Apparently, we were doing it the correct way by just leaving out password. The error message made it sound like it was annoyed at seeing user_group_ref with no password before it, but it’s more about not providing the user_group info in the XML. Will post separately on that, but it would still be nice if it was clearer in the documentation that no providing any password information would prompt the system to auto-create one. Just my $0.02.