This can occur if you do something like: $ ipa hbac-add-host --hosts="" testrule options will have an entry for 'host' but it will be None whcih is not iterable. ticket 486
ipa help commands