{"record":{"id":"d751e6f74c8da119","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-saving-an-us","errorCode":null,"errorMessage":"LDAP identity service doesn't support saving an user","messagePattern":"LDAP identity service doesn't support saving an user","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":108,"sourceCode":"            if (privilegeMapping.getUserId() != null) {\n                User user = new UserEntityImpl();\n                user.setId(privilegeMapping.getUserId());\n                user.setLastName(privilegeMapping.getUserId());\n                users.add(user);\n            }\n        }\n        \n        return users;\n    }\n\n    @Override\n    public User newUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new user\");\n    }\n\n    @Override\n    public void saveUser(User user) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving an user\");\n    }\n\n    @Override\n    public NativeUserQuery createNativeUserQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override\n    public Group newGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new group\");\n    }\n\n    @Override","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L90-L126","documentation":"LDAPIdentityServiceImpl.saveUser() is an intentionally unsupported write operation. Because users are managed in the LDAP directory, persisting a User object through the Flowable identity API is impossible and always throws FlowableException. It typically follows a newUser() call in code written for the database identity service.","triggerScenarios":"Calling identityService.saveUser(user) with the LDAP identity service active; generic identity-sync code that does newUser()+saveUser(); admin tooling attempting to update user attributes.","commonSituations":"Onboarding/provisioning scripts ported from a DB-backed setup; shared service layer used with both DB and LDAP engines; attempt to update email/name of an LDAP user via Flowable.","solutions":["Update the user in the LDAP directory itself; Flowable will see the change on the next query.","Remove saveUser() calls (and the preceding newUser()) from code paths active under LDAP.","If profile updates are needed from the application, write them via an LDAP client (e.g. UnboundID/JNDI) outside Flowable, or use a custom IdentityService implementation.","Branch on configuration: only invoke saveUser when the default DB identity service is in use."],"exampleFix":"// before\nUser user = identityService.newUser(\"jdoe\");\nuser.setEmail(\"jdoe@example.com\");\nidentityService.saveUser(user);\n// after\n// update attributes in the directory; Flowable only reads\nUser user = identityService.createUserQuery().userId(\"jdoe\").singleResult();\n// user.getEmail() reflects what LDAP holds; no saveUser() possible","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"User updates must be done in the LDAP directory\");\n}\nidentityService.saveUser(user); // only for DB-backed identity service","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    identityService.saveUser(user);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support saving an user\")) {\n        // route the update to your LDAP write path (JNDI/UnboundID) instead\n    }\n}","preventionTips":["Do not pair newUser()+saveUser() in code shared with LDAP deployments.","Centralize profile edits in a directory-administration component, not in Flowable identity calls.","Add integration tests that exercise profile update under an LDAP identity service to catch this early."],"tags":["ldap","identity-service","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}