https://fedorahosted.org/sssd/ticket/1668
The memberof plugin did only expand the ghost users attribute to
parents when adding a nested group, but didn't implement the reverse
operation.
This bug resulted in users being reported as group members even
after the direct parent went away as the expanded ghost attributes were
never removed from the parent entry.
There seems to be a lot of similarlity between memberuid and ghost
attributes in the memberof plugin. Maybe the code would benefit from
soem more generic functions? But given the time contrainst, I would
prefer the refactoring to happend post-1.9.3.