Index: core-providers/src/test/org/sakaiproject/entitybroker/providers/MembershipEntityProviderTest.java
===================================================================
--- core-providers/src/test/org/sakaiproject/entitybroker/providers/MembershipEntityProviderTest.java	(revision 115880)
+++ core-providers/src/test/org/sakaiproject/entitybroker/providers/MembershipEntityProviderTest.java	(working copy)
@@ -281,6 +281,7 @@
 
         when(siteService.findGroup("group.with.dots")).thenReturn(group);
         when(siteService.allowUpdateSite("site-foo")).thenReturn(true);
+        when(userEntityProvider.findAndCheckUserId(null, "user-foo")).thenReturn("user-foo");
 
         List<EntityData> result =
                 provider.getGroupMemberships(entityView, params);
Index: core-providers/src/java/membership.properties
===================================================================
--- core-providers/src/java/membership.properties	(revision 115880)
+++ core-providers/src/java/membership.properties	(working copy)
@@ -9,7 +9,7 @@
 (POST) will add one or more site memberships via an array of "userSearchValues" request parameters (each of which is a user ID, user EID, or email address), along with a "memberRole" string (default for joinable site memberships is the default joiner role) and "active" Boolean value (default is true). Response headers may include "x-warning-not-found" (for a list of invalid userSearchValues) and "x-warning-already-members" (for a list of userSearchValues which were already site members).
 membership.action.group = The URL format is "/membership/group/:groupId:" <br/> \
 (GET) will return all memberships for a group. <br/> \
-(POST) will update user group membership. Mandatory POST Parameters: 'userIds' a comma separated list of users. \
+(POST) will update user group membership. Mandatory POST Parameters: 'userIds' a comma separated list of users (eid or id). \
 'action' can have values: update, add or remove. If update, replace the current membership with the provided list. If add, add the list to the existing membership, \
 if remove, remove the list from the existing membership. 
 membership.action.join = Allows a user without permissions in a site to join it, works with the current user only: /membership/join/site/siteId
Index: core-providers/src/java/org/sakaiproject/entitybroker/providers/MembershipEntityProvider.java
===================================================================
--- core-providers/src/java/org/sakaiproject/entitybroker/providers/MembershipEntityProvider.java	(revision 115880)
+++ core-providers/src/java/org/sakaiproject/entitybroker/providers/MembershipEntityProvider.java	(working copy)
@@ -339,7 +339,11 @@
             if ("add".equals(action)) {
                 // add the list to the existing membership
                 for (String user : userIds) {
-                    String userId = user.trim();
+                    String userId = userEntityProvider.findAndCheckUserId(null, user.trim());
+                    if (userId == null) {
+                        log.warn("Unable to add user ("+user+") to group ("+group.getId()+") in site ("+site.getId()+"), could not find user record by id or eid");
+                        continue;
+                    }
                     Member m = site.getMember(userId);
                     Role role = m.getRole();
 
@@ -357,7 +361,11 @@
                 // replace the current membership with the provided list
                 group.removeMembers();
                 for (String user : userIds) {
-                    String userId = user.trim();
+                    String userId = userEntityProvider.findAndCheckUserId(null, user.trim());
+                    if (userId == null) {
+                        log.warn("Unable to update user ("+user+") in group ("+group.getId()+") in site ("+site.getId()+"), could not find user record by id or eid");
+                        continue;
+                    }
                     Member m = site.getMember(userId);
                     Role role = m.getRole();
 
@@ -370,6 +378,11 @@
             } else if ("remove".equals(action)) {
                 // remove the list from the existing membership
                 for (String userId : userIds) {
+                    userId = userEntityProvider.findAndCheckUserId(null, userId.trim());
+                    if (userId == null) {
+                        log.warn("Unable to remove user ("+userId+") from group ("+group.getId()+") in site ("+site.getId()+"), could not find user record by id or eid");
+                        continue;
+                    }
                     group.removeMember(userId);
                 }
             } else {