LDAP groups sometimes could not be retrieved for a user. This leads to incorrect privileges.

This happens because of incorrect serialization/de-serialization of cached ldap user object.
in DefaultLDAPUser class we declare a distinguishedName field as transient.

private transient String distinguishedName;

When this object is serialization/de-serialization (which is happens in clustered cache) this filed will be null but we still use it to construct ldap query. See this support case.

We need to figure out if there is a reason why we declare this field as transient and if there is no good reason make it non-transient.