Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserRolesSaveController.java
===================================================================
diff -u -rf5d27dea6e5752fec029c67db67a5b7df49e10e8 -r93628ccc1d83a6cc777055222af3b2e87ccbb30c
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserRolesSaveController.java	(.../UserRolesSaveController.java)	(revision f5d27dea6e5752fec029c67db67a5b7df49e10e8)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserRolesSaveController.java	(.../UserRolesSaveController.java)	(revision 93628ccc1d83a6cc777055222af3b2e87ccbb30c)
@@ -23,17 +23,6 @@
 
 package org.lamsfoundation.lams.admin.web.controller;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-
 import org.apache.log4j.Logger;
 import org.lamsfoundation.lams.admin.web.form.UserRolesForm;
 import org.lamsfoundation.lams.lesson.service.ILessonService;
@@ -56,6 +45,16 @@
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
 /**
  * @author jliew
  */
@@ -100,8 +99,9 @@
 
 	if (log.isDebugEnabled()) {
 	    String numRoles = roles != null ? Integer.toString(roles.length) : "0";
-	    log.debug(new StringBuilder("userId: ").append(userId).append(", orgId: ").append(orgId)
-		    .append(" will have ").append(numRoles).append(" roles").toString());
+	    log.debug(
+		    new StringBuilder("userId: ").append(userId).append(", orgId: ").append(orgId).append(" will have ")
+			    .append(numRoles).append(" roles").toString());
 	}
 	Organisation org = (Organisation) userManagementService.findById(Organisation.class, orgId);
 	User user = (User) userManagementService.findById(User.class, userId);
@@ -112,25 +112,24 @@
 	if (!isGlobalRolesSet && (roles == null || roles.length < 1)) {
 	    errorMap.add("roles", messageService.getMessage("error.roles.empty"));
 	    request.setAttribute("errorMap", errorMap);
-	    request.setAttribute("rolelist",
-		    userManagementService.filterRoles(rolelist,
-			    request.isUserInRole(Role.APPADMIN) || request.isUserInRole(Role.SYSADMIN),
-			    org.getOrganisationType()));
+	    request.setAttribute("rolelist", userManagementService.filterRoles(rolelist,
+		    request.isUserInRole(Role.APPADMIN) || request.isUserInRole(Role.SYSADMIN),
+		    org.getOrganisationType()));
 	    request.setAttribute("login", user.getLogin());
 	    request.setAttribute("fullName", user.getFullName());
 	    return "forward:/userroles.do";
 	}
 	List<String> userRolesList = roles == null || roles.length < 1 ? List.of() : Arrays.asList(roles);
-	if (userRolesList.contains(Role.ROLE_SYSADMIN.toString())
-		&& !userRolesList.contains(Role.ROLE_APPADMIN.toString())) {
+	if (userRolesList.contains(Role.ROLE_SYSADMIN.toString()) && !userRolesList.contains(
+		Role.ROLE_APPADMIN.toString())) {
 	    //all sysadmins are also appadmins
 	    userRolesList = new ArrayList<>(userRolesList);
 	    userRolesList.add(Role.ROLE_APPADMIN.toString());
 	}
 	userManagementService.setRolesForUserOrganisation(user, orgId, userRolesList);
 
-	if (userRolesList.contains(Role.ROLE_APPADMIN.toString())
-		&& !userRolesList.contains(Role.ROLE_SYSADMIN.toString())) {
+	if (userRolesList.contains(Role.ROLE_APPADMIN.toString()) && !userRolesList.contains(
+		Role.ROLE_SYSADMIN.toString())) {
 	    // appadmin need to have 2FA on, unless sysadmin says otherwise in user edit panels
 	    user.setTwoFactorAuthenticationEnabled(true);
 	    userManagementService.save(user);
@@ -157,8 +156,10 @@
     }
 
     private void auditLog(Organisation organisation, Integer userId, String[] roleIds, boolean addToLessons) {
-	List<String> roles = Stream.of(roleIds).collect(Collectors
-		.mapping(roleId -> Role.ROLE_MAP.get(Integer.valueOf(roleId)), Collectors.toUnmodifiableList()));
+	List<String> roles = roleIds == null
+		? List.of()
+		: Stream.of(roleIds).collect(Collectors.mapping(roleId -> Role.ROLE_MAP.get(Integer.valueOf(roleId)),
+			Collectors.toUnmodifiableList()));
 	User targetUser = userManagementService.getUserById(userId);
 	StringBuilder auditLogMessage = new StringBuilder("to user ").append(targetUser.getFirstName()).append(" ")
 		.append(targetUser.getLastName()).append(" (").append(targetUser.getLogin()).append(") assigned roles ")