flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support native querying

Error message

LDAP identity service doesn't support native querying

What it means

LDAPIdentityServiceImpl.createNativeUserQuery() throws FlowableException because native (raw SQL) queries have no meaning against an LDAP directory — there is no relational user table to query. Native user queries only exist for the database-backed identity service.

Solutions

1. Replace the native user query with LDAPUserQueryImpl-equivalent API: identityService.createUserQuery() with userId/memberOf/userIdLike filters.
2. For complex lookups, set LDAPConfiguration search fields (userBaseDn, userFullNameLike, queryGroupsForUser) to shape directory searches.
3. Keep native queries only in deployments using the DB identity service; branch on configuration.
4. If heavy relational querying is required, sync LDAP users into a local DB table and query that instead.

Example fix

// before
List<User> users = identityService.createNativeUserQuery()
    .sql("SELECT * FROM ACT_ID_USER WHERE EMAIL_ LIKE ?")
    .parameter("%@example.com").list();
// after
List<User> users = identityService.createUserQuery()
    .userEmailLike("%@example.com")
    .list();

if (isLdapIdentityService(identityService)) {
    List<User> users = identityService.createUserQuery().userEmailLike(pattern).list();
} else {
    List<User> users = identityService.createNativeUserQuery()
        .sql("SELECT * FROM ACT_ID_USER WHERE EMAIL_ LIKE ?").parameter(pattern).list();
}

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    return identityService.createNativeUserQuery().sql(sql).list();
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support native querying")) {
        return identityService.createUserQuery().userEmailLike(pattern).list(); // LDAP fallback
    }
    throw e;
}

When it happens

Trigger: Calling identityService.createNativeUserQuery() while the LDAP identity service is installed; code shared between DB and LDAP deployments that uses native queries for complex user lookups.

Common situations: Reporting or admin screens that rely on native SQL user queries; performance-tuned lookups moved unchanged to an LDAP setup; copy-pasted repository/identity service code.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support creating a new group
• LDAP identity service doesn't support deleting a group
• LDAP identity service doesn't support deleting an user
• LDAP identity service doesn't support saving a group

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/ac31828b6c481dd0. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:113

            }
        }
        
        return users;
    }

    @Override
    public User newUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new user");
    }

    @Override
    public void saveUser(User user) {
        throw new FlowableException("LDAP identity service doesn't support saving an user");
    }

    @Override
    public NativeUserQuery createNativeUserQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override

View on GitHub (pinned to d6d39ce1c6)