Requesting the members of a group can return shadowed users. Where there is more than one directory containing a user, only the memberships defined in that user's actual directory should take effect. This functionality is implemented in CWD-3143 but not currently enabled in Crowd. There are a number of options:

• Unconditionally enable, although this could make group memberships queries slower in the case of uncached LDAP directories
• Detect the cases that could be slow and run the extra check otherwise
• Introduce more caching so the additional check is always fast
• Add a system setting to make this behaviour opt-in