I was playing with LDAP database due to bind-dyncb-ldap patches testing. I added a new Extensible Object class into LDAP and made one DNS zone of that type.

I'm able to see the DNS zone in the IPA Web UI, but unable to edit any entry.

The results section in the response contains:
"results": [
{
"error": null,
"result": {
"attributelevelrights": {
"*": "rscwo",
"aci": "rscwo",
"cospriority": "rscwo",
"nsaccountlock": "rscwo"
},
...