recalculate_groups (or the expanded version of that) was called after user creation in LDAP, but the user was not updated afterwards to actually set the groups.
running recalculate_groups before .to_ldap() sets the groups right to only need one .to_ldap().
Note: recalculate_groups only works on the Role/User, so we don't need to wait for LDAP success. .to_ldap() first adds the user and only afterwards does the groups.