The setup for this is:

• Ldap GroupOfNames
• Ldap attribute resolver using an alternative ldap, matching uid with subjectId and returning entryDn
• Not searching entities
• Entity attribute "dn" is translated "${grouperProvisioningEntity.retrieveAttributeValueString('entityAttributeResolverLdap__entrydn')}" and stored in entity cache
• Group member field is using the cache

 

Result:

• Full working fine
• Incremental clearing out all the members of the group, yet reports it as an add of those members