flowable/flowable-engine · critical · FlowableException

Could not find or create ${privilegeName} privilege

Error message

Could not find or create ${privilegeName} privilege

What it means

BootstrapConfiguration.initializePrivilege throws FlowableException when, after creating-or-fetching and one retry (to handle concurrent creation by another server node), the IDM privilege still cannot be found. This indicates the bootstrap default privilege (e.g. rest-api privilege) could not be provisioned, so the REST admin mapping cannot be established and startup fails.

Source

Thrown at modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/BootstrapConfiguration.java:130

        initializePrivilege(restAdminId, SecurityConstants.ACCESS_ADMIN);
    }

    protected void initializePrivilege(String restAdminId, String privilegeName) {
        boolean restApiPrivilegeMappingExists = false;
        Privilege privilege = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();
        if (privilege != null) {
            restApiPrivilegeMappingExists = restApiPrivilegeMappingExists(restAdminId, privilege);
        } else {
            try {
                privilege = idmIdentityService.createPrivilege(privilegeName);
            } catch (Exception e) {
                // Could be created by another server, retrying fetch
                privilege = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();
            }
        }
        
        if (privilege == null) {
            throw new FlowableException("Could not find or create " + privilegeName + " privilege");
        }
        
        if (!restApiPrivilegeMappingExists) {
            idmIdentityService.addUserPrivilegeMapping(privilege.getId(), restAdminId);
        }
    }

    protected boolean restApiPrivilegeMappingExists(String restAdminId, Privilege privilege) {
        return idmIdentityService.createPrivilegeQuery()
                .userId(restAdminId)
                .privilegeId(privilege.getId())
                .singleResult() != null;
    }
    
    protected void initDemoProcessDefinitions() {

        String deploymentName = "Demo processes";
        List<Deployment> deploymentList = repositoryService.createDeploymentQuery().deploymentName(deploymentName).list();

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Check the IDM database for an existing ACT_ID_PRIV row with the privilege name; create it manually if creation keeps failing
2. Verify the IDM engine can write (correct datasource, not read-only) and review logs for a swallowed exception during privilege creation
3. Restart bootstrap after fixing concurrency/DB issues — the retry assumes another node creates it
4. If upgrading, confirm expected default privilege names match your data (e.g. rest-api) and align configuration

Example fix

// before
privilege = idmIdentityService.createPrivilege(privilegeName); // failed silently, no tx commit
// after
Privilege p = idmIdentityService.createPrivilegeQuery().privilegeName(privilegeName).singleResult();
if (p == null) {
    p = idmIdentityService.createPrivilege(privilegeName); // ensure within a committed transaction
}

Privilege existing = idmIdentityService.createPrivilegeQuery().privilegeName("rest-api").singleResult();
if (existing == null) {
    // ensure IDM DB is writable before bootstrap
    logger.warn("Default privilege missing; bootstrap will attempt to create it");
}

try {
    runBootstrap(args);
} catch (FlowableException e) {
    if (e.getMessage().contains("Could not find or create")) {
        logger.error("Privilege bootstrap failed; check ACT_ID_PRIV table and IDM datasource", e);
    }
    throw e;
}

When it happens

Trigger: Calling initializeDefaultPrivileges during REST app bootstrap where createPrivilege(...).singleResult() and the retry fetch both return null — e.g. privilege creation silently failed or the IDM engine/DB is in an inconsistent state.

Common situations: Multi-node startup racing on privilege creation combined with a failed transaction; a read-only or misconfigured IDM database where the insert is not persisted; permission-name mismatches after version upgrades.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• Privilege name is null
• Provided privilege name already exists
• id is null
• name is null
• privilegeId is null

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/2bd351187e3f2397. Report an issue: GitHub.