The attached patch applies on both master and sssd-1-9 and fixes:
https://fedorahosted.org/sssd/ticket/1806
The IPA provider attempted to store the original value of member attribute
to the cache. That caused the memberof plugin to process the values which
was really CPU intensive.
We don't use the values anywhere and rely on the originalDN instead, so
it's safe to avoid even downloading them.
Many thanks to Andreas and Simo for their help debugging the problem.