Authentication with delegated LDAP does not work in case:

0. JIRA has Directory with setting: Delegated LDAP Authentication with "Copy user on login" enabled.
1. User is created in LDAP
2. The same user is created in JIRA (for Delegated LDAP directory)
3. Created user tries to log in

Login is unsuccessful with the following error:

 com.atlassian.crowd.exception.InvalidUserException: User externalId cannot be changed 

It seems that while creating user in Jira it gets an externalID parameter from InternalDirectory. Later on when we log in user is found in LDAP with different ExternalID. ExternalID cannot be overwritten so login fails.