The following command results in an internal error:

./ipa permission-add some-perm --permissions='"read,write"' --attrs=cn

The permission validator in our ACI plugin does comma splitting (in addition to CSV splitting done by the frontend), so it lets a string with comma-separated permissions through. permission-add will choke on such a string later on.

When we drop CSV support this will be more visible, since the various quotes in that command won't be necessary.