{"record":{"id":"8c5012d987c15523","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-deleting-a-g","errorCode":null,"errorMessage":"LDAP identity service doesn't support deleting a group","messagePattern":"LDAP identity service doesn't support deleting a group","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":138,"sourceCode":"\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void saveGroup(Group group) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving a group\");\n    }\n\n    @Override\n    public void deleteGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting a group\");\n    }\n\n    protected boolean executeCheckPassword(final String userId, final String password) {\n        // Extra password check, see http://forums.activiti.org/comment/22312\n        if (password == null || password.length() == 0) {\n            throw new FlowableException(\"Null or empty passwords are not allowed!\");\n        }\n\n        try {\n            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);\n            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {\n\n                @Override\n                public Boolean executeInContext(InitialDirContext initialDirContext) {\n\n                    if (initialDirContext == null) {\n                        return false;\n                    }","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L120-L156","documentation":"LDAPIdentityServiceImpl.deleteGroup() throws FlowableException because deleting groups is not supported through the Flowable identity API when backed by LDAP. Groups must be removed from the directory itself; Flowable only reads them.","triggerScenarios":"Calling identityService.deleteGroup(groupId) with the LDAP identity service installed; cleanup code that deletes groups created during tests or bootstrap.","commonSituations":"Test teardown routines; group offboarding/retirement scripts ported from a DB setup; admin UI delete action against an LDAP-backed identity service.","solutions":["Delete the group entry in the LDAP directory (ldapdelete or directory admin tooling).","Remove or guard deleteGroup() calls when running with LDAP identity service.","For test cleanup, clean the directory out-of-band or run those tests against the DB identity service.","If deletion must be app-driven, implement a custom IdentityService with LDAP delete support."],"exampleFix":"// before\nidentityService.deleteGroup(\"management\");\n// after\n// remove the entry from the directory instead:\n// ldapdelete -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \\\n//   cn=management,ou=groups,dc=flowable,dc=org","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"Group deletion must be done in the LDAP directory\");\n}\nidentityService.deleteGroup(groupId); // DB-backed identity service only","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    identityService.deleteGroup(groupId);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support deleting a group\")) {\n        // delete the LDAP group entry via directory tooling instead\n    }\n}","preventionTips":["Handle group retirement in directory administration, not via Flowable identity API.","Adjust test teardown to avoid identityService.deleteGroup under LDAP.","Document the read-only nature of the LDAP identity service in your deployment runbook."],"tags":["ldap","identity-service","groups","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}