NPE found when a ldap user tries to login for thefirst time

### problem

NPE found when a ldap user tries to login for the first time

### versions

ACS. 4.23

### The steps to reproduce the bug

Steps to reproduce the issue

Have a openldap server and configure LDAP configuration in cloudstack and domain

1. Create a account in a domain.

cmk create account accounttype=0 username=qa-admin password=x email=a@b.c firstname=q lastname=a account=qa-team-acct domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c roleid=4

2. Link account to ldap

cmk link accounttoldap domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c account=qa-team-acct type=GROUP ldapdomain='cn=qa-team,ou=Telco-Bng,dc=example,dc=in' accounttype=0

3. login as the ldap user

4. NPE execption found the first login

Logs

```
[root@ref-trl-12339-k-Mol8-kiran-chavala-mgmt1 ~]# cat /var/log/cloudstack/management/management-server.log | grep -i "logid:d30a2480"
2026-09-09 09:28:43,319 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===START=== 10.0.3.251 -- POST login
2026-09-09 09:28:43,320 DEBUG [c.c.a.ApiSessionListener] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Session created by Id : node01e0gcsnit62u91szmr8mgirvcm138 , session: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , source: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , event: javax.servlet.http.HttpSessionEvent[source=Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true}]
2026-09-09 09:28:43,323 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Attempting to log in user: kiran in domain 2
2026-09-09 09:28:43,324 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,325 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,325 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,327 DEBUG [o.a.c.l.LdapAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving ldap user: kiran
2026-09-09 09:28:43,340 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,359 DEBUG [o.a.c.l.OpenLdapUserManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) adding search filter for 'cn=qa-team,ou=Telco-Bng,dc=example,dc=in', using 'memberof'
2026-09-09 09:28:43,377 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,380 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Access granted to Account [{"accountName":"system","id":1,"uuid":"161686dc-ac15-11f1-b58f-1e00cb00045c"}] to Domain {"id":2,"name":"telco-bng","path":"\/telco-bng\/","uuid":"7d685c93-0d65-4cbb-9afe-223d1000aa7d"} by AffinityGroupAccessChecker
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Verifying whether the caller has the correct privileges based on the user's role type and API permissions: Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Creating user: kiran, accountId: 8 timezone:null
2026-09-09 09:28:43,776 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) CIDRs from which account 'Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]' is allowed to perform API calls: 0.0.0.0/0,::/0
2026-09-09 09:28:43,792 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) User: kiran in domain 2 has successfully logged in, auth time duration - 469 ms
2026-09-09 09:28:43,792 INFO [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Current user logged in under UTC timezone
2026-09-09 09:28:43,792 INFO [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Timezone offset from UTC is: 0.0
2026-09-09 09:28:43,797 ERROR [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) unknown exception writing api response java.lang.NullPointerException: Cannot invoke "com.cloud.user.UserAccount.getId()" because "userAccount" is null
2026-09-09 09:28:43,799 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===END=== 10.0.3.251 -- POST login
```

5. Subsequent logins works fine

### What to do about it?

First ldap login should work fine

Start with the AccountManagerImpl login path and the LdapAuthenticator flow shown in the logs, focusing on the first-login userAccount handling. Reproduce the OpenLDAP setup and first login, then verify that the API response completes without the NullPointerException and that subsequent logins still work.

Written by the indexing model from the issue text.