flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support creating a new group

Error message

LDAP identity service doesn't support creating a new group

What it means

LDAPIdentityServiceImpl.newGroup() throws FlowableException because groups, like users, are managed in the LDAP directory and cannot be created through the Flowable identity API. Group membership in Flowable with LDAP comes from directory groups (often mapped via group queries), not from locally created Group entities.

Solutions

1. Create the group in the LDAP directory (e.g. groupOfNames / posixGroup entry) and map it via LDAPConfiguration groupBaseDn/search settings.
2. Remove group-creation bootstrap code or make it conditional on a non-LDAP identity service.
3. For candidate-group assignments, use existing directory groups and configure queryGroupIdsMemberOf as needed.
4. If dynamic groups are required, keep a DB identity service and use LDAP only for user authentication.

Example fix

// before
Group group = identityService.newGroup("management");
identityService.saveGroup(group);
// after
// create the group in LDAP, then it is discoverable:
List<Group> groups = identityService.createGroupQuery()
    .groupId("management")
    .list();

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("Group creation must be done in the LDAP directory");
}
Group group = identityService.newGroup(groupId); // DB-backed identity service only

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    Group group = identityService.newGroup(groupId);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support creating a new group")) {
        // create the group entry in LDAP (groupOfNames) instead
    }
}

When it happens

Trigger: Calling identityService.newGroup(groupId) while LDAP identity service is active; bootstrap code that seeds groups (e.g. creating 'management'/'sales' groups at startup); admin UI group creation.

Common situations: Apps migrating from DB identity service to LDAP; seeding demo data scripts; workflow assignment setup that assumed writable groups.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support deleting a group
• LDAP identity service doesn't support saving a group
• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support deleting an user
• LDAP identity service doesn't support saving an user

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/490738b6d882949f. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:123

    @Override
    public void saveUser(User user) {
        throw new FlowableException("LDAP identity service doesn't support saving an user");
    }

    @Override
    public NativeUserQuery createNativeUserQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void saveGroup(Group group) {
        throw new FlowableException("LDAP identity service doesn't support saving a group");
    }

    @Override
    public void deleteGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support deleting a group");
    }

    protected boolean executeCheckPassword(final String userId, final String password) {

View on GitHub (pinned to d6d39ce1c6)