If a group doesn't have any members, modifying the group's description will fail with "No such attribute." Once a member is added, the operation will work properly.

The problem happens in UGSubsystem.modifyGroup(). In the above scenario the modify request doesn't contain any members because the group is already empty. However, the code incorrectly interprets it as a request to remove all members, so it will try to delete the uniquemember attribute, which will fail because the group has no such attribute.

Enumeration<String> e = grp.getMemberNames();
if (e.hasMoreElements() == true) {
    ...
    mod.add(LDAPModification.REPLACE, attrMembers);
} else {
    if (!grp.getName().equalsIgnoreCase(SUPER_CERT_ADMINS)) {
        mod.add(LDAPModification.DELETE, attrMembers);
    } else {
        ...
    }
}

Steps to reproduce:

1. Create a group without any members.
2. Run pki group-mod --description , this will fail.
3. Add a member to the group.
4. Repeat step #2, it will work.

Expected result: The group-mod command should work regardless of the number of members in the group.