🇩🇪Germany @websiedler

I can confirm similar behaviour changing the password using the user profile form.

digging in the code I recognized that CredentialsStorage::storeUserPassword) is called twice, first as expected by ldap_user_grab_password_validate() with the new password from the profile form, but after that by LdapProtectedUserFieldConstraintValidator:validate() with the old password from the current useraccount.

Therefore CredentialsStorage::getPassword() in LdapEntryProvisionSubscriber::fetchDrupalAccountPassword() gets the old password and syncs it subsequently.

The new password is correctly set in the local Drupal database by the profile form.

After a successful re-login with the new password, it is grabbed and synced as expected.