flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support deleting an user

Error message

LDAP identity service doesn't support deleting an user

What it means

LDAPIdentityServiceImpl.deleteUser() throws FlowableException because user deletion is not supported against an LDAP directory. Flowable treats LDAP as read-only identity data; removing a user must be done in the directory itself.

Solutions

1. Delete the user in the LDAP directory (ldapdelete or directory admin tooling).
2. Remove/guard deleteUser() calls when LDAP-backed; wrap in a config check.
3. For test cleanup, use a DB identity service for the tests that create/delete users, or clean the directory out-of-band.
4. If application-managed deletion is mandatory, implement a custom writable IdentityService backed by an LDAP write client.

Example fix

// before
identityService.deleteUser("jdoe");
// after
// delete in the directory instead:
// ldapdelete -x -H ldap://localhost:389 -D cn=admin,dc=flowable,dc=org -w secret \
//   uid=jdoe,ou=users,dc=flowable,dc=org

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("User deletion must be done in the LDAP directory");
}
identityService.deleteUser(userId); // DB-backed identity service only

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    identityService.deleteUser(userId);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support deleting an user")) {
        // trigger directory deletion via your LDAP admin API instead
    }
}

When it happens

Trigger: Calling identityService.deleteUser(userId) with the LDAP identity service active; cleanup/teardown code (e.g. test @After methods) that deletes users it created; account-offboarding logic routed through Flowable.

Common situations: Test suites that clean up fixtures via identityService; HR offboarding integrations; scripts that purge demo users at shutdown.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support creating a new group
• LDAP identity service doesn't support deleting a group
• LDAP identity service doesn't support saving a group
• LDAP identity service doesn't support saving an user

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/ced0b1ecc48ff3d3. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:118

    @Override
    public User newUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new user");
    }

    @Override
    public void saveUser(User user) {
        throw new FlowableException("LDAP identity service doesn't support saving an user");
    }

    @Override
    public NativeUserQuery createNativeUserQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void saveGroup(Group group) {
        throw new FlowableException("LDAP identity service doesn't support saving a group");
    }

    @Override

View on GitHub (pinned to d6d39ce1c6)