How to debug the cause of removing "invalid" user

[performation]

We are testing keycloak integration with an ldap federation provider.

We have created a 1000 users with username, password and otp secret. A test script picks random users and attempts to login to the service with correct credentials. Some users, quite often, fail to login. Keycloak logs "removed invalid user" after which the user appears to be restored from ldap, but their otp secret is now missing because it only existed in the keycloak database. The user now has to configure OTP again.

We have tried the same test setup with nightly build of keycloak and the setting "remove invalid users during searches" disabled. Now the users aren't removed, but are disabled and marked read only and still can't login. In addition, we don't know how to reenable them as it is unclear where they are marked read only. The corresponding user_entity.enabled field is still true, so it isn't clear where they are marked disabled either.

We would like to understand the reason keycloak deems these users invalid, so we can understand how to fix this behavior. We can't seem to find the reason in the log.