It looks like the memberof overlay doesn't update a user object's entryCSN when a group object is changed. I believe this causes trouble with syncrepl, at least in a multi-master configuration: if one node is down when the group object is changed, it won't know it needs to update the user object when it comes back.

Should be fixed in HEAD (one-line fix, see overlays/memberof.c 1.25 -> 1.26).

Please test. Thanks, p.