and another logic bug in ldap group code