The way the LDAP_GROUPS_FROM_ATTRIBUTES loader is written, it fetches the configured groupAttribute for a row, and loops all the attribute values  to convert into a group name.But if the user does not have the attribute it doesn't process it at all. This means that users can't be put into a group of subjects missing the attribute.

This could be enhanced by adding a new option for "Group attribute default value if null". The code could easy accomodate this by checking for an empty array of values, and create a 1-element array if so.