saml: handle empty user-roles attributes (#7532)

wcs/qommon/saml2.py

@@ -431,10 +431,14 @@ class Saml2Directory(Directory):
         m = {}
         try:
             for attribute in assertion.attributeStatement[0].attribute:
+                # always mark the attribute as being present, even if it won't
+                # have any value, as an empty value (role-slug) must not be
+                # ignored.
+                m.setdefault(attribute.name, [])
                 try:
                     d[attribute.name] = attribute.attributeValue[0].any[0].content
                     for attribute_value in attribute.attributeValue:
-                        l = m.setdefault(attribute.name, [])
+                        l = m[attribute.name]
                         l.append(attribute_value.any[0].content)
                 except IndexError:
                     pass