diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index 2c955eedeb0da390ff3a3a224c0eef4dbf39b66e..56b32d3df2c4da805222133691dfc8d4b60cbeba 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -919,14 +919,6 @@ static int parseProxyAuthz (
 	op->o_ndn = dn;
 	ber_dupbv( &op->o_dn, &dn );
 
-	/*
-	 * since the authzid has changed, we need to delete
-	 * cached groups (ITS#4760)
-	 */
-        if ( op->o_groups ) {
-                slap_op_groups_free( op );
-        }
-
 	Statslog( LDAP_DEBUG_STATS, "%s PROXYAUTHZ dn=\"%s\"\n",
 	    op->o_log_prefix, dn.bv_val, 0, 0, 0 );
 
diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 7b8a606f66f1bef31f54ae6aa178d92884282eeb..dcf0c0c9ef1f4bd7d0f8b923600ab35fc5ff6d9b 100644
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -1872,14 +1872,18 @@ slap_sasl_check_authz( Operation *op,
 	AttributeDescription *ad,
 	struct berval *authc )
 {
-	int rc;
-	BerVarray vals = NULL;
+	int		rc,
+			do_not_cache = op->o_do_not_cache;
+	BerVarray	vals = NULL;
 
 	Debug( LDAP_DEBUG_TRACE,
 	   "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
 	   assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
 
+	/* ITS#4760: don't cache group access */
+	op->o_do_not_cache = 1;
 	rc = backend_attribute( op, NULL, searchDN, ad, &vals, ACL_AUTH );
+	op->o_do_not_cache = do_not_cache;
 	if( rc != LDAP_SUCCESS ) goto COMPLETE;
 
 	/* Check if the *assertDN matches any *vals */