**Build scan:**
https://gradle-enterprise.elastic.co/s/fmiiv5kmsm2uu/tests/:x-pack:qa:third-party:active-directory:test/org.elasticsearch.xpack.security.authc.ldap.GroupMappingIT/testGroupMapping

**Reproduction line:**
`./gradlew ':x-pack:qa:third-party:active-directory:test' --tests "org.elasticsearch.xpack.security.authc.ldap.GroupMappingIT.testGroupMapping" -Dtests.seed=D51FD3E394A6008D -Dtests.locale=es-GT -Dtests.timezone=Europe/Sarajevo -Druntime.java=17`

**Applicable branches:**
master

**Reproduces locally?:**
No

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.xpack.security.authc.ldap.GroupMappingIT&tests.test=testGroupMapping

**Failure excerpt:**
```
org.elasticsearch.ElasticsearchSecurityException: unable to authenticate user [odin] for action [indices:data/write/index]

  at __randomizedtesting.SeedInfo.seed([D51FD3E394A6008D:9718CF59E5601BBC]:0)
  at org.elasticsearch.xpack.core.security.support.Exceptions.authenticationError(Exceptions.java:20)
  at org.elasticsearch.xpack.core.security.authc.DefaultAuthenticationFailureHandler.createAuthenticationError(DefaultAuthenticationFailureHandler.java:186)
  at org.elasticsearch.xpack.core.security.authc.DefaultAuthenticationFailureHandler.failedAuthentication(DefaultAuthenticationFailureHandler.java:106)
  at org.elasticsearch.xpack.security.authc.AuthenticationService$AuditableTransportRequest.authenticationFailed(AuthenticationService.java:332)
  at org.elasticsearch.xpack.security.authc.RealmsAuthenticator.consumeNullUser(RealmsAuthenticator.java:269)
  at org.elasticsearch.xpack.security.authc.RealmsAuthenticator.lambda$consumeToken$3(RealmsAuthenticator.java:212)
  at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:136)
  at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:31)
  at org.elasticsearch.xpack.core.common.IteratingActionListener.onResponse(IteratingActionListener.java:132)
  at org.elasticsearch.xpack.security.authc.RealmsAuthenticator.lambda$consumeToken$0(RealmsAuthenticator.java:190)
  at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:136)
  at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.lambda$authenticateWithCache$3(CachingUsernamePasswordRealm.java:221)
  at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:136)
  at org.elasticsearch.xpack.security.authc.ldap.LdapRealm$LdapSessionActionListener.onFailure(LdapRealm.java:308)
  at org.elasticsearch.action.support.ContextPreservingActionListener.onFailure(ContextPreservingActionListener.java:38)
  at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectorySessionFactory.lambda$getSessionWithoutPool$2(ActiveDirectorySessionFactory.java:163)
  at org.elasticsearch.action.ActionListener$1.onFailure(ActionListener.java:144)
  at org.elasticsearch.action.ActionRunnable.onFailure(ActionRunnable.java:77)
  at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils$2.onFailure(LdapUtils.java:204)
  at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:28)
  at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.maybeForkAndRun(LdapUtils.java:102)
  at org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils.maybeForkThenBind(LdapUtils.java:212)
  at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectorySessionFactory$ADAuthenticator.authenticate(ActiveDirectorySessionFactory.java:320)
  at org.elasticsearch.xpack.security.authc.ldap.ActiveDirectorySessionFactory.getSessionWithoutPool(ActiveDirectorySessionFactory.java:161)
  at org.elasticsearch.xpack.security.authc.ldap.PoolingSessionFactory.session(PoolingSessionFactory.java:110)
  at org.elasticsearch.xpack.security.authc.ldap.LdapRealm.lambda$doAuthenticate$1(LdapRealm.java:147)
  at org.elasticsearch.xpack.security.authc.ldap.LdapRealm$CancellableLdapRunnable.doRun(LdapRealm.java:343)
  at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:776)
  at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
  at java.lang.Thread.run(Thread.java:833)

```
x-pack/qa/third-party/active-directory/src/test/java/org/elasticsearch/xpack/security/authc/ldap/AbstractAdLdapRealmTestCase.java
if (shouldPickFileContent.get()) {
                return new RoleMappingEntry(fileContent, null);
            } else {
                return new RoleMappingEntry(null, nativeContent);
            }
        }
    }
    /**
     * Represents multiple possible configurations for active directory and ldap
     */
    enum RealmConfig {
        AD(
            false,
            AD_ROLE_MAPPING,
            Settings.builder()
                .put(XPACK_SECURITY_AUTHC_REALMS_AD_EXTERNAL + ".domain_name", ActiveDirectorySessionFactoryTests.AD_DOMAIN)
                .put(XPACK_SECURITY_AUTHC_REALMS_AD_EXTERNAL + ".group_search.base_dn", "CN=Users,DC=ad,DC=test,DC=elasticsearch,DC=com")
                .put(XPACK_SECURITY_AUTHC_REALMS_AD_EXTERNAL + ".group_search.scope", randomBoolean() ? SUB_TREE : ONE_LEVEL)
                .put(XPACK_SECURITY_AUTHC_REALMS_AD_EXTERNAL + ".url", ActiveDirectorySessionFactoryTests.AD_LDAP_URL)
                .put(XPACK_SECURITY_AUTHC_REALMS_AD_EXTERNAL + ".follow_referrals", ActiveDirectorySessionFactoryTests.FOLLOW_REFERRALS)
                .put(getFullSettingKey("external", ActiveDirectorySessionFactorySettings.AD_LDAP_PORT_SETTING), AD_LDAP_PORT)
                .put(getFullSettingKey("external", ActiveDirectorySessionFactorySettings.AD_LDAPS_PORT_SETTING), AD_LDAPS_PORT)
                .put(getFullSettingKey("external", ActiveDirectorySessionFactorySettings.AD_GC_LDAP_PORT_SETTING), AD_GC_LDAP_PORT)
                .put(getFullSettingKey("external", ActiveDirectorySessionFactorySettings.AD_GC_LDAPS_PORT_SETTING), AD_GC_LDAPS_PORT)
                .build(),
            "active_directory"
        ),
        AD_LDAP_GROUPS_FROM_SEARCH(
            true,
            AD_ROLE_MAPPING,