Don't allow default objectclass list to be empty.

https://fedorahosted.org/freeipa/ticket/1945

ipalib/plugins/config.py

@@ -220,6 +220,9 @@ class config_mod(LDAPUpdate):
         for (attr, obj) in (('ipauserobjectclasses', 'user'),
                             ('ipagroupobjectclasses', 'group')):
             if attr in entry_attrs:
+                if not entry_attrs[attr]:
+                    raise errors.ValidationError(name=attr,
+                        error=_('May not be empty'))
                 objectclasses = list(set(entry_attrs[attr] \
                                          + self.api.Object[obj].possible_objectclasses))
                 new_allowed_attrs = ldap.get_allowed_attributes(objectclasses,