute -N 'node1' -n standby -v 'on' --lifetime='forever'
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="on"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node online node1
 .EXT crm_attribute -N 'node1' -n standby -v 'off' --lifetime='forever'
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node attribute node1 set a1 "1 2 3"
 .EXT crm_attribute -t nodes -U 'node1' -n 'a1' -v '1 2 3'
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
           <nvpair id="nodes-node1-a1" name="a1" value="1 2 3"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node attribute node1 show a1
 .EXT crm_attribute -G -t nodes -U 'node1' -n 'a1'
 scope=nodes  name=a1 value=1 2 3
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
           <nvpair id="nodes-node1-a1" name="a1" value="1 2 3"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node attribute node1 delete a1
 .EXT crm_attribute -D -t nodes -U 'node1' -n 'a1'
 Deleted nodes attribute: id=nodes-node1-a1 name=a1
 
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node status-attr node1 set s1 "1 2 3"
 .EXT crm_attribute -t status -U 'node1' -n 's1' -v '1 2 3'
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node status-attr node1 show s1
 .EXT crm_attribute -G -t status -U 'node1' -n 's1'
 scope=status  name=s1 value=(null)
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY node status-attr node1 delete s1
 .EXT crm_attribute -D -t status -U 'node1' -n 's1'
 .INP: configure
 .INP: _regtest on
 .INP: show xml node1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes>
       <node id="node1" type="normal" uname="node1">
         <instance_attributes id="nodes-node1">
           <nvpair id="nodes-node1-standby" name="standby" value="off"/>
         </instance_attributes>
       </node>
     </nodes>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
diff --git a/shell/regression/testcases/resource.exp b/shell/regression/testcases/resource.exp
index d510a6cf70..89a282c762 100644
--- a/shell/regression/testcases/resource.exp
+++ b/shell/regression/testcases/resource.exp
@@ -1,388 +1,406 @@
 .TRY resource status p0
 .EXT crm_resource -W -r 'p0'
 resource p0 is NOT running
 .SETENV showobj=p3
 .TRY resource start p3
 .INP: configure
 .INP: _regtest on
 .INP: show xml p3
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p3" provider="pacemaker" type="Dummy">
         <meta_attributes id="p3-meta_attributes">
           <nvpair id="p3-meta_attributes-target-role" name="target-role" value="Started"/>
         </meta_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource stop p3
 .INP: configure
 .INP: _regtest on
 .INP: show xml p3
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p3" provider="pacemaker" type="Dummy">
         <meta_attributes id="p3-meta_attributes">
           <nvpair id="p3-meta_attributes-target-role" name="target-role" value="Stopped"/>
         </meta_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .SETENV showobj=c1
 .TRY resource manage c1
 .INP: configure
 .INP: _regtest on
 .INP: show xml c1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <clone id="c1">
         <meta_attributes id="c1-meta_attributes">
           <nvpair id="c1-meta_attributes-is-managed" name="is-managed" value="true"/>
         </meta_attributes>
         <primitive class="ocf" id="p1" provider="pacemaker" type="Dummy"/>
       </clone>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource unmanage c1
 .INP: configure
 .INP: _regtest on
 .INP: show xml c1
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <clone id="c1">
         <meta_attributes id="c1-meta_attributes">
           <nvpair id="c1-meta_attributes-is-managed" name="is-managed" value="false"/>
         </meta_attributes>
         <primitive class="ocf" id="p1" provider="pacemaker" type="Dummy"/>
       </clone>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .SETENV showobj=cli-prefer-p3
 .TRY resource migrate p3
 .EXT crm_resource -M -r 'p3' 
 Resource p3 not moved: not-active and no preferred location specified.
 Error performing operation: cib object missing
 .INP: configure
 .INP: _regtest on
 .INP: show xml cli-prefer-p3
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource migrate p3 node1
 .EXT crm_resource -M -r 'p3' --node='node1'
 .INP: configure
 .INP: _regtest on
 .INP: show xml cli-prefer-p3
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources/>
     <constraints>
       <rsc_location id="cli-prefer-p3" rsc="p3">
         <rule id="cli-prefer-rule-p3" score="INFINITY">
           <expression attribute="#uname" id="cli-prefer-expr-p3" operation="eq" value="node1"/>
         </rule>
       </rsc_location>
     </constraints>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource unmigrate p3
 .EXT crm_resource -U -r 'p3'
 .INP: configure
 .INP: _regtest on
 .INP: show xml cli-prefer-p3
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources/>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .SETENV showobj=p0
 .TRY resource param p0 set a0 "1 2 3"
 .EXT crm_resource -r 'p0' -p 'a0' -v '1 2 3'
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy">
         <instance_attributes id="p0-instance_attributes">
           <nvpair id="p0-instance_attributes-a0" name="a0" value="1 2 3"/>
         </instance_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource param p0 show a0
 .EXT crm_resource -r 'p0' -g 'a0'
 1 2 3
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy">
         <instance_attributes id="p0-instance_attributes">
           <nvpair id="p0-instance_attributes-a0" name="a0" value="1 2 3"/>
         </instance_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource param p0 delete a0
 .EXT crm_resource -r 'p0' -d 'a0'
 Deleted p0 option: id=p0-instance_attributes-a0 name=a0
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource meta p0 set m0 123
 .EXT crm_resource --meta -r 'p0' -p 'm0' -v '123'
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy">
         <meta_attributes id="p0-meta_attributes">
           <nvpair id="p0-meta_attributes-m0" name="m0" value="123"/>
         </meta_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource meta p0 show m0
 .EXT crm_resource --meta -r 'p0' -g 'm0'
 123
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy">
         <meta_attributes id="p0-meta_attributes">
           <nvpair id="p0-meta_attributes-m0" name="m0" value="123"/>
         </meta_attributes>
       </primitive>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource meta p0 delete m0
 .EXT crm_resource --meta -r 'p0' -d 'm0'
 Deleted p0 option: id=p0-meta_attributes-m0 name=m0
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource failcount p0 set node1 5
 .EXT crm_attribute -t status -n 'fail-count-p0' -N 'node1' -v '5' -d 0
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource failcount p0 show node1
 .EXT crm_attribute -t status -n 'fail-count-p0' -N 'node1' -G -d 0
 scope=status  name=fail-count-p0 value=0
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource failcount p0 delete node1
 .EXT crm_attribute -t status -n 'fail-count-p0' -N 'node1' -D -d 0
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource cleanup p0 node1
 .EXT crm_resource -C -r 'p0' -H 'node1'
 Error performing operation: connection failed
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>
 
 .TRY resource cleanup p0
 .EXT crm_resource -C -r 'p0'
 Error performing operation: connection failed
 .INP: configure
 .INP: _regtest on
 .INP: show xml p0
 <?xml version="1.0" ?>
-<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.2">
+<cib admin_epoch="0" crm_feature_set="3.0.1" dc-uuid="f36760d8-d84a-46b2-b452-4c8cac8b3396" epoch="0" have-quorum="1" num_updates="1" remote-tls-port="0" validate-with="pacemaker-1.1">
   <configuration>
     <crm_config/>
     <rsc_defaults/>
     <op_defaults/>
     <nodes/>
     <resources>
       <primitive class="ocf" id="p0" provider="pacemaker" type="Dummy"/>
     </resources>
     <constraints/>
+    <acls/>
   </configuration>
 </cib>