diff --git a/confluent_server/confluent/config/attributes.py b/confluent_server/confluent/config/attributes.py
index 0d9f61ae..a83520f0 100644
--- a/confluent_server/confluent/config/attributes.py
+++ b/confluent_server/confluent/config/attributes.py
@@ -161,7 +161,8 @@ node = {
                         'upon discovery.  "expiration=no,loginfailures=no,complexity=no,reuse=no" '
                         'would disable password expiration, login failures '
                         'triggering a lockout, password complexity requirements,'
-                        'and any restrictions around reusing an old password.'
+                        'and any restrictions around reusing an old password.',
+        'validlistkeys': ('expiration', 'loginfailures', 'complexity', 'reuse'),
     },
     'discovery.policy': {
         'description':  'Policy to use for auto-configuration of discovered '
@@ -172,6 +173,7 @@ node = {
                         'so long as the node has no existing public key. '
                         '"open" allows discovery even if a known public key '
                         'is already stored',
+        'validlist': ('manual', 'permissive', 'pxe', 'open'),
     },
     'info.note': {
         'description':  'A field used for administrators to make arbitrary '
@@ -259,11 +261,13 @@ node = {
     'console.logging': {
         'description': ('Indicate logging level to apply to console.  Valid '
                         'values are currently "full", "interactive", and '
-                        '"none". Defaults to "full".')
+                        '"none". Defaults to "full".'),
+        'validvalues': ('full', 'interactive', 'none'),
     },
     'console.method': {
         'description': ('Indicate the method used to access the console of '
-                        'the managed node.')
+                        'the managed node.'),
+        'validvalues': ('ssh', 'ipmi'),
     },
 #    'virtualization.host': {
 #        'description': ('Hypervisor where this node does/should reside'),
diff --git a/confluent_server/confluent/messages.py b/confluent_server/confluent/messages.py
index 9d146e88..f0265329 100644
--- a/confluent_server/confluent/messages.py
+++ b/confluent_server/confluent/messages.py
@@ -598,7 +598,7 @@ class InputAttributes(ConfluentMessage):
         for node in nodes:
             self.nodeattribs[node] = inputdata
 
-    def get_attributes(self, node):
+    def get_attributes(self, node, validattrs=None):
         if node not in self.nodeattribs:
             return {}
         nodeattr = deepcopy(self.nodeattribs[node])
@@ -613,6 +613,34 @@ class InputAttributes(ConfluentMessage):
                     # an expression string will error if format() done
                     # use that as cue to put it into config as an expr
                     nodeattr[attr] = {'expression': nodeattr[attr]}
+            if validattrs and 'validvalues' in validattrs[attr]:
+                if nodeattr[attr] not in validattrs[attr]['validvalues']:
+                    raise exc.InvalidArgumentException(
+                        'Attribute {0} does not accept value {1} (valid values would be {2})'.format(
+                            attr, nodeattr[attr], ','.join(validattrs[attr]['validvalues'])))
+            elif validattrs and 'validlist' in validattrs[attr]:
+                req = nodeattr[attr].split(',')
+                for v in req:
+                    if v not in validattrs[attr]['validlist']:
+                        raise exc.InvalidArgumentException(
+                            'Attribute {0} does not accept list member '
+                            '{1} (valid values would be {2})'.format(
+                                attr, v, ','.join(
+                                    validattrs[attr]['validlist'])))
+            elif validattrs and 'validlistkeys' in validattrs[attr]:
+                req = nodeattr[attr].split(',')
+                for v in req:
+                    if '=' not in v:
+                        raise exc.InvalidArgumentException(
+                            'Passed key {0} requires a parameter'.format(v))
+                    v = v.split('=', 1)[0]
+                    if v not in validattrs[attr]['validlistkeys']:
+                        raise exc.InvalidArgumentException(
+                            'Attribute {0} does not accept key {1} (valid values would be {2})'.format(
+                                attr, v, ','.join(
+                                    validattrs[attr]['validlistkeys'])
+                            )
+                        )
         return nodeattr
 
 
diff --git a/confluent_server/confluent/plugins/configuration/attributes.py b/confluent_server/confluent/plugins/configuration/attributes.py
index f1e5fab2..373397c8 100644
--- a/confluent_server/confluent/plugins/configuration/attributes.py
+++ b/confluent_server/confluent/plugins/configuration/attributes.py
@@ -198,7 +198,7 @@ def create(nodes, element, configmanager, inputdata):
 def update_nodes(nodes, element, configmanager, inputdata):
     updatedict = {}
     for node in nodes:
-        updatenode = inputdata.get_attributes(node)
+        updatenode = inputdata.get_attributes(node, allattributes.node)
         clearattribs = []
         if updatenode:
             for attrib in updatenode.iterkeys():