LDAP plugin throws "Emby Premiere required for LDAP" while the same server log reports "Registered for

[Zeretzul 0]

Emby Server 4.9.5.0 stable, Linux x64 (Ubuntu 24.04), .NET 8.0.25
LDAP plugin 1.0.45.0
Server Id: 49e19033f5604404b403653ef7e80d9f
Premiere: active monthly Stripe subscription, expires 2026-10-04

Every LDAP authentication attempt fails with "Emby Premiere required for
LDAP", on a server whose own startup log confirms Premiere validated:

  19:44:57.392  Loading LDAP, Version=1.0.45.0 from /var/lib/emby/plugins/LDAP.dll
  19:45:00.384  Starting entry point Emby.Security.PluginSecurityManager
  19:45:07.462  POST https://mb3admin.com/admin/service/registration/validate
  19:45:07.594  Http response 200 after 132ms
  19:45:07.599  SecurityManager: Registered for MBSupporter
  19:45:18.993  Error UserManager: Error authenticating with provider LDAP
                System.Exception: Emby Premiere required for LDAP
                   at LDAP.AuthenticationProvider.Authenticate(String, String)

Plugins/SecurityInfo returns IsMBSupporter: true. Other Premiere features are
fine — DVR, Sync and Cinema Mode all report registered with the correct
2026-10-04 expiry.

The plugin aborts before any network I/O — there are no LDAP or socket errors
anywhere in the log, because it never opens a connection.

The LDAP server itself is provably fine. From the Emby host, using the exact
bind DN, base DN and filter configured in the plugin:

  $ LDAPTLS_REQCERT=never ldapsearch -x -H ldaps://<server>:636 \
      -D "cn=svc.emby-ldap,ou=users,dc=dember,dc=net" -W \
      -b "ou=users,dc=dember,dc=net" \
      "(&(cn=aputrino)(memberOf=cn=emby_users,ou=groups,dc=dember,dc=net))"

  dn: cn=aputrino,ou=users,dc=dember,dc=net
  result: 0 Success

Ruled out:
- Server version — reproduces on 4.9.5.0 stable and 4.10.0.27 beta
- Plugin binary — uninstalled and reinstalled; 1.0.45.0 is current
- LDAP target/network/TLS — no I/O occurs; proven working independently,
  and behaviour is identical against a different LDAP server entirely
- User lockout — fires one millisecond AFTER the tenth LDAP failure, and
  failures continue for 90+ minutes after it expires
- General auth breakage — local Emby accounts authenticate normally

Also tried without effect: renewing Premiere, re-saving the licence key
(confirmed accepted), three restarts.

Note: my subscription had lapsed briefly and was renewed the same day, a
couple of hours before these logs.

One observation I can't evaluate from outside the code: the plugin is loaded
at 19:44:57.392, roughly ten seconds BEFORE the licence validation completes
at 19:45:07.599. If the plugin reads the supporter flag at construction
rather than at authentication time, it would capture "not registered" and
hold it for the life of the process — which would match the fact that this
reproduces identically on every restart. Is that plausible, or does the
provider re-read the flag on each call?

embyserver (6).txt