flowable/flowable-engine · error · FlowableException

LDAP identity service doesn't support saving an user

Error message

LDAP identity service doesn't support saving an user

What it means

LDAPIdentityServiceImpl.saveUser() is an intentionally unsupported write operation. Because users are managed in the LDAP directory, persisting a User object through the Flowable identity API is impossible and always throws FlowableException. It typically follows a newUser() call in code written for the database identity service.

Solutions

1. Update the user in the LDAP directory itself; Flowable will see the change on the next query.
2. Remove saveUser() calls (and the preceding newUser()) from code paths active under LDAP.
3. If profile updates are needed from the application, write them via an LDAP client (e.g. UnboundID/JNDI) outside Flowable, or use a custom IdentityService implementation.
4. Branch on configuration: only invoke saveUser when the default DB identity service is in use.

Example fix

// before
User user = identityService.newUser("jdoe");
user.setEmail("jdoe@example.com");
identityService.saveUser(user);
// after
// update attributes in the directory; Flowable only reads
User user = identityService.createUserQuery().userId("jdoe").singleResult();
// user.getEmail() reflects what LDAP holds; no saveUser() possible

if (isLdapIdentityService(identityService)) {
    throw new UnsupportedOperationException("User updates must be done in the LDAP directory");
}
identityService.saveUser(user); // only for DB-backed identity service

boolean isLdapIdentityService(IdentityService s) {
    return s instanceof LDAPIdentityServiceImpl;
}

try {
    identityService.saveUser(user);
} catch (FlowableException e) {
    if (e.getMessage() != null && e.getMessage().contains("doesn't support saving an user")) {
        // route the update to your LDAP write path (JNDI/UnboundID) instead
    }
}

When it happens

Trigger: Calling identityService.saveUser(user) with the LDAP identity service active; generic identity-sync code that does newUser()+saveUser(); admin tooling attempting to update user attributes.

Common situations: Onboarding/provisioning scripts ported from a DB-backed setup; shared service layer used with both DB and LDAP engines; attempt to update email/name of an LDAP user via Flowable.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• LDAP identity service doesn't support creating a new user
• LDAP identity service doesn't support creating a new group
• LDAP identity service doesn't support deleting a group
• LDAP identity service doesn't support deleting an user
• LDAP identity service doesn't support saving a group

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/d751e6f74c8da119. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:108

            if (privilegeMapping.getUserId() != null) {
                User user = new UserEntityImpl();
                user.setId(privilegeMapping.getUserId());
                user.setLastName(privilegeMapping.getUserId());
                users.add(user);
            }
        }
        
        return users;
    }

    @Override
    public User newUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new user");
    }

    @Override
    public void saveUser(User user) {
        throw new FlowableException("LDAP identity service doesn't support saving an user");
    }

    @Override
    public NativeUserQuery createNativeUserQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void deleteUser(String userId) {
        throw new FlowableException("LDAP identity service doesn't support deleting an user");
    }

    @Override
    public Group newGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support creating a new group");
    }

    @Override

View on GitHub (pinned to d6d39ce1c6)