CrowdService.updateUser(...) causes "Write operations are not allowed in read-only mode" error

Using the following in a custom authenticator in Confluence 3.5/4.0:

com.atlassian.crowd.embedded.api.User crowdUser = crowdService.getUser(user.getName());

ImmutableUser.Builder userBuilder = new ImmutableUser.Builder();
// clone the user before making mods
userBuilder.active(crowdUser.isActive());
userBuilder.directoryId(crowdUser.getDirectoryId());
userBuilder.displayName(crowdUser.getDisplayName());
userBuilder.emailAddress(crowdUser.getEmailAddress());
userBuilder.name(crowdUser.getName());

// ... only do the following if name/email is different
crowdService.updateUser(userBuilder.toUser());

in one customer environment sometimes produces the following error. Any ideas as to what might be wrong that we could relay to this customer, or is this a problem with our implementation?:

org.springframework.dao.InvalidDataAccessApiUsageException: Write operations are not allowed in read-only mode (FlushMode.NEVER): Turn your Session into FlushMode.AUTO or remove 'readOnly' marker from transaction definition.
at org.springframework.orm.hibernate.HibernateTemplate.checkWriteOperationAllowed(HibernateTemplate.java:1000)
at org.springframework.orm.hibernate.HibernateTemplate$11.doInHibernate(HibernateTemplate.java:590)
at org.springframework.orm.hibernate.HibernateTemplate.execute(HibernateTemplate.java:370)
at org.springframework.orm.hibernate.HibernateTemplate.update(HibernateTemplate.java:588)
at org.springframework.orm.hibernate.HibernateTemplate.update(HibernateTemplate.java:584)
at com.atlassian.crowd.embedded.hibernate2.HibernateUserDao.update(HibernateUserDao.java:225)
at com.atlassian.confluence.user.crowd.CachedCrowdUserDao.update(CachedCrowdUserDao.java:177)
at com.atlassian.crowd.directory.AbstractInternalDirectory.updateUser(AbstractInternalDirectory.java:396)
at com.atlassian.crowd.manager.directory.DirectoryManagerGeneric.updateUser(DirectoryManagerGeneric.java:352)
at com.atlassian.crowd.manager.application.ApplicationServiceGeneric.updateUser(ApplicationServiceGeneric.java:434)
at com.atlassian.crowd.embedded.core.CrowdServiceImpl.updateUser(CrowdServiceImpl.java:315)

Also posted as question here, but this seems like a bug. Even if the case is that the crowd repository is read-only, then it seems a more appropriate error would be generated. The goal is to have a custom authenticator in Confluence that is able to update user information in Crowd upon authentication via SSO.