The exception is caused by an error in the code. A TreeSet java object is modified while a for loop iterates on it and this generates the ConcurrentModificationException as described by the javadoc.

For details please see the issue I created on JIRA-GeoServer ticket tracker. https://osgeo-org.atlassian.net/browse/GEOS-9488

I solved, at least in test environment, by modifying the code and by recompiling the classes affected by the error. Thus I generated a new gs-sec-ldap-2.16-SNAPSHOT.jar file and replaced the gs-sec-ldap-1.16.1.jar file in the lib folder of the geoserver.

More in detail I modified the LDAPRoleService.getRolesForUser and the LDAPUserGroupService.getGroupsForUser methods, as also described in the JIRA ticket, as following:

   public SortedSet<GeoServerRole> getRolesForUser(final String username) throws IOException 
        final SortedSet<GeoServerRole> roles = new TreeSet<GeoServerRole>();
        // new set containing only nested parent roles
        final SortedSet<GeoServerRole> parentRoles = new TreeSet<GeoServerRole>();
        //...
        if (useNestedGroups) {
            for (GeoServerRole erole : roles) { 
                searchNestedParentRoles(erole, parentRoles, 1);   
            }
            roles.addAll(parentRoles);

        }
        return Collections.unmodifiableSortedSet(roles);
    }

The exception is caused by an error in the code. A TreeSet java object is modified while a for loop iterates on it and this generates the ConcurrentModificationException as described by the javadoc.

For details please see the issue I created on JIRA-GeoServer ticket tracker. https://osgeo-org.atlassian.net/browse/GEOS-9488

I solved, at least in test environment, by modifying the code and by recompiling the classes affected by the error. Thus I generated a new gs-sec-ldap-2.16-SNAPSHOT.jar file and replaced the gs-sec-ldap-1.16.1.jar file in the lib folder of the geoserver.

More in detail I modified the LDAPRoleService.getRolesForUser and the LDAPUserGroupService.getGroupsForUser methods, as also described in the JIRA ticket, as follows:

   public SortedSet<GeoServerRole> getRolesForUser(final String username) throws IOException 
        final SortedSet<GeoServerRole> roles = new TreeSet<GeoServerRole>();
        // new set containing only nested parent roles
        final SortedSet<GeoServerRole> parentRoles = new TreeSet<GeoServerRole>();
        //...
        if (useNestedGroups) {
            for (GeoServerRole erole : roles) { 
                searchNestedParentRoles(erole, parentRoles, 1);   
            }
            roles.addAll(parentRoles);

        }
        return Collections.unmodifiableSortedSet(roles);
    }