If the role or attribute is empty (i.e. no server provides the role or the caller has no read access to the required information) do not return empty attributes. This is consistent with other behavior displayed by optional multivalued Params. https://pagure.io/freeipa/issue/7029 Reviewed-By: Martin Basti <mbasti@redhat.com>