flowable/flowable-engine · error · FlowableException

Could not find groups

Error message

Could not find groups 

What it means

LDAPGroupQueryImpl.executeInContext runs an LDAP search for groups and wraps any javax.naming.NamingException in a FlowableException prefixed with 'Could not find groups' plus the search expression used. It signals that the LDAP directory operation itself failed (connection, naming, or schema problems), not that zero groups matched.

Solutions

1. Inspect the wrapped NamingException cause to see the exact LDAP error (connection refused, invalid DN, no such object, etc.).
2. Verify ldapConfigurator settings: server URL/port, searchBase for groups, user/group attributes and the group query filter.
3. Test the same search with ldapsearch or an LDAP browser using the same bind credentials to isolate app vs directory issues.
4. Check network connectivity and firewall rules from the app host to the LDAP server.

Example fix

// before (config)
cfg.setGroupBase("ou=groupz,dc=example,dc=org"); // typo

// after
cfg.setGroupBase("ou=groups,dc=example,dc=org");

// pre-check connectivity
new InitialDirContext(env); // verify bind works before issuing queries

try { return identityService.createGroupQuery().list(); } catch (FlowableException e) { log.error("LDAP group query failed: " + e.getMessage(), e.getCause()); throw new LdapUnavailableException(e); }

When it happens

Trigger: Any GroupQuery execution against LDAP (findById, groupMember, etc.) where the underlying DirContext.search call throws NamingException — e.g. invalid search base, bad filter, or the LDAP server is unreachable.

Common situations: Wrong LDAP server URL or port in the configurator; searchBase pointing to a non-existent OU; credentials without rights to read the group tree; network/firewall changes between app and LDAP server; expired service account credentials.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• Could not close InitialDirContext correctly!
• Could not create InitialDirContext for LDAP connection:
• Could not create InitialDirContext for LDAP connection
• Could not send email: Incorrect JNDI configuration
• Exception while initializing Database connection

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/29c64b46d073af59. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/impl/LDAPGroupQueryImpl.java:131

                        GroupEntity group = new GroupEntityImpl();
                        if (ldapConfigurator.getGroupIdAttribute() != null) {
                            group.setId(result.getAttributes().get(ldapConfigurator.getGroupIdAttribute()).get().toString());
                        }
                        if (ldapConfigurator.getGroupNameAttribute() != null) {
                            group.setName(result.getAttributes().get(ldapConfigurator.getGroupNameAttribute()).get().toString());
                        }
                        if (ldapConfigurator.getGroupTypeAttribute() != null) {
                            group.setType(result.getAttributes().get(ldapConfigurator.getGroupTypeAttribute()).get().toString());
                        }
                        groups.add(group);
                    }

                    namingEnum.close();

                    return groups;

                } catch (NamingException e) {
                    throw new FlowableException("Could not find groups " + searchExpression, e);
                }
            }

        });
    }

    protected SearchControls createSearchControls() {
        SearchControls searchControls = new SearchControls();
        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
        searchControls.setTimeLimit(ldapConfigurator.getSearchTimeLimit());
        return searchControls;
    }
}

View on GitHub (pinned to d6d39ce1c6)