{"record":{"id":"29c64b46d073af59","repo":"flowable/flowable-engine","slug":"could-not-find-groups","errorCode":null,"errorMessage":"Could not find groups ","messagePattern":"Could not find groups ","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/impl/LDAPGroupQueryImpl.java","lineNumber":131,"sourceCode":"                        GroupEntity group = new GroupEntityImpl();\n                        if (ldapConfigurator.getGroupIdAttribute() != null) {\n                            group.setId(result.getAttributes().get(ldapConfigurator.getGroupIdAttribute()).get().toString());\n                        }\n                        if (ldapConfigurator.getGroupNameAttribute() != null) {\n                            group.setName(result.getAttributes().get(ldapConfigurator.getGroupNameAttribute()).get().toString());\n                        }\n                        if (ldapConfigurator.getGroupTypeAttribute() != null) {\n                            group.setType(result.getAttributes().get(ldapConfigurator.getGroupTypeAttribute()).get().toString());\n                        }\n                        groups.add(group);\n                    }\n\n                    namingEnum.close();\n\n                    return groups;\n\n                } catch (NamingException e) {\n                    throw new FlowableException(\"Could not find groups \" + searchExpression, e);\n                }\n            }\n\n        });\n    }\n\n    protected SearchControls createSearchControls() {\n        SearchControls searchControls = new SearchControls();\n        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);\n        searchControls.setTimeLimit(ldapConfigurator.getSearchTimeLimit());\n        return searchControls;\n    }\n}\n","sourceCodeStart":113,"sourceCodeEnd":145,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/impl/LDAPGroupQueryImpl.java#L113-L145","documentation":"LDAPGroupQueryImpl.executeInContext runs an LDAP search for groups and wraps any javax.naming.NamingException in a FlowableException prefixed with 'Could not find groups' plus the search expression used. It signals that the LDAP directory operation itself failed (connection, naming, or schema problems), not that zero groups matched.","triggerScenarios":"Any GroupQuery execution against LDAP (findById, groupMember, etc.) where the underlying DirContext.search call throws NamingException — e.g. invalid search base, bad filter, or the LDAP server is unreachable.","commonSituations":"Wrong LDAP server URL or port in the configurator; searchBase pointing to a non-existent OU; credentials without rights to read the group tree; network/firewall changes between app and LDAP server; expired service account credentials.","solutions":["Inspect the wrapped NamingException cause to see the exact LDAP error (connection refused, invalid DN, no such object, etc.).","Verify ldapConfigurator settings: server URL/port, searchBase for groups, user/group attributes and the group query filter.","Test the same search with ldapsearch or an LDAP browser using the same bind credentials to isolate app vs directory issues.","Check network connectivity and firewall rules from the app host to the LDAP server."],"exampleFix":"// before (config)\ncfg.setGroupBase(\"ou=groupz,dc=example,dc=org\"); // typo\n\n// after\ncfg.setGroupBase(\"ou=groups,dc=example,dc=org\");","handlingStrategy":"try-catch","validationCode":"// pre-check connectivity\nnew InitialDirContext(env); // verify bind works before issuing queries","typeGuard":null,"tryCatchPattern":"try { return identityService.createGroupQuery().list(); } catch (FlowableException e) { log.error(\"LDAP group query failed: \" + e.getMessage(), e.getCause()); throw new LdapUnavailableException(e); }","preventionTips":["Validate searchBase DNs and group filters with ldapsearch before deployment.","Monitor LDAP server reachability and service-account credential expiry.","Log the cause chain — the NamingException carries the real directory error."],"tags":["ldap","naming-exception","directory-search","connection"],"backgroundTag":"database-query-failed","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}