Imported Debian patch 4.8.10-2

ipaserver/install/plugins/update_managed_permissions.py

@@ -560,8 +560,7 @@ class update_managed_permissions(Updater):
             if current_aci != default_aci:
                 logger.debug('ACIs not compatible')
                 continue
-            else:
-                all_incompatible = False
+            all_incompatible = False
 
             if attrs_in_all_defaults is None:
                 attrs_in_all_defaults = set(default_attrs)
@@ -636,6 +635,10 @@ class update_managed_permissions(Updater):
 
         # Attributes from template
         bindruletype = template.pop('ipapermbindruletype', 'permission')
+        if bindruletype not in {"all", "anonymous", "self", "permission"}:
+            raise ValueError(
+                f"Invalid ipapermbindruletype '{bindruletype}'"
+            )
         if is_new:
             entry.single_value['ipapermbindruletype'] = bindruletype