flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support saving a group

Error message

LDAP identity service doesn't support saving a group

What it means

LDAPIdentityServiceImpl.saveGroup() throws FlowableException because persisting group changes through the Flowable identity API is unsupported: LDAP groups live in and are maintained by the directory. Any save on a Group object obtained (or fabricated) in an LDAP-backed deployment always throws.

Solutions

1. Modify the group in the LDAP directory; Flowable picks changes up on the next group query.
2. Remove saveGroup()/newGroup() calls from code paths used with LDAP.
3. If write-back is essential, use a custom IdentityService with an LDAP write client, or revert to DB identity service.
4. Gate identity-write logic behind a capability check (e.g. only when identity service is the DB implementation).

Example fix

// before
Group group = identityService.newGroup("management");
group.setName("Management Team");
identityService.saveGroup(group);
// after
// rename the entry in the directory; then read it back
Group group = identityService.createGroupQuery().groupId("management").singleResult();
// group.getName() comes from LDAP

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("Group updates must be done in the LDAP directory");
}
identityService.saveGroup(group); // DB-backed identity service only

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    identityService.saveGroup(group);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support saving a group")) {
        // apply the change to the LDAP entry via your directory admin client
    }
}

When it happens

Trigger: Calling identityService.saveGroup(group) with LDAP identity service active; typically paired with newGroup() in bootstrap or sync code; renaming/editing group metadata via Flowable.

Common situations: Group provisioning scripts migrated from DB identity service; admin tooling editing group names/descriptions; demo-data seeding at engine startup.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support creating a new group
• LDAP identity service doesn't support deleting a group
• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support deleting an user
• LDAP identity service doesn't support saving an user

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/8f17ef58687d469e. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:133

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void saveGroup(Group group) {
        throw new FlowableException("LDAP identity service doesn't support saving a group");
    }

    @Override
    public void deleteGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support deleting a group");
    }

    protected boolean executeCheckPassword(final String userId, final String password) {
        // Extra password check, see http://forums.activiti.org/comment/22312
        if (password == null || password.length() == 0) {
            throw new FlowableException("Null or empty passwords are not allowed!");
        }

        try {
            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);
            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {

                @Override

View on GitHub (pinned to d6d39ce1c6)