Don't add provider service as viewer.
ED groups documentation (https://www.middleware.vt.edu/ed/groups/#ougroupsdcvtdcedu) states "The service DNs allowed to view the data in ED-LDAP. If an administrator sets this attribute then only those services listed will be able to see the group data." So basically...if you set a viewer, membership is supressed whether you want it to be or not.
Consequently adding the TF service as a viewer is having the unintended side effect of suppressing membership on all groups.
This change removes that.