flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support creating a new user

Error message

LDAP identity service doesn't support creating a new user

What it means

LDAPIdentityServiceImpl.newUser() is an intentionally unsupported operation. LDAP is a read-only source of identity for Flowable: users live in the directory and are queried, never created through the Flowable identity API. Calling newUser always throws FlowableException.

Solutions

  1. Create/manage the user directly in the LDAP directory (e.g. via ldapadd or your directory's admin tooling).
  2. Remove or guard user-creation code paths when the LDAP identity service is active.
  3. If write access to identity is required, switch back to the DB-based identity service and use LDAP only for authentication/authorization of queries, or implement a custom IdentityService.
  4. In tests, replace LDAP-backed identity service fixtures with an in-memory identity service.

Example fix

// before
User user = identityService.newUser("jdoe");
user.setFirstName("John");
identityService.saveUser(user);
// after (LDAP is read-only: create the user in the directory instead)
// ldapadd -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \
//   -f jdoe.ldif
User user = identityService.createUserQuery().userId("jdoe").singleResult();
if (user == null) {
    throw new IllegalStateException("User jdoe must exist in LDAP first");
}
Defensive patterns

Strategy: validation

Validate before calling

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("User creation must be done in the LDAP directory");
}
User user = identityService.newUser(userId); // only reached for writable identity services

Type guard

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

Try / catch

try {
    User user = identityService.newUser(userId);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support creating a new user")) {
        // provision the user in LDAP via your directory tooling instead
    }
}

Prevention

When it happens

Trigger: Calling identityService.newUser(userId) while the engine uses the LDAP identity service (LDAPConfigurator installed). Also indirectly via APIs that create users, such as admin console user creation or identity bootstrap code written for the default in-memory/DB identity service.

Common situations: Migrating an app from the database identity service to LDAP without removing user-creation code; seeding default users at startup; tests that reuse fixtures which create users; admin UI writing back to LDAP-backed identity service.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/feb17dda1616e2c8. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:103

    @Override
    public List<User> getUsersWithPrivilege(String name) {
        List<User> users = new ArrayList<>();
        List<PrivilegeMapping> privilegeMappings = getPrivilegeMappingsByPrivilegeId(name);
        for (PrivilegeMapping privilegeMapping : privilegeMappings) {
            if (privilegeMapping.getUserId() != null) {
                User user = new UserEntityImpl();
                user.setId(privilegeMapping.getUserId());
                user.setLastName(privilegeMapping.getUserId());
                users.add(user);
            }
        }
        
        return users;
    }

    @Override
    public User newUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new user");
    }

    @Override
    public void saveUser(User user) {
        throw new FlowableException("LDAP identity service doesn't support saving an user");
    }

    @Override
    public NativeUserQuery createNativeUserQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override

View on GitHub (pinned to d6d39ce1c6)