I haven't ever tried your idea with my own app that utilizes JNDI but I
would think that on the surface, your code would remove the attribute
and any values it contained but if you say it works then it must be okay.

I, on the other hand, take the opposite approach. I ignore any values
that will be removed and create a new BasicAttribute that contains only
the values that will be kept and write that back to the directory store
using modifyAttributes().

Just wanted to say that I was re-reading your initial post and was
originally thinking you were wanting to delete a value from an attribute
when it had multiple values but it seems you want to delete a whole
attribute. You seem to have been using the word "value" in multiple ways
but in LDAP terminology it means something specific so it threw me off
until I re-read your post.

Going back to your original post, you wanted to only remove the the
sysRole user attribute.  Given your example, sysRole is the attribute
but 'user' is the data (you called 'user' an attribute), specifically it
is the 2nd value for the sysRole attribute based on your example.
Depending on whether or not I understand you correctly this time and
whether you correctly used the terms you wanted to use I'll say this:

You are on the right track but you don't have to specify any value to
the BasicAttribute() constructor to delete an attribute. It has another
constructor that takes only an attribute name.