flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support deleting a group

Error message

LDAP identity service doesn't support deleting a group

What it means

LDAPIdentityServiceImpl.deleteGroup() throws FlowableException because deleting groups is not supported through the Flowable identity API when backed by LDAP. Groups must be removed from the directory itself; Flowable only reads them.

Solutions

1. Delete the group entry in the LDAP directory (ldapdelete or directory admin tooling).
2. Remove or guard deleteGroup() calls when running with LDAP identity service.
3. For test cleanup, clean the directory out-of-band or run those tests against the DB identity service.
4. If deletion must be app-driven, implement a custom IdentityService with LDAP delete support.

Example fix

// before
identityService.deleteGroup("management");
// after
// remove the entry from the directory instead:
// ldapdelete -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \
//   cn=management,ou=groups,dc=flowable,dc=org

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("Group deletion must be done in the LDAP directory");
}
identityService.deleteGroup(groupId); // DB-backed identity service only

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    identityService.deleteGroup(groupId);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support deleting a group")) {
        // delete the LDAP group entry via directory tooling instead
    }
}

When it happens

Trigger: Calling identityService.deleteGroup(groupId) with the LDAP identity service installed; cleanup code that deletes groups created during tests or bootstrap.

Common situations: Test teardown routines; group offboarding/retirement scripts ported from a DB setup; admin UI delete action against an LDAP-backed identity service.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support creating a new group
• LDAP identity service doesn't support saving a group
• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support deleting an user
• LDAP identity service doesn't support saving an user

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/8c5012d987c15523. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:138

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void saveGroup(Group group) {
        throw new FlowableException("LDAP identity service doesn't support saving a group");
    }

    @Override
    public void deleteGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support deleting a group");
    }

    protected boolean executeCheckPassword(final String userId, final String password) {
        // Extra password check, see http://forums.activiti.org/comment/22312
        if (password == null || password.length() == 0) {
            throw new FlowableException("Null or empty passwords are not allowed!");
        }

        try {
            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);
            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {

                @Override
                public Boolean executeInContext(InitialDirContext initialDirContext) {

                    if (initialDirContext == null) {
                        return false;
                    }

View on GitHub (pinned to d6d39ce1c6)