{"record":{"id":"8f17ef58687d469e","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-saving-a-gro","errorCode":null,"errorMessage":"LDAP identity service doesn't support saving a group","messagePattern":"LDAP identity service doesn't support saving a group","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":133,"sourceCode":"\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void saveGroup(Group group) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving a group\");\n    }\n\n    @Override\n    public void deleteGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting a group\");\n    }\n\n    protected boolean executeCheckPassword(final String userId, final String password) {\n        // Extra password check, see http://forums.activiti.org/comment/22312\n        if (password == null || password.length() == 0) {\n            throw new FlowableException(\"Null or empty passwords are not allowed!\");\n        }\n\n        try {\n            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);\n            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {\n\n                @Override","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L115-L151","documentation":"LDAPIdentityServiceImpl.saveGroup() throws FlowableException because persisting group changes through the Flowable identity API is unsupported: LDAP groups live in and are maintained by the directory. Any save on a Group object obtained (or fabricated) in an LDAP-backed deployment always throws.","triggerScenarios":"Calling identityService.saveGroup(group) with LDAP identity service active; typically paired with newGroup() in bootstrap or sync code; renaming/editing group metadata via Flowable.","commonSituations":"Group provisioning scripts migrated from DB identity service; admin tooling editing group names/descriptions; demo-data seeding at engine startup.","solutions":["Modify the group in the LDAP directory; Flowable picks changes up on the next group query.","Remove saveGroup()/newGroup() calls from code paths used with LDAP.","If write-back is essential, use a custom IdentityService with an LDAP write client, or revert to DB identity service.","Gate identity-write logic behind a capability check (e.g. only when identity service is the DB implementation)."],"exampleFix":"// before\nGroup group = identityService.newGroup(\"management\");\ngroup.setName(\"Management Team\");\nidentityService.saveGroup(group);\n// after\n// rename the entry in the directory; then read it back\nGroup group = identityService.createGroupQuery().groupId(\"management\").singleResult();\n// group.getName() comes from LDAP","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"Group updates must be done in the LDAP directory\");\n}\nidentityService.saveGroup(group); // DB-backed identity service only","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    identityService.saveGroup(group);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support saving a group\")) {\n        // apply the change to the LDAP entry via your directory admin client\n    }\n}","preventionTips":["Never call newGroup()+saveGroup() in code paths shared with LDAP deployments.","Perform group renames/metadata changes in the directory and verify with createGroupQuery().","Gate identity-write features by backend capability, detected once at startup."],"tags":["ldap","identity-service","groups","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}