NPE found when a ldap user tries to login for thefirst time

### problem

NPE found when a ldap user tries to login for the first time

### versions

ACS. 4.23

### The steps to reproduce the bug

Steps to reproduce the issue

Have a openldap server and configure LDAP configuration in cloudstack and domain

1. Create a account in a domain.

cmk create account accounttype=0 username=qa-admin password=x email=a@b.c firstname=q lastname=a account=qa-team-acct domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c roleid=4

2. Link account to ldap

cmk link accounttoldap domainid=b62d7616-ac14-11f1-b58f-1e00cb00045c account=qa-team-acct type=GROUP ldapdomain='cn=qa-team,ou=Telco-Bng,dc=example,dc=in' accounttype=0

3. login as the ldap user

4. NPE execption found the first login

Logs

```
[root@ref-trl-12339-k-Mol8-kiran-chavala-mgmt1 ~]# cat /var/log/cloudstack/management/management-server.log | grep -i "logid:d30a2480"
2026-09-09 09:28:43,319 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===START=== 10.0.3.251 -- POST login
2026-09-09 09:28:43,320 DEBUG [c.c.a.ApiSessionListener] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Session created by Id : node01e0gcsnit62u91szmr8mgirvcm138 , session: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , source: Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true} , event: javax.servlet.http.HttpSessionEvent[source=Session@23d2189f{id=node01e0gcsnit62u91szmr8mgirvcm138,x=node01e0gcsnit62u91szmr8mgirvcm138.node0,req=1,res=true}]
2026-09-09 09:28:43,323 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Attempting to log in user: kiran in domain 2
2026-09-09 09:28:43,324 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,325 DEBUG [o.a.c.s.a.PBKDF2UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,325 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.SHA256SaltedUserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving user: kiran
2026-09-09 09:28:43,326 DEBUG [o.a.c.a.MD5UserAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Unable to find user with kiran in domain 2
2026-09-09 09:28:43,327 DEBUG [o.a.c.l.LdapAuthenticator] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Retrieving ldap user: kiran
2026-09-09 09:28:43,340 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,359 DEBUG [o.a.c.l.OpenLdapUserManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) adding search filter for 'cn=qa-team,ou=Telco-Bng,dc=example,dc=in', using 'memberof'
2026-09-09 09:28:43,377 DEBUG [o.a.c.l.LdapContextFactory] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) initializing ldap with provider url: ldap://10.0.33.32:389
2026-09-09 09:28:43,380 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Access granted to Account [{"accountName":"system","id":1,"uuid":"161686dc-ac15-11f1-b58f-1e00cb00045c"}] to Domain {"id":2,"name":"telco-bng","path":"\/telco-bng\/","uuid":"7d685c93-0d65-4cbb-9afe-223d1000aa7d"} by AffinityGroupAccessChecker
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Verifying whether the caller has the correct privileges based on the user's role type and API permissions: Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]
2026-09-09 09:28:43,385 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Creating user: kiran, accountId: 8 timezone:null
2026-09-09 09:28:43,776 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) CIDRs from which account 'Account [{"accountName":"qa-team-acct","id":8,"uuid":"97ad8a9f-19eb-42a8-a930-c92e458c507d"}]' is allowed to perform API calls: 0.0.0.0/0,::/0
2026-09-09 09:28:43,792 DEBUG [c.c.u.AccountManagerImpl] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) User: kiran in domain 2 has successfully logged in, auth time duration - 469 ms
2026-09-09 09:28:43,792 INFO [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Current user logged in under UTC timezone
2026-09-09 09:28:43,792 INFO [c.c.a.ApiServer] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) Timezone offset from UTC is: 0.0
2026-09-09 09:28:43,797 ERROR [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) unknown exception writing api response java.lang.NullPointerException: Cannot invoke "com.cloud.user.UserAccount.getId()" because "userAccount" is null
2026-09-09 09:28:43,799 DEBUG [c.c.a.ApiServlet] (qtp1151704483-21:[ctx-d818adc7]) (logid:d30a2480) ===END=== 10.0.3.251 -- POST login
```

5. Subsequent logins works fine

### What to do about it?

First ldap login should work fine

Commencez par le chemin de connexion de AccountManagerImpl et le flux de LdapAuthenticator affichés dans les logs, en vous concentrant sur la gestion de userAccount lors de la première connexion. Reproduisez la configuration d’OpenLDAP et la première connexion, puis vérifiez que la réponse de l’API se termine sans la NullPointerException et que les connexions suivantes fonctionnent toujours.

Rédigé par le modèle d'indexation à partir du texte de l'issue.