Description of problem:
Upon requesting a non-existing netgroup name, the command #getent netgroup
<unknown_group> returns the same name, however the command is expected to
return nothing. This happens when sssd is configured as proxy provider.

Version-Release number of selected component (if applicable):
sssd-1.8.0-11.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Edit /etc/ldap.conf and add the following:
   uri ldap://<hostname.com>:<port>
   ssl no
   base <basedn>

2. Create and edit /etc/pam.d/sssdproxyldap with the following contents:
   auth          required      pam_ldap.so
   account       required      pam_ldap.so
   password      required      pam_ldap.so
   session       required      pam_ldap.so

3. To produce the issue, setup sssd.conf as below:
[sssd]
reconnection_retries = 3
config_file_version = 2
sbus_timeout = 30
services = nss, pam
domains = PROXY
debug_level = 9

[nss]
filter_groups = root
filter_users = root

[pam]

[domain/PROXY]
id_provider = proxy
auth_provider = proxy
cache_credentials = TRUE
proxy_lib_name = ldap
proxy_pam_target = sssdproxyldap
enumerate = TRUE
debug_level = 9
ldap_tls_cacertdir = /etc/openldap/cacerts/

4. After setting the above configurations, start sssd service and run the
following step:

[root@sssd-client sssd]# getent netgroup some_group

Actual results:
The cmd #getent returns the non-existing netgroup name as given below:

[root@sssd-client sssd]# getent netgroup some_group
some_group

[root@sssd-client sssd]# getent netgroup some_group
some_group

Expected results:
The cmd #getent should return nothing upon requesting a non-existing netgroup.

[root@sssd-client sssd]# getent netgroup some_group
[root@sssd-client sssd]# getent netgroup some_group

Additional info: