ldap: Verify we have an entry before trying to print the DN

diff --git a/src/modules/rlm_ldap/groups.c b/src/modules/rlm_ldap/groups.c
index 7af8598c0b08633b97707b5b873f5c8c4056f013..42a3c955e9ab967bd001ee5587bc7c11138efe6d 100644 (file)
--- a/src/modules/rlm_ldap/groups.c
+++ b/src/modules/rlm_ldap/groups.c
@@ -741,9 +741,11 @@ static unlang_action_t ldap_check_groupobj_resume(rlm_rcode_t *p_result, UNUSED
                        LDAPMessage     *entry = NULL;
                        char            *dn = NULL;
                        entry = ldap_first_entry(query->ldap_conn->handle, query->result);
-                       if (entry) dn = ldap_get_dn(query->ldap_conn->handle, entry);
-                       RDEBUG2("User found in group object \"%pV\"", fr_box_strvalue(dn));
-                       ldap_memfree(dn);
+                       if (entry) {
+                               dn = ldap_get_dn(query->ldap_conn->handle, entry);
+                               RDEBUG2("User found in group object \"%pV\"", fr_box_strvalue(dn));
+                               ldap_memfree(dn);
+                       }
                }
                break;