{"record":{"id":"ced0b1ecc48ff3d3","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-deleting-an","errorCode":null,"errorMessage":"LDAP identity service doesn't support deleting an user","messagePattern":"LDAP identity service doesn't support deleting an user","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":118,"sourceCode":"\n    @Override\n    public User newUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new user\");\n    }\n\n    @Override\n    public void saveUser(User user) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving an user\");\n    }\n\n    @Override\n    public NativeUserQuery createNativeUserQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void saveGroup(Group group) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving a group\");\n    }\n\n    @Override","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L100-L136","documentation":"LDAPIdentityServiceImpl.deleteUser() throws FlowableException because user deletion is not supported against an LDAP directory. Flowable treats LDAP as read-only identity data; removing a user must be done in the directory itself.","triggerScenarios":"Calling identityService.deleteUser(userId) with the LDAP identity service active; cleanup/teardown code (e.g. test @After methods) that deletes users it created; account-offboarding logic routed through Flowable.","commonSituations":"Test suites that clean up fixtures via identityService; HR offboarding integrations; scripts that purge demo users at shutdown.","solutions":["Delete the user in the LDAP directory (ldapdelete or directory admin tooling).","Remove/guard deleteUser() calls when LDAP-backed; wrap in a config check.","For test cleanup, use a DB identity service for the tests that create/delete users, or clean the directory out-of-band.","If application-managed deletion is mandatory, implement a custom writable IdentityService backed by an LDAP write client."],"exampleFix":"// before\nidentityService.deleteUser(\"jdoe\");\n// after\n// delete in the directory instead:\n// ldapdelete -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \\\n//   uid=jdoe,ou=users,dc=flowable,dc=org","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"User deletion must be done in the LDAP directory\");\n}\nidentityService.deleteUser(userId); // DB-backed identity service only","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    identityService.deleteUser(userId);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support deleting an user\")) {\n        // trigger directory deletion via your LDAP admin API instead\n    }\n}","preventionTips":["Move user lifecycle (create/update/delete) fully into directory administration workflows.","Rework test teardown so it never deletes users through an LDAP-backed identity service.","Keep offboarding integrations outside the Flowable identity API when LDAP is configured."],"tags":["ldap","identity-service","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}