LPAP Sync: User not removed from group after removal from LDAP

[intix]

Hey folks,

I'm guessing this is a bug, but maybe I'm doing something wrong. Scenario:

1. Add a user to LDAP
2. Sync the LDAP realm in PVE
3. Add the user to a PVE Group
4. Remove the user from LDAP
5. Run another LDAP realm sync

The user will remain present in the group, and PVE will complain about the user not existing during certain operations. For instance when generating a cloud-init dump:

root@foobar:~# qm cloudinit dump 100 user
user config - ignore invalid group member 'foo@LDAP'
#cloud-config
hostname: somehostname
manage_etc_hosts: true
chpasswd:
  expire: False
users:
  - default
package_upgrade: true