'Validate that either the default domain or nothing is specified.
Also removes the domain from the ref so that LDAP doesn\'t have to
persist the attribute.'

def _validate_default_domain(self, ref):

    ref = ref.copy()
    domain_id = ref.pop('domain_id', CONF.identity.default_domain_id)
    self._validate_default_domain_id(domain_id)
    return ref
