From 7ae9d9629dceaf41df4ef297b5741f76206d83c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C4=8Cech?= <pcech@redhat.com>
Date: Wed, 31 Aug 2016 12:28:48 +0200
Subject: [PATCH] MEMBEROF: Don't resolve members if they are removed

If we need remove ghost (SYSDB_GHOST, DB_GHOST) attribute
from group we use empty structure.

This doesn't mean that there is pointer to NULL but
it means that there is zero elements.
Ghost attribute is array not string.

Resolves:
https://fedorahosted.org/sssd/ticket/2940
---
 src/ldb_modules/memberof.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
index af7147e..af42c72 100644
--- a/src/ldb_modules/memberof.c
+++ b/src/ldb_modules/memberof.c
@@ -2920,7 +2920,9 @@ static int memberof_mod(struct ldb_module *module, struct ldb_request *req)
     mod_ctx->ghel = ldb_msg_find_element(mod_ctx->msg, DB_GHOST);
 
     /* continue with normal ops if there are no members and no ghosts */
-    if (mod_ctx->membel == NULL && mod_ctx->ghel == NULL) {
+    if ((mod_ctx->membel == NULL && mod_ctx->ghel == NULL) ||
+        (mod_ctx->membel == NULL && mod_ctx->ghel != NULL &&
+         mod_ctx->ghel->num_values == 0)) {
         mod_ctx->terminate = true;
         return mbof_orig_mod(mod_ctx);
     }
