NPE found when a ldap user tries to login for thefirst time

从日志中显示的 AccountManagerImpl 登录路径和 LdapAuthenticator 流程开始，重点关注首次登录时对 userAccount 的处理。复现 OpenLDAP 设置和首次登录，然后验证 API 响应能够在不发生 NullPointerException 的情况下完成，并且后续登录仍然有效。

problem

NPE found when a ldap user tries to login for the first time

versions

ACS. 4.23

The steps to reproduce the bug

Steps to reproduce the issue

Have a openldap server and configure LDAP configuration in cloudstack and domain

1. Create a account in a domain.

cmk create account accounttype=0 username=qa-admin password=x email=a@b.c firstname=q lastname=a account=qa-team-acct domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c roleid=4

2. Link account to ldap

cmk link accounttoldap domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c account=qa-team-acct type=GROUP ldapdomain='cn=qa-team,ou=Telco-Bng,dc=example,dc=in' accounttype=0

3. login as the ldap user

4. NPE execption found the first login

Logs

[root@ref-trl-12339-k-Mol8-kiran-chavala-mgmt1 ~]# cat  /var/log/cloudstack/management/management-server.log | grep -i "logid:d30a2480"
2026-09-09 09:28:43,319 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===START===  10.0.3.251 -- POST   login
2026-09-09 09:28:43,320 DEBUG [c.c.a.ApiSessionListener] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Session created by Id : node01e0gcsnit62u91szmr8mgirvcm138 , session: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , source: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , event: javax.servlet.http.HttpSessionEvent[source=Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true}]
2026-09-09 09:28:43,323 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Attempting to log in user: kiran in domain 2
2026-09-09 09:28:43,324 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,325 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,325 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,327 DEBUG [o.a.c.l.LdapAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving ldap user: kiran
2026-09-09 09:28:43,340 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,359 DEBUG [o.a.c.l.OpenLdapUserManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) adding search filter for 'cn=qa-team,ou=Telco-Bng,dc=example,dc=in', using 'memberof'
2026-09-09 09:28:43,377 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,380 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Access granted to Account [{"accountName":"system","id":1,"uuid":"161686dc-ac15-11f1-b58f-1e00cb00045c"}] to Domain {"id":2,"name":"telco-bng","path":"\/telco-bng\/","uuid":"7d685c93-0d65-4cbb-9afe-223d1000aa7d"} by AffinityGroupAccessChecker
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Verifying whether the caller has the correct privileges based on the user's role type and API permissions: Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Creating user: kiran, accountId: 8 timezone:null
2026-09-09 09:28:43,776 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) CIDRs from which account 'Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]' is allowed to perform API calls: 0.0.0.0/0,::/0
2026-09-09 09:28:43,792 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) User: kiran in domain 2 has successfully logged in, auth time duration - 469 ms
2026-09-09 09:28:43,792 INFO  [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Current user logged in under UTC timezone
2026-09-09 09:28:43,792 INFO  [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Timezone offset from UTC is: 0.0
2026-09-09 09:28:43,797 ERROR [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) unknown exception writing api response java.lang.NullPointerException: Cannot invoke "com.cloud.user.UserAccount.getId()" because "userAccount" is null
2026-09-09 09:28:43,799 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===END===  10.0.3.251 -- POST   login

5. Subsequent logins works fine

What to do about it?

First ldap login should work fine