Hi @olorasde,
The username and a hash of the password is being cached by x-pack for performance reasons. This can be disabled on a per realm basis. If you would like to disable it, in your ldap1 realm settings, add cache.ttl: -1. Details about the cache settings: https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html