diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_group.py b/lib/ansible/modules/extras/identity/ipa/ipa_group.py
index 39ce80639d1..0c45776a23f 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_group.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_group.py
@@ -210,6 +210,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_hbacrule.py b/lib/ansible/modules/extras/identity/ipa/ipa_hbacrule.py
index 5657ffb8efe..54619c5ec33 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_hbacrule.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_hbacrule.py
@@ -241,6 +241,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_host.py b/lib/ansible/modules/extras/identity/ipa/ipa_host.py
index 1ca4113b9d6..a7cc4d361e2 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_host.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_host.py
@@ -234,6 +234,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_hostgroup.py b/lib/ansible/modules/extras/identity/ipa/ipa_hostgroup.py
index 50e66428805..f0350277313 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_hostgroup.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_hostgroup.py
@@ -187,6 +187,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
@@ -285,11 +287,13 @@ def ensure(module, client):
                     client.hostgroup_mod(name=name, item=data)
 
         if host is not None:
-            changed = modify_if_diff(module, name, ipa_hostgroup.get('member_host', []), host,
+            changed = modify_if_diff(module, name, ipa_hostgroup.get('member_host', []),
+                                     [item.lower() for item in host],
                                      client.hostgroup_add_host, client.hostgroup_remove_host) or changed
 
         if hostgroup is not None:
-            changed = modify_if_diff(module, name, ipa_hostgroup.get('member_hostgroup', []), hostgroup,
+            changed = modify_if_diff(module, name, ipa_hostgroup.get('member_hostgroup', []),
+                                     [item.lower() for item in hostgroup],
                                      client.hostgroup_add_hostgroup, client.hostgroup_remove_hostgroup) or changed
 
     else:
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_role.py b/lib/ansible/modules/extras/identity/ipa/ipa_role.py
index 48508a256ae..9d3ac043f3a 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_role.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_role.py
@@ -217,6 +217,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_sudocmd.py b/lib/ansible/modules/extras/identity/ipa/ipa_sudocmd.py
index 5b9dbec5fde..f759f2d726f 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_sudocmd.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_sudocmd.py
@@ -167,6 +167,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_sudocmdgroup.py b/lib/ansible/modules/extras/identity/ipa/ipa_sudocmdgroup.py
index 182bf82806a..b29216f70cd 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_sudocmdgroup.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_sudocmdgroup.py
@@ -174,6 +174,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_sudorule.py b/lib/ansible/modules/extras/identity/ipa/ipa_sudorule.py
index 162baad5d8c..426a4444ecc 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_sudorule.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_sudorule.py
@@ -226,6 +226,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None
 
@@ -348,7 +350,8 @@ def modify_if_diff(module, name, ipa_list, module_list, add_method, remove_metho
 def category_changed(module, client, category_name, ipa_sudorule):
     if ipa_sudorule.get(category_name, None) == ['all']:
         if not module.check_mode:
-            client.sudorule_mod(name=ipa_sudorule.get('cn'), item={category_name: None})
+            # cn is returned as list even with only a single value.
+            client.sudorule_mod(name=ipa_sudorule.get('cn')[0], item={category_name: None})
         return True
     return False
 
diff --git a/lib/ansible/modules/extras/identity/ipa/ipa_user.py b/lib/ansible/modules/extras/identity/ipa/ipa_user.py
index 8a5c4b09168..464348ee9bc 100644
--- a/lib/ansible/modules/extras/identity/ipa/ipa_user.py
+++ b/lib/ansible/modules/extras/identity/ipa/ipa_user.py
@@ -212,6 +212,8 @@ class IPAClient:
                 if isinstance(result, list):
                     if len(result) > 0:
                         return result[0]
+                    else:
+                        return {}
             return result
         return None