[Bug]: a wrong password will trigger badPwdCount twice in ldap

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

If i enter a wrong password the login will fail > as expected
But the "bad password counter" allways get raised +2 instead of +1

I am using the User_ldap app and have debugged this bug to this method:

https://github.com/nextcloud/server/blob/232866d42ed25150358c17a0dda1a4ac0c058961/lib/private/User/Manager.php#L255-L291

Here this method first tries to login with the given credentials.
After fail a second try is happen to prove for non ascii passwords...

I think this second one have to be configurable, because if someone has a fail to ban protection in ldap @ 3 wrong passwords the user get locked out/banned after only 2 wrong password tries

Steps to reproduce

1.install nextcloud (version does not matter, cause version 18-24 are affected)
2. install / setup user_ldap app
3. login with existing user but bad password
4. look into Active directory user / group management console and search for the user
5. look into the attribute editor und find badPwdCount raised to "2"

Expected behavior

decribed above

Installation method

No response

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Nginx

Database engine version

SQlite

Is this bug present after an update or on a fresh install?

fresh install and update

Are you using the Nextcloud Server Encryption module?

no

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "192.168.1.3"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "sqlite3",
        "version": "25.0.0.6",
        "overwrite.cli.url": "http:\/\/192.168.1.3\/nextcloud",
        "installed": true,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
    }
}

List of activated Apps

Enabled:
  - cloud_federation_api: 1.8.0
  - dav: 1.24.0
  - federatedfilesharing: 1.15.0
  - files: 1.20.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - lookup_server_connector: 1.13.0
  - oauth2: 1.13.0
  - provisioning_api: 1.15.0
  - settings: 1.7.0
  - systemtags: 1.15.0
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_ldap: 1.15.0
  - user_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - admin_audit
  - bruteforcesettings
  - comments: 1.15.0
  - contactsinteraction: 1.6.0
  - dashboard: 7.5.0
  - encryption
  - federation: 1.15.0
  - files_external
  - files_sharing: 1.17.0
  - sharebymail: 1.15.0
  - testing
  - theming: 2.0.0
  - weather_status: 1.5.0

Nextcloud Signing status

Nextcloud Logs

not provided, not needed due to logical bug in source...
see in description above

Additional info

affected Nextcloud versions:

• 18
• 19
• 20
• 21
• 22
• 23
• 24
• latest

Start in lib/private/User/Manager.php at the method linked in the issue, around lines 255-291, and trace the two authentication attempts used for non-ASCII password handling. Reproduce a failed LDAP/Active Directory login and verify that one incorrect password does not increment badPwdCount twice, while determining how the proposed configurability should behave.