basalt-26.3.2-rc-20260908: security/ldapauth: TestLDAPAuthorizationDBConsole failed

security/ldapauth.TestLDAPAuthorizationDBConsole [failed](https://mesolite.cluster.engflow.com/invocations/default/84483de1-b344-4bb7-a487-42863798b484?testReportRun=1&testReportShard=1&testReportAttempt=1#targets-Ly9wa2cvc2VjdXJpdHkvbGRhcGF1dGg6bGRhcGF1dGhfdGVzdA==) on basalt-26.3.2-rc-20260908 @ [807558e5e81666af257c811e925e4cae570abc28](https://github.com/cockroachdb/cockroach/commits/807558e5e81666af257c811e925e4cae570abc28):

```
=== RUN TestLDAPAuthorizationDBConsole
test_log_scope.go:172: test logs captured to: outputs.zip/logTestLDAPAuthorizationDBConsole2601224691
test_log_scope.go:82: use -show-logs to present logs inline
test_server_shim.go:168: automatically injected a shared process virtual cluster under test; see comment at top of test_server_shim.go for details.
authorization_ldap_external_test.go:170: -- test log scope end --
test logs left over in: outputs.zip/logTestLDAPAuthorizationDBConsole2601224691
--- FAIL: TestLDAPAuthorizationDBConsole (63.96s)
=== RUN TestLDAPAuthorizationDBConsole/successful_login_with_partial_role_grant
authorization_ldap_external_test.go:136:
Error Trace: pkg/security/ldapauth/authorization_ldap_external_test.go:136
Error: Received unexpected error:
status: 401 Unauthorized, content-type: text/plain; charset=utf-8, body: {
(1) attached stack trace
-- stack trace:
| github.com/cockroachdb/cockroach/pkg/util/httputil.doJSONRequest
| pkg/util/httputil/http.go:189
| github.com/cockroachdb/cockroach/pkg/util/httputil.PostJSON
| pkg/util/httputil/http.go:93
| github.com/cockroachdb/cockroach/pkg/security/ldapauth_test.TestLDAPAuthorizationDBConsole.func6
| pkg/security/ldapauth/authorization_ldap_external_test.go:133
| testing.tRunner
| GOROOT/src/testing/testing.go:2036
| runtime.goexit
| src/runtime/asm_amd64.s:1771
Wraps: (2) status: 401 Unauthorized, content-type: text/plain; charset=utf-8, body: {
| "error": "the provided credentials did not match any account on the server",
| "code": 16,
| "message": "the provided credentials did not match any account on the server",
| "details": [
| ]
| }
| {
| "error": "An internal server error has occurred. Please check your CockroachDB logs for more details.",
| "code": 13,
| "message": "An internal server error has occurred. Please check your CockroachDB logs for more details.",
| "details": [
| ]
| }, error:
Error types: (1) *withstack.withStack (2) *errutil.leafError
Test: TestLDAPAuthorizationDBConsole/successful_login_with_partial_role_grant
Messages: DB Console login should succeed
--- FAIL: TestLDAPAuthorizationDBConsole/successful_login_with_partial_role_grant (11.45s)
```

Parameters:
- attempt=1
- race=true
- run=1
- shard=1
Help

See also: [How To Investigate a Go Test Failure \(internal\)](https://cockroachlabs.atlassian.net/l/c/HgfXfJgM)

/cc @cockroachlabs/security-engineering @cockroachlabs/product-security

[This test on roachdash](https://roachdash.crdb.dev/?filter=status:open%20t:.*TestLDAPAuthorizationDBConsole.*&sort=title+created&display=lastcommented+project) | [Improve this report!](https://github.com/cockroachdb/cockroach/tree/master/pkg/cmd/bazci/githubpost/issues)

Start with pkg/security/ldapauth/authorization_ldap_external_test.go, especially the login request around lines 133-136, and inspect the linked test report and captured logs. Reproduce TestLDAPAuthorizationDBConsole and determine why the partial-role-grant login receives 401 Unauthorized; done means the test passes successfully.

Written by the indexing model from the issue text.