Is there a reason DS returns 'none', except the return value concatenates everything so an empty result could cause trouble when parsing?
We return a Python/JSON dict so the empty string would not be a problem

It is probably python-ldap returning None.

I had the same thought, but given it's in a [RHDS doc page] and http://www.ietf.org/proceedings/52/I-D/draft-ietf-ldapext-acl-model-08.txt IETF draft, I doubt it's Python's None.

Given that the RFC calls for the word none it seems like it is doing the right thing and it is up to us to interpret it in a python-ey way.

DS returns none if now rights could be determined, so it is deliberate but I don't know what the reason was to do it like this

Moving stabilization tickets that do not affect FreeIPA 4.0 release usability in any significant way to 4.0.1 stabilization milestone.

master:

• fcd2922 baseldap: Return empty string when no effective rights are found

ipa-4-1:

• fcd2922 baseldap: Return empty string when no effective rights are found

ipa-4-0:

• fcd2922 baseldap: Return empty string when no effective rights are found

Rather internal change not reproducible in RHELs - no clone.