{"record":{"id":"ac31828b6c481dd0","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-native-query","errorCode":null,"errorMessage":"LDAP identity service doesn't support native querying","messagePattern":"LDAP identity service doesn't support native querying","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":113,"sourceCode":"            }\n        }\n        \n        return users;\n    }\n\n    @Override\n    public User newUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new user\");\n    }\n\n    @Override\n    public void saveUser(User user) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving an user\");\n    }\n\n    @Override\n    public NativeUserQuery createNativeUserQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L95-L131","documentation":"LDAPIdentityServiceImpl.createNativeUserQuery() throws FlowableException because native (raw SQL) queries have no meaning against an LDAP directory — there is no relational user table to query. Native user queries only exist for the database-backed identity service.","triggerScenarios":"Calling identityService.createNativeUserQuery() while the LDAP identity service is installed; code shared between DB and LDAP deployments that uses native queries for complex user lookups.","commonSituations":"Reporting or admin screens that rely on native SQL user queries; performance-tuned lookups moved unchanged to an LDAP setup; copy-pasted repository/identity service code.","solutions":["Replace the native user query with LDAPUserQueryImpl-equivalent API: identityService.createUserQuery() with userId/memberOf/userIdLike filters.","For complex lookups, set LDAPConfiguration search fields (userBaseDn, userFullNameLike, queryGroupsForUser) to shape directory searches.","Keep native queries only in deployments using the DB identity service; branch on configuration.","If heavy relational querying is required, sync LDAP users into a local DB table and query that instead."],"exampleFix":"// before\nList<User> users = identityService.createNativeUserQuery()\n    .sql(\"SELECT * FROM ACT_ID_USER WHERE EMAIL_ LIKE ?\")\n    .parameter(\"%@example.com\").list();\n// after\nList<User> users = identityService.createUserQuery()\n    .userEmailLike(\"%@example.com\")\n    .list();","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    List<User> users = identityService.createUserQuery().userEmailLike(pattern).list();\n} else {\n    List<User> users = identityService.createNativeUserQuery()\n        .sql(\"SELECT * FROM ACT_ID_USER WHERE EMAIL_ LIKE ?\").parameter(pattern).list();\n}","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    return identityService.createNativeUserQuery().sql(sql).list();\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support native querying\")) {\n        return identityService.createUserQuery().userEmailLike(pattern).list(); // LDAP fallback\n    }\n    throw e;\n}","preventionTips":["Prefer the typed createUserQuery()/createGroupQuery() API — it works with both DB and LDAP backends.","Reserve native queries for DB-only reporting modules.","Configure LDAPConfiguration search filters so the typed query covers your lookup needs."],"tags":["ldap","identity-service","native-query","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}