{"record":{"id":"feb17dda1616e2c8","repo":"flowable/flowable-engine","slug":"ldap-identity-service-doesn-t-support-creating-a-n","errorCode":null,"errorMessage":"LDAP identity service doesn't support creating a new user","messagePattern":"LDAP identity service doesn't support creating a new user","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":103,"sourceCode":"    @Override\n    public List<User> getUsersWithPrivilege(String name) {\n        List<User> users = new ArrayList<>();\n        List<PrivilegeMapping> privilegeMappings = getPrivilegeMappingsByPrivilegeId(name);\n        for (PrivilegeMapping privilegeMapping : privilegeMappings) {\n            if (privilegeMapping.getUserId() != null) {\n                User user = new UserEntityImpl();\n                user.setId(privilegeMapping.getUserId());\n                user.setLastName(privilegeMapping.getUserId());\n                users.add(user);\n            }\n        }\n        \n        return users;\n    }\n\n    @Override\n    public User newUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support creating a new user\");\n    }\n\n    @Override\n    public void saveUser(User user) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving an user\");\n    }\n\n    @Override\n    public NativeUserQuery createNativeUserQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void deleteUser(String userId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting an user\");\n    }\n\n    @Override","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L85-L121","documentation":"LDAPIdentityServiceImpl.newUser() is an intentionally unsupported operation. LDAP is a read-only source of identity for Flowable: users live in the directory and are queried, never created through the Flowable identity API. Calling newUser always throws FlowableException.","triggerScenarios":"Calling identityService.newUser(userId) while the engine uses the LDAP identity service (LDAPConfigurator installed). Also indirectly via APIs that create users, such as admin console user creation or identity bootstrap code written for the default in-memory/DB identity service.","commonSituations":"Migrating an app from the database identity service to LDAP without removing user-creation code; seeding default users at startup; tests that reuse fixtures which create users; admin UI writing back to LDAP-backed identity service.","solutions":["Create/manage the user directly in the LDAP directory (e.g. via ldapadd or your directory's admin tooling).","Remove or guard user-creation code paths when the LDAP identity service is active.","If write access to identity is required, switch back to the DB-based identity service and use LDAP only for authentication/authorization of queries, or implement a custom IdentityService.","In tests, replace LDAP-backed identity service fixtures with an in-memory identity service."],"exampleFix":"// before\nUser user = identityService.newUser(\"jdoe\");\nuser.setFirstName(\"John\");\nidentityService.saveUser(user);\n// after (LDAP is read-only: create the user in the directory instead)\n// ldapadd -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \\\n//   -f jdoe.ldif\nUser user = identityService.createUserQuery().userId(\"jdoe\").singleResult();\nif (user == null) {\n    throw new IllegalStateException(\"User jdoe must exist in LDAP first\");\n}","handlingStrategy":"validation","validationCode":"if (isLdapIdentityService(identityService)) {\n    throw new UnsupportedOperationException(\"User creation must be done in the LDAP directory\");\n}\nUser user = identityService.newUser(userId); // only reached for writable identity services","typeGuard":"boolean isLdapIdentityService(IdentityService s) {\n    return s instanceof LDAPIdentityServiceImpl;\n}","tryCatchPattern":"try {\n    User user = identityService.newUser(userId);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"doesn't support creating a new user\")) {\n        // provision the user in LDAP via your directory tooling instead\n    }\n}","preventionTips":["Treat LDAP-backed identity service as strictly read-only: never call newUser/saveUser/deleteUser on it.","Audit startup/bootstrap code for user seeding when switching to LDAP.","Extract identity-write code behind an interface and inject a no-op or directory-based implementation for LDAP deployments.","Document in team wiki that user lifecycle lives in the directory."],"tags":["ldap","identity-service","unsupported-operation","read-only"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}