{"record":{"id":"e65428b12c011ab7","repo":"flowable/flowable-engine","slug":"trying-to-use-idm-identity-service-when-it-is-not","errorCode":null,"errorMessage":"Trying to use idm identity service when it is not initialized","messagePattern":"Trying to use idm identity service when it is not initialized","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-engine/src/main/java/org/flowable/engine/impl/IdentityServiceImpl.java","lineNumber":161,"sourceCode":"    @Override\n    public List<String> getUserInfoKeys(String userId) {\n        return getIdmIdentityService().getUserInfoKeys(userId);\n    }\n\n    @Override\n    public void setUserInfo(String userId, String key, String value) {\n        getIdmIdentityService().setUserInfo(userId, key, value);\n    }\n\n    @Override\n    public void deleteUserInfo(String userId, String key) {\n        getIdmIdentityService().deleteUserInfo(userId, key);\n    }\n    \n    protected IdmIdentityService getIdmIdentityService() {\n        IdmIdentityService idmIdentityService = EngineServiceUtil.getIdmIdentityService(configuration);\n        if (idmIdentityService == null) {\n            throw new FlowableException(\"Trying to use idm identity service when it is not initialized\");\n        }\n        return idmIdentityService;\n    }\n}\n","sourceCodeStart":143,"sourceCodeEnd":166,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-engine/src/main/java/org/flowable/engine/impl/IdentityServiceImpl.java#L143-L166","documentation":"Flowable throws this FlowableException from IdentityServiceImpl.getIdmIdentityService() when the IDM identity service has not been initialized in the engine configuration. The engine's IdentityService delegates user/group operations to the separate flowable-idm engine, which must be present and configured. All user/group operations (newGroup, newUser, saveGroup, saveUser, updateUserPassword, createUserQuery, etc.) go through this lookup.","triggerScenarios":"Using ProcessEngine.getIdentityService() user/group methods when the flowable-idm engine dependency is missing or the IDM engine was not built/started in the process engine configuration.","commonSituations":"Applications that removed the idm-engine dependency or disabled the IDM engine (e.g. standalone LDAP/AD setups) but still call identityService.newUser()/saveUser(); partial engine bootstrapping where only the process engine was started.","solutions":["Add the flowable-idm-engine dependency and let the default ProcessEngineConfiguration initialize the IDM engine","If IDM is intentionally disabled, avoid identityService user/group APIs and use the configured identity source (e.g. LDAP) directly","Check EngineServiceUtil.getIdmIdentityService(configuration) availability before calling identity operations"],"exampleFix":"// before\nidentityService.saveUser(identityService.newUser(\"kermit\"));\n// after\n// ensure idm engine is initialized first\nProcessEngineConfiguration cfg = ProcessEngineConfiguration\n    .createProcessEngineConfigurationFromResource(\"flowable.cfg.xml\");\nProcessEngine engine = cfg.buildProcessEngine();\nengine.getIdentityService().saveUser(engine.getIdentityService().newUser(\"kermit\"));","handlingStrategy":"validation","validationCode":"IdmIdentityService idm = EngineServiceUtil.getIdmIdentityService(processEngineConfiguration);\nif (idm == null) {\n    throw new IllegalStateException(\"IDM engine not initialized; user/group APIs unavailable\");\n}","typeGuard":"boolean isIdmAvailable(ProcessEngineConfiguration cfg) {\n    return EngineServiceUtil.getIdmIdentityService(cfg) != null;\n}","tryCatchPattern":"try {\n    identityService.saveUser(identityService.newUser(userId));\n} catch (FlowableException e) {\n    if (e.getMessage().contains(\"idm identity service\")) {\n        LOG.error(\"IDM engine is not configured; use your external identity provider instead\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Include flowable-idm-engine on the classpath when using identityService user/group APIs","Build the engine with default configuration so the IDM engine starts with it","If IDM is disabled intentionally, route user management through your LDAP/AD integration and avoid IdentityService user APIs"],"tags":["flowable","identity","idm","initialization","configuration"],"backgroundTag":"module-init-failed","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}