{"record":{"id":"490738b6d882949f","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-creating-a-n-490738","errorCode":null,"errorMessage":"LDAP identity service doesn't support creating a new group","messagePattern":"LDAP identity service doesn't support creating a new group","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":123,"sourceCode":"\n    @Override\n    public void saveUser(User user) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving an user\");\n    }\n\n    @Override\n    public NativeUserQuery createNativeUserQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void saveGroup(Group group) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving a group\");\n    }\n\n    @Override\n    public void deleteGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting a group\");\n    }\n\n    protected boolean executeCheckPassword(final String userId, final String password) {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L105-L141","documentation":"LDAPIdentityServiceImpl.newGroup() throws FlowableException because groups, like users, are managed in the LDAP directory and cannot be created through the Flowable identity API. Group membership in Flowable with LDAP comes from directory groups (often mapped via group queries), not from locally created Group entities.","triggerScenarios":"Calling identityService.newGroup(groupId) while LDAP identity service is active; bootstrap code that seeds groups (e.g. creating 'management'/'sales' groups at startup); admin UI group creation.","commonSituations":"Apps migrating from DB identity service to LDAP; seeding demo data scripts; workflow assignment setup that assumed writable groups.","solutions":["Create the group in the LDAP directory (e.g. groupOfNames / posixGroup entry) and map it via LDAPConfiguration groupBaseDn/search settings.","Remove group-creation bootstrap code or make it conditional on a non-LDAP identity service.","For candidate-group assignments, use existing directory groups and configure queryGroupIdsMemberOf as needed.","If dynamic groups are required, keep a DB identity service and use LDAP only for user authentication."],"exampleFix":"// before\nGroup group = identityService.newGroup(\"management\");\nidentityService.saveGroup(group);\n// after\n// create the group in LDAP, then it is discoverable:\nList<Group> groups = identityService.createGroupQuery()\n    .groupId(\"management\")\n    .list();","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"Group creation must be done in the LDAP directory\");\n}\nGroup group = identityService.newGroup(groupId); // DB-backed identity service only","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    Group group = identityService.newGroup(groupId);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support creating a new group\")) {\n        // create the group entry in LDAP (groupOfNames) instead\n    }\n}","preventionTips":["Define candidate groups as directory entries and map them with LDAPConfiguration groupBaseDn.","Remove demo/bootstrap group seeding when switching to LDAP.","If dynamic groups are a requirement, do not use the LDAP identity service for group management."],"tags":["ldap","identity-service","groups","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}