Not that people should be expected to know this, but here's an idiom that does work:

    if res="$(ldap-query-for-valid-users)"; then
        echo "($res)" > "/tmp/all-users.sexp"
    else
        handle_failure
    fi
    

I second the recommendation to use https://github.com/koalaman/shellcheck – you really shouldn't be writing shell scripts without it – but in this case it doesn't seem to handle the issue (with default settings at least).