This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5170

In user plugin, the preserved users can be assigned membership, even though they are not supposed to work with membership information. Moreover, when a membership is assigned to a preserved user and then the user is activated, the membership information persists for the active entry.

'''Steps to reproduce:'''

'''1. create a group and a user'''

{{{
$ ipa group-add tgroup
$ ipa user-add tuser --first test --last user
}}}

'''2. delete the user with --preserve option'''

{{{
$ ipa user-del tuser --preserve
}}}


'''3. assign membership to the preserved user'''

{{{
$ ipa group-add-member tgroup --users tuser
}}}

Expected result: should not add the user to the group

Actual result: the user is added to the group:

{{{
  Group name: tgroup
  GID: 280206353
-------------------------
Number of members added 1
-------------------------
}}}

Even though results of group-show and user-show command do not list 'tuser' as a member of 'tgroup', the membership was apparently added:

{{{
$ ipa group-show tgroup
  Group name: tgroup
  GID: 280206353

$ ipa user-show tuser
  User login: tuser
  First name: test
  Last name: user
  Home directory: /home/tuser
  Login shell: /bin/sh
  Email address: tuser.lab.eng.brq.redhat.com
  UID: 280206355
  GID: 280206355
  Account disabled: True
  Preserved user: True
  Password: False
  Kerberos keys available: False
}}}

'''4. activate the preserved entry'''

{{{
$ ipa user-undel tuser
}}}

Expected result: user is now active and has only 'ipausers' membership

Actual result: user is active and has 'ipausers' and ''''tgroup'''' membership:
{{{
$ ipa user-show tuser
  User login: tuser
  First name: test
  Last name: user
  Home directory: /home/tuser
  Login shell: /bin/sh
  Email address: tuser.lab.eng.brq.redhat.com
  UID: 280206355
  GID: 280206355
  Account disabled: False
  Password: False
  Member of groups: tgroup, ipausers
  Kerberos keys available: False

$ ipa group-show tgroup
  Group name: tgroup
  GID: 280206353
  Member users: tuser
}}}

'''Note:''' The membership added to the preserved entry can also be removed using 'group-remove-member'