Authenticated users can download packages from the CMD but not allowed to download it from the web UI

[SoConfuseddd]

I am new to verdaccio and I'm trying to host verdaccio but I am facing a problem
I'm using verdaccio-ldap plugin to authenticate the users through the active directory
I can login to the UI using my organization credentials successfully and I can login through the CMD as well
But when it comes to downloading the packages, the web UI refuses to download the tarball and I get this error

info <-- 127.0.0.1 requested 'POST /-/verdaccio/sec/login'
http <-- 200, user: null(127.0.0.1), req: 'POST /-/verdaccio/sec/login', bytes: 52/0
http <-- 200, user: nada(127.0.0.1), req: 'POST /-/verdaccio/sec/login', bytes: 52/356
info <-- 127.0.0.1 requested 'GET /-/verdaccio/data/packages'
http <-- 200, user: nada(127.0.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/0
info --- auth/allow_action: access granted to: adahefuo
info --- allowed access for test
http <-- 200, user: nada(127.0.0.1), req: 'GET /-/verdaccio/data/packages', bytes: 0/1101
info <-- 127.0.0.1 requested 'GET /test/-/test-1.0.0.tgz'
error--- forbidden access for test. Error: authorization required to access package test
http <-- 200, user: null(127.0.0.1), req: 'GET /test/-/test-1.0.0.tgz', bytes: 0/0
http <-- 401, user: null(127.0.0.1), req: 'GET /test/-/test-1.0.0.tgz', error: authorization required to access package test

it first logs in successfully then became null again

although when I try to install the same package using the same credentials through npm install it is installed successfully

C:\Users\nada\Desktop\test>npm publish --registry http://localhost:4873/
npm notice
npm notice package: [email protected]
npm notice === Tarball Contents ===
npm notice 218B docs/package.json
npm notice 260B package.json
npm notice === Tarball Details ===
npm notice name:          test
npm notice version:       1.0.0
npm notice filename:      test-1.0.0.tgz
npm notice package size:  300 B
npm notice unpacked size: 478 B
npm notice shasum:        7ada4127f9ae2d651dadf063ab717f96be472041
npm notice integrity:     sha512-oHsSFbEugtqJP[...]npt3b91ySQXiw==
npm notice total files:   2
npm notice
npm notice Publishing to http://localhost:4873/ with tag latest and default access
+ [email protected]
C:\Users\nada\Desktop\test>npm install --registry=http://localhost:4873/ test

added 1 package, and audited 2 packages in 4s

found 0 vulnerabilities

This is all what I changed on the default configuration

auth:
  ldap:
    type: ldap
    client_options:
      url: "ldaps://ldap.url.com:636"
      searchBase: "DC=x,DC=y,DC=com"
      searchFilter: '(&(objectClass=user)(cn={{username}}))'
      groupDnProperty: 'cn'
      groupSearchBase: 'DC=x,DC=y,DC=com'
      searchAttributes: ['*', 'memberOf']
      reconnect: true
      tlsOptions:
        rejectUnauthorized: false

packages:
  '@*/*':
    # scoped packages
    access: $authenticated
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmjs

  '**':
    access: $authenticated
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmjs

[mbtools]

which versions of node, npm, verdaccio do you run?