flowable/flowable-engine · error · FlowableException

Null or empty passwords are not allowed!

Error message

Null or empty passwords are not allowed!

What it means

Flowable's LDAP identity service refuses to attempt an LDAP bind with a null or empty password. A blank bind would either fail or, worse, succeed as an anonymous bind on misconfigured servers, silently authenticating a user without a real password check. The library therefore fails fast with this FlowableException in executeCheckPassword before any LDAP communication.

Solutions

1. Ensure a non-empty password is supplied before calling checkPassword; validate the input at the application layer and reject empty logins early.
2. If the password comes from configuration or environment, fix the missing value (e.g. check ldap password property) and redeploy.
3. If the use case is genuinely anonymous/unauthenticated access, do not route it through checkPassword; implement the flow outside the LDAP identity service.

Example fix

// before
boolean ok = identityService.checkPassword(userId, request.getParameter("password"));

// after
String password = request.getParameter("password");
if (password == null || password.isEmpty()) {
    throw new BadRequestException("Password is required");
}
boolean ok = identityService.checkPassword(userId, password);

if (password == null || password.isEmpty()) { throw new IllegalArgumentException("password must be non-empty"); }

try { return identityService.checkPassword(userId, password); } catch (FlowableException e) { log.warn("LDAP password check failed", e); return false; }

When it happens

Trigger: Calling LDAPIdentityServiceImpl.checkPassword(userId, password) with a null or zero-length password string, typically when the password field of a login form was never filled or the credentials object was only partially populated.

Common situations: Login forms that submit empty password fields; code that reads passwords from a config/property file where the entry is missing; frameworks or custom code paths that pass null credentials for 'anonymous' or SSO-style flows into Flowable's identity check.

Related errors

• Could not create InitialDirContext for LDAP connection:
• Could not create InitialDirContext for LDAP connection
• Authentication failed for this username and password
• Authentication failed for this username and password
• Authentication failed for this username and password

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/a4a2ce2b4ed23352. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java:144

    @Override
    public NativeGroupQuery createNativeGroupQuery() {
        throw new FlowableException("LDAP identity service doesn't support native querying");
    }

    @Override
    public void saveGroup(Group group) {
        throw new FlowableException("LDAP identity service doesn't support saving a group");
    }

    @Override
    public void deleteGroup(String groupId) {
        throw new FlowableException("LDAP identity service doesn't support deleting a group");
    }

    protected boolean executeCheckPassword(final String userId, final String password) {
        // Extra password check, see http://forums.activiti.org/comment/22312
        if (password == null || password.length() == 0) {
            throw new FlowableException("Null or empty passwords are not allowed!");
        }

        try {
            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);
            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {

                @Override
                public Boolean executeInContext(InitialDirContext initialDirContext) {

                    if (initialDirContext == null) {
                        return false;
                    }

                    // Do the actual search for the user
                    String userDn = null;
                    try {

                        String searchExpression = ldapConfigurator.getLdapQueryBuilder().buildQueryByUserId(ldapConfigurator, userId);

View on GitHub (pinned to d6d39ce1c6)