This only seems to happen once a user with a large number of nested groups tries to login.
Once the user tries to login he is not authorized and continues to be blocked on subsequent login attempts. The user has 10 direct assigned groups and 75 indirect or nested groups he is a member of.
Once the user tries to login the logs in trace logs similar to the following.
DBGTRACE (10): escapedDn cn=bastion,cn=groups,cn=accounts,dc=example,dc=com
result nested attr count for depth 30 : 0
Results for LDAP group search for cn=bastion,cn=groups,cn=accounts,dc=example,dc=com in base convertedOldStyleSettings:
[]
DBGTRACE (10): escapedDn cn=bastion,cn=groups,cn=accounts,dc=example,dc=com
result nested attr count for depth 29 : 0
Results for LDAP group search for cn=bastion,cn=groups,cn=accounts,dc=example,dc=com in base convertedOldStyleSettings:
[]
This continues for several of the groups in our ldap. Another user with fewer groups can login and be authorized without issues. This logging goes away if I restart the cluster. It starts up again if the user tries to login.
This issue persists on v 3.4.0.