A check short-circuits the logic in addMembership and deleteMembership in LdapGroupProvisioner.java when ldapUser is null.  But when needsTargetSystemUsers = FALSE we expect it to be null. 

I will be submitting a PR in github from iisimaginary referencing this issue.