diff --git a/roles/ipa/client/tasks/common.yml b/roles/ipa/client/tasks/common.yml
index af968bb281..b064783769 100644
--- a/roles/ipa/client/tasks/common.yml
+++ b/roles/ipa/client/tasks/common.yml
@@ -12,9 +12,10 @@
   changed_when: false
   loop: >-
     {{
-      ipa_server_user_groups
-      + (ipa_server_all_groups_hosts_dict | list | product(['sysadmin-main']) | list)
+      (ipa_server_user_groups | default([]))
+      + (ipa_server_all_groups_hosts_dict | default({}) | list | product(['sysadmin-main']) | list)
     }}
+  when: ipa_server_user_groups is defined or ipa_server_all_groups_hosts_dict is defined
 
 ## Rules specific to hosts, host groups