IPA: fix segfault in ipa_s2n_exop
    
    can be triggered on demand by assigning a POSIX group
    with external members sudo privileges, then dropping
    the cache and doing a sudo -U <user> -l.
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>