LDAP authentication test with valid credentials results in bind account locked out in Active Directory

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

ldap

Describe the bug

We’ve observed an issue in Keycloak v26.4.0 when testing the ldap bind account.

The issue occurs when we update the LDAP connection URL in the Keycloak Admin Console and select the authentication test without first saving the change.

In this scenario, Active Directory reports that Keycloak has provided invalid bind credentials even though the username and password are correct. Using the same configuration change and saving the configuration before running the test results in a successful outcome.

If the authentication test repeatedly fails Active Directory Policies kick in and lockout the bind account which is a real problem when AD is managed by a different supplier.

The error returned in the logs is - KC-SERVICES0055: Error when authenticating to LDAP: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09052B, comment: AcceptSecurityContext error, data 52e, v4f7c]

Version

26.4.0

Regression

• The issue is a regression

Expected behavior

Admins should be able to perform ldap authentication tests before committing changes to the ldap connection URL. Its unintuitive that they should save changes before testing the Connection URL works and easily results in Keycloak not being able to authenticate users.

Actual behavior

The attempt to authenticate fails as shown in the screenshot.

The debug shows

{"timestamp":"2025-10-30T13:28:15.680740358Z","sequence":5654,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted null HttpRequestMetric [initialPath=/health/ready, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@223bbf7]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.680829822Z","sequence":5655,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted /health/ready HttpRequestMetric [initialPath=/health/ready, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@223bbf7]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.684189875Z","sequence":5656,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"responseEnd io.vertx.core.http.impl.Http1xServerResponse@6b0c8fc8, HttpRequestMetric [initialPath=/health/ready, currentRoutePath=/health/ready, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@223bbf7]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.684249709Z","sequence":5657,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.infinispan.health.impl.JdbcPingClusterHealthImpl","level":"DEBUG","message":"Set cluster health status to healthy","threadName":"","threadId":1268,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.700749491Z","sequence":5658,"loggerClassName":"io.netty.util.internal.logging.LocationAwareSlf4JLogger","loggerName":"io.netty.handler.ssl.SslHandler","level":"DEBUG","message":"[id: 0x04e0c7ed, L:/10.195.12.21:9000 - R:/10.195.12.117:30588] HANDSHAKEN: protocol:TLSv1.2 cipher suite:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.702017529Z","sequence":5659,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted null HttpRequestMetric [initialPath=/health/ready, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5211a57d]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.702221911Z","sequence":5660,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted null HttpRequestMetric [initialPath=/health/ready, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5211a57d]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.702306512Z","sequence":5661,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted /health/ready HttpRequestMetric [initialPath=/health/ready, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5211a57d]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.704702907Z","sequence":5662,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.infinispan.health.impl.JdbcPingClusterHealthImpl","level":"DEBUG","message":"Set cluster health status to healthy","threadName":"","threadId":1269,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:15.705014423Z","sequence":5663,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"responseEnd io.vertx.core.http.impl.Http1xServerResponse@5dec0238, HttpRequestMetric [initialPath=/health/ready, currentRoutePath=/health/ready, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5211a57d]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.422839078Z","sequence":5664,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted null HttpRequestMetric [initialPath=/admin/realms/myrealm/testLDAPConnection, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5e5ea96]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.423660463Z","sequence":5665,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted null HttpRequestMetric [initialPath=/admin/realms/myrealm/testLDAPConnection, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5e5ea96]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.423887072Z","sequence":5666,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"requestRouted / HttpRequestMetric [initialPath=/admin/realms/myrealm/testLDAPConnection, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5e5ea96]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.424633666Z","sequence":5667,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.transaction.JtaTransactionWrapper","level":"DEBUG","message":"new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP POST /admin/realms/myrealm/testLDAPConnection","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.42741127Z","sequence":5668,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.models.sessions.infinispan.changes.UserSessionPersistentChangelogBasedTransaction","level":"DEBUG","message":"user-session found in cache for sessionId=417ff008-24a7-a350-3649-7936a5b501f5 offline=false 1761830843","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.427915567Z","sequence":5669,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.models.sessions.infinispan.PersistentUserSessionProvider","level":"DEBUG","message":"getUserSessionWithPredicate(417ff008-24a7-a350-3649-7936a5b501f5): found in local cache","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.428166287Z","sequence":5670,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.services.resources.admin.AdminRoot","level":"DEBUG","message":"authenticated admin access for: admin","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.428919773Z","sequence":5671,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.models.sessions.infinispan.PersistentUserSessionProvider","level":"DEBUG","message":"getUserSessionWithPredicate(417ff008-24a7-a350-3649-7936a5b501f5): found in local cache","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.432142248Z","sequence":5672,"loggerClassName":"org.hibernate.engine.jdbc.JdbcLogging_$logger","loggerName":"org.hibernate.orm.jdbc","level":"DEBUG","message":"HHH100016: 'hibernate.connection.provider_disables_autocommit' was enabled. This setting should only be enabled when JDBC Connections obtained by Hibernate from the ConnectionProvider have auto-commit disabled. Enabling this setting when connections have auto-commit enabled leads to execution of SQL operations outside of any JDBC transaction.","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.436156418Z","sequence":5673,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.storage.ldap.idm.store.ldap.LDAPContextManager","level":"DEBUG","message":"Creating LdapContext using properties: [{java.naming.security.authentication=simple, com.sun.jndi.ldap.connect.timeout=10000, java.naming.provider.url=ldap://adserver.thedomain.local, com.sun.jndi.ldap.read.timeout=10000, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.credentials=**************************************, java.naming.security.principal=CN=serviceaccount,OU=Service Accounts,OU=Administrative,DC=thedomain,DC=local}]","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.443112264Z","sequence":5674,"loggerClassName":"org.keycloak.services.ServicesLogger_$logger","loggerName":"org.keycloak.services","level":"ERROR","message":"KC-SERVICES0055: Error when authenticating to LDAP: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090450, comment: AcceptSecurityContext error, data 52e, v2580\u0000]","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766,"exception":{"refId":1,"exceptionType":"javax.naming.AuthenticationException","message":"[LDAP: error code 49 - 80090308: LdapErr: DSID-0C090450, comment: AcceptSecurityContext error, data 52e, v2580\u0000]","frames":[{"class":"com.sun.jndi.ldap.LdapCtx","method":"mapErrorCode","line":3260},{"class":"com.sun.jndi.ldap.LdapCtx","method":"processReturnCode","line":3206},{"class":"com.sun.jndi.ldap.LdapCtx","method":"processReturnCode","line":2992},{"class":"com.sun.jndi.ldap.LdapCtx","method":"connect","line":2906},{"class":"com.sun.jndi.ldap.LdapCtx","method":"<init>","line":349},{"class":"com.sun.jndi.ldap.LdapCtxFactory","method":"getLdapCtxFromUrl","line":229},{"class":"com.sun.jndi.ldap.LdapCtxFactory","method":"getUsingURL","line":189},{"class":"com.sun.jndi.ldap.LdapCtxFactory","method":"getUsingURLs","line":247},{"class":"com.sun.jndi.ldap.LdapCtxFactory","method":"getLdapCtxInstance","line":154},{"class":"com.sun.jndi.ldap.LdapCtxFactory","method":"getInitialContext","line":84},{"class":"javax.naming.spi.NamingManager","method":"getInitialContext","line":520},{"class":"javax.naming.InitialContext","method":"getDefaultInitCtx","line":305},{"class":"javax.naming.InitialContext","method":"init","line":236},{"class":"javax.naming.ldap.InitialLdapContext","method":"<init>","line":154},{"class":"org.keycloak.storage.ldap.idm.store.ldap.SessionBoundInitialLdapContext","method":"<init>","line":34},{"class":"org.keycloak.storage.ldap.idm.store.ldap.LDAPContextManager","method":"createLdapContext","line":80},{"class":"org.keycloak.storage.ldap.idm.store.ldap.LDAPContextManager","method":"getLdapContext","line":105},{"class":"org.keycloak.services.managers.LDAPServerCapabilitiesManager","method":"testLDAP","line":202},{"class":"org.keycloak.services.resources.admin.TestLdapConnectionResource","method":"testLDAPConnection","line":92},{"class":"org.keycloak.services.resources.admin.TestLdapConnectionResource$quarkusrestinvoker$testLDAPConnection_c31f9cb262cabd2403483720b840b8d28e8baa95","method":"invoke"},{"class":"org.jboss.resteasy.reactive.server.handlers.InvocationHandler","method":"handle","line":29},{"class":"io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext","method":"invokeHandler","line":183},{"class":"org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext","method":"run","line":147},{"class":"io.quarkus.vertx.core.runtime.VertxCoreRecorder$15","method":"runWith","line":645},{"class":"org.jboss.threads.EnhancedQueueExecutor$Task","method":"doRunWith","line":2651},{"class":"org.jboss.threads.EnhancedQueueExecutor$Task","method":"run","line":2630},{"class":"org.jboss.threads.EnhancedQueueExecutor","method":"runThreadBody","line":1622},{"class":"org.jboss.threads.EnhancedQueueExecutor$ThreadBody","method":"run","line":1589},{"class":"org.jboss.threads.DelegatingRunnable","method":"run","line":11},{"class":"org.jboss.threads.ThreadLocalResettingRunnable","method":"run","line":11},{"class":"io.netty.util.concurrent.FastThreadLocalRunnable","method":"run","line":30},{"class":"java.lang.Thread","method":"run","line":1583}]}} {"timestamp":"2025-10-30T13:28:17.446321981Z","sequence":5675,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.transaction.JtaTransactionWrapper","level":"DEBUG","message":"JtaTransactionWrapper rollback. Request Context: HTTP POST /admin/realms/myrealm/testLDAPConnection","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.447410735Z","sequence":5676,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.transaction.JtaTransactionWrapper","level":"DEBUG","message":"JtaTransactionWrapper end. Request Context: HTTP POST /admin/realms/myrealm/testLDAPConnection","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.448050159Z","sequence":5677,"loggerClassName":"org.hibernate.internal.CoreMessageLogger_$logger","loggerName":"org.hibernate.session.metrics","level":"DEBUG","message":"HHH000401: Logging session metrics:\n\t0 ns acquiring 0 JDBC connections\n\t0 ns releasing 0 JDBC connections\n\t0 ns preparing 0 JDBC statements\n\t0 ns executing 0 JDBC statements\n\t0 ns executing 0 JDBC batches\n\t0 ns performing 0 second-level cache puts\n\t0 ns performing 0 second-level cache hits\n\t0 ns performing 0 second-level cache misses\n\t0 ns executing 0 flushes (flushing a total of 0 entities and 0 collections)\n\t0 ns executing 0 pre-partial-flushes\n\t0 ns executing 0 partial-flushes (flushing a total of 0 entities and 0 collections)\n","threadName":"executor-thread-1","threadId":25,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.454736647Z","sequence":5678,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics","level":"DEBUG","message":"responseEnd io.vertx.core.http.impl.Http1xServerResponse@5a51eae6, HttpRequestMetric [initialPath=/admin/realms/myrealm/testLDAPConnection, currentRoutePath=/, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@5e5ea96]","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766} {"timestamp":"2025-10-30T13:28:17.455296477Z","sequence":5679,"loggerClassName":"org.jboss.logging.DelegatingBasicLogger","loggerName":"org.infinispan.metrics.impl.MetricsRegistryImpl","level":"DEBUG","message":"Registered metric MeterId{name='http.server.requests', tags=[tag(method=POST),tag(outcome=CLIENT_ERROR),tag(status=400),tag(uri=/admin/realms/{realm}/{extension})]}","threadName":"vert.x-eventloop-thread-0","threadId":35,"mdc":{},"ndc":"","hostName":"hostname.eu-west-2a.keycloak","processName":"/usr/lib/jvm/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/bin/java","processId":9766}

How to Reproduce?

To reproduce the issue Logon to the Keycloak Admin Console Select Manage Realms, select your realm Select User federation then the Ldap domain With the ldap configuration correctly configured (Connection URL with multiple AD Servers, Bind type = Simple, Bind DN, Bind credentials), click the Test authentication button to confirm authentication is working.

Then update the Connection URL with just one of the working AD Servers and click Test Authentication.

This causes the test to fail.

Anything else?

No response