flowable/flowable-engine · error · FlowableException

Trying to use idm identity service when it is not initialize

Error message

Trying to use idm identity service when it is not initialized

What it means

Flowable throws this FlowableException from IdentityServiceImpl.getIdmIdentityService() when the IDM identity service has not been initialized in the engine configuration. The engine's IdentityService delegates user/group operations to the separate flowable-idm engine, which must be present and configured. All user/group operations (newGroup, newUser, saveGroup, saveUser, updateUserPassword, createUserQuery, etc.) go through this lookup.

Source

Thrown at modules/flowable-engine/src/main/java/org/flowable/engine/impl/IdentityServiceImpl.java:161

    @Override
    public List<String> getUserInfoKeys(String userId) {
        return getIdmIdentityService().getUserInfoKeys(userId);
    }

    @Override
    public void setUserInfo(String userId, String key, String value) {
        getIdmIdentityService().setUserInfo(userId, key, value);
    }

    @Override
    public void deleteUserInfo(String userId, String key) {
        getIdmIdentityService().deleteUserInfo(userId, key);
    }
    
    protected IdmIdentityService getIdmIdentityService() {
        IdmIdentityService idmIdentityService = EngineServiceUtil.getIdmIdentityService(configuration);
        if (idmIdentityService == null) {
            throw new FlowableException("Trying to use idm identity service when it is not initialized");
        }
        return idmIdentityService;
    }
}

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Add the flowable-idm-engine dependency and let the default ProcessEngineConfiguration initialize the IDM engine
2. If IDM is intentionally disabled, avoid identityService user/group APIs and use the configured identity source (e.g. LDAP) directly
3. Check EngineServiceUtil.getIdmIdentityService(configuration) availability before calling identity operations

Example fix

// before
identityService.saveUser(identityService.newUser("kermit"));
// after
// ensure idm engine is initialized first
ProcessEngineConfiguration cfg = ProcessEngineConfiguration
    .createProcessEngineConfigurationFromResource("flowable.cfg.xml");
ProcessEngine engine = cfg.buildProcessEngine();
engine.getIdentityService().saveUser(engine.getIdentityService().newUser("kermit"));

IdmIdentityService idm = EngineServiceUtil.getIdmIdentityService(processEngineConfiguration);
if (idm == null) {
    throw new IllegalStateException("IDM engine not initialized; user/group APIs unavailable");
}

boolean isIdmAvailable(ProcessEngineConfiguration cfg) {
    return EngineServiceUtil.getIdmIdentityService(cfg) != null;
}

try {
    identityService.saveUser(identityService.newUser(userId));
} catch (FlowableException e) {
    if (e.getMessage().contains("idm identity service")) {
        LOG.error("IDM engine is not configured; use your external identity provider instead");
    } else {
        throw e;
    }
}

When it happens

Trigger: Using ProcessEngine.getIdentityService() user/group methods when the flowable-idm engine dependency is missing or the IDM engine was not built/started in the process engine configuration.

Common situations: Applications that removed the idm-engine dependency or disabled the IDM engine (e.g. standalone LDAP/AD setups) but still call identityService.newUser()/saveUser(); partial engine bootstrapping where only the process engine was started.

Related errors

• There is no engine configuration for scope ${engineScopeType
• Form engine is not initialized
• no org.flowable.app.engine.AppEngine defined in the applicat
• transactionManager is required property for SpringAppEngineC
• Could not find or create ${privilegeName} privilege

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/e65428b12c011ab7. Report an issue: GitHub.