IPA: fix segfault in ipa_s2n_exop
    
    can be triggered on demand by assigning a POSIX group
    with external members sudo privileges, then dropping
    the cache and doing a sudo -U <user> -l.
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit c520f40d1a2d77cf1d413451b5682297733521ed)