{"record":{"id":"2bd351187e3f2397","repo":"flowable/flowable-engine","slug":"could-not-find-or-create-privilegename-privileg","errorCode":null,"errorMessage":"Could not find or create ${privilegeName} privilege","messagePattern":"Could not find or create (.+?) privilege","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"critical","filePath":"modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/BootstrapConfiguration.java","lineNumber":130,"sourceCode":"        initializePrivilege(restAdminId, SecurityConstants.ACCESS_ADMIN);\n    }\n\n    protected void initializePrivilege(String restAdminId, String privilegeName) {\n        boolean restApiPrivilegeMappingExists = false;\n        Privilege privilege = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();\n        if (privilege != null) {\n            restApiPrivilegeMappingExists = restApiPrivilegeMappingExists(restAdminId, privilege);\n        } else {\n            try {\n                privilege = idmIdentityService.createPrivilege(privilegeName);\n            } catch (Exception e) {\n                // Could be created by another server, retrying fetch\n                privilege = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();\n            }\n        }\n        \n        if (privilege == null) {\n            throw new FlowableException(\"Could not find or create \" + privilegeName + \" privilege\");\n        }\n        \n        if (!restApiPrivilegeMappingExists) {\n            idmIdentityService.addUserPrivilegeMapping(privilege.getId(), restAdminId);\n        }\n    }\n\n    protected boolean restApiPrivilegeMappingExists(String restAdminId, Privilege privilege) {\n        return idmIdentityService.createPrivilegeQuery()\n                .userId(restAdminId)\n                .privilegeId(privilege.getId())\n                .singleResult() != null;\n    }\n    \n    protected void initDemoProcessDefinitions() {\n\n        String deploymentName = \"Demo processes\";\n        List<Deployment> deploymentList = repositoryService.createDeploymentQuery().deploymentName(deploymentName).list();","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/BootstrapConfiguration.java#L112-L148","documentation":"BootstrapConfiguration.initializePrivilege throws FlowableException when, after creating-or-fetching and one retry (to handle concurrent creation by another server node), the IDM privilege still cannot be found. This indicates the bootstrap default privilege (e.g. rest-api privilege) could not be provisioned, so the REST admin mapping cannot be established and startup fails.","triggerScenarios":"Calling initializeDefaultPrivileges during REST app bootstrap where createPrivilege(...).singleResult() and the retry fetch both return null — e.g. privilege creation silently failed or the IDM engine/DB is in an inconsistent state.","commonSituations":"Multi-node startup racing on privilege creation combined with a failed transaction; a read-only or misconfigured IDM database where the insert is not persisted; permission-name mismatches after version upgrades.","solutions":["Check the IDM database for an existing ACT_ID_PRIV row with the privilege name; create it manually if creation keeps failing","Verify the IDM engine can write (correct datasource, not read-only) and review logs for a swallowed exception during privilege creation","Restart bootstrap after fixing concurrency/DB issues — the retry assumes another node creates it","If upgrading, confirm expected default privilege names match your data (e.g. rest-api) and align configuration"],"exampleFix":"// before\nprivilege = idmIdentityService.createPrivilege(privilegeName); // failed silently, no tx commit\n// after\nPrivilege p = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();\nif (p == null) {\n    p = idmIdentityService.createPrivilege(privilegeName); // ensure within a committed transaction\n}","handlingStrategy":"retry","validationCode":"Privilege existing = idmIdentityService.createPrivilegeQuery().privilegeName(\"rest-api\").singleResult();\nif (existing == null) {\n    // ensure IDM DB is writable before bootstrap\n    logger.warn(\"Default privilege missing; bootstrap will attempt to create it\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    runBootstrap(args);\n} catch (FlowableException e) {\n    if (e.getMessage().contains(\"Could not find or create\")) {\n        logger.error(\"Privilege bootstrap failed; check ACT_ID_PRIV table and IDM datasource\", e);\n    }\n    throw e;\n}","preventionTips":["Stagger or coordinate bootstrap across clustered nodes to reduce creation races","Confirm the IDM datasource is writable and migrations ran successfully","Pre-create default privileges in your DB provisioning scripts"],"tags":["bootstrap","idm","privilege","flowable"],"backgroundTag":"entity-not-found","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}