When using search-and-bind strategy, the user attributes are already returned in the first search. If the user happens to not have privileges to perform a search, the second search may fail. (user only has bind privileges) See https://github.com/cloudfoundry/uaa/issues/342