diff --git a/core/src/main/java/hudson/security/LDAPSecurityRealm.java b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
index 87ae5ae7f1e17231c2cbba4dadbc39157bbda8ce..147d78b37a86775cbc065f0f8fc9d5024247f602 100644
--- a/core/src/main/java/hudson/security/LDAPSecurityRealm.java
+++ b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
@@ -436,9 +436,11 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
                     // intern attributes
                     Attributes v = ldapUser.getAttributes();
                     if (v instanceof BasicAttributes) {// BasicAttributes.equals is what makes the interning possible
-                        Attributes vv = (Attributes)attributesCache.get(v);
-                        if (vv==null)   attributesCache.put(v,vv=v);
-                        user.setAttributes(vv);
+                        synchronized (attributesCache) {
+                            Attributes vv = (Attributes)attributesCache.get(v);
+                            if (vv==null)   attributesCache.put(v,vv=v);
+                            user.setAttributes(vv);
+                        }
                     }
 
                     GrantedAuthority[] extraAuthorities = authoritiesPopulator.getGrantedAuthorities(ldapUser);