Setting an empty set of target attributes should raise an exception.

It is possible to create an ACI with attributes and then try to set that
to None via a mod command later. We need to catch this and raise an exception.

If all attributes are set to None in an aci then the attr target is removed
from the ACI. This could result in an illegal ACI if there are no other
targets. Having no targets is a legal state, just not a legal final state.

ticket 647

1 files changed, 4 insertions, 0 deletions

diff --git a/ipalib/aci.py b/ipalib/aci.py
index fc94126a3..abb2ebc49 100755
--- a/ipalib/aci.py
+++ b/ipalib/aci.py
@@ -175,6 +175,10 @@ class ACI:
         self.target['targetfilter']['operator'] = operator
 
     def set_target_attr(self, attr, operator="="):
+        if not attr:
+            if 'targetattr' in self.target:
+                del self.target['targetattr']
+            return
         if not type(attr) in (tuple, list):
             attr = [attr]
         self.target['targetattr'] = {}