I think most of this stuff should be fixed in tomorrow's snapshot, though I haven't tested it all yet. The OIDC plugin was in fact also running the resolver when it doesn't need to, so that warning will go away as well I think. We need to prevent the LDAP drift problem in the future, so I filed an IdP bug on that. -- Scott