{"record":{"id":"2632c38d19ffbfac","repo":"pentaho/pentaho-kettle","slug":"error-0002-unable-to-get-logical-roles","errorCode":"ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES","errorMessage":"ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES","messagePattern":"ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java","lineNumber":111,"sourceCode":"   * @param locale the locale to pass to the service\n   * @param originalException the exception from the first attempt\n   * @return the {@link RoleBindingStruct} if the retry succeeds\n   * @throws KettleException if the retry also fails or the stub cannot be recreated\n   */\n  private RoleBindingStruct retryGetRoleBindingStruct( String locale, Exception originalException )\n      throws KettleException {\n    getLogger().info(\n        BaseMessages.getString( AbsSecurityManager.class,\n            ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES )\n            + \" - attempting to recreate web service stub and retry\" );\n    IUser currentUser = getRepository().getUserInfo();\n    if ( currentUser != null && serviceManager != null ) {\n      createAuthorizationPolicyService( currentUser );\n      if ( authorizationPolicyRoleBindingService != null ) {\n        try {\n          return authorizationPolicyRoleBindingService.getRoleBindingStruct( locale );\n        } catch ( Exception retryException ) {\n          throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,\n              ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES ), retryException );\n        }\n      }\n    }\n    throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,\n        ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES ), originalException );\n  }\n\n  @Override\n  public IRole getRole( String name ) throws KettleException {\n    IRole role = super.getRole( name );\n    if ( role instanceof IAbsRole ) {\n      List<String> logicalRoles = getLogicalRoles( role.getName() );\n      if ( logicalRoles != null && logicalRoles.size() > 0 ) {\n        ( (IAbsRole) role ).setLogicalRoles( logicalRoles );\n      }\n    }\n    return role;","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java#L93-L129","documentation":"retryGetRoleBindingStruct wraps any exception thrown by the retried getRoleBindingStruct(locale) call into a KettleException with message ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES, keeping the retry exception as cause. This means the first call failed (e.g. stale stub after session timeout), the stub was recreated, but the second attempt also failed — so the logical role mapping could not be fetched from the authorization policy web service.","triggerScenarios":"initialize(locale) -> first getRoleBindingStruct throws -> retryGetRoleBindingStruct recreates the stub -> second getRoleBindingStruct(locale) throws any Exception (network failure, HTTP error, server-side fault, serialization error).","commonSituations":"Pentaho server down or restarted mid-session; session timeout invalidated credentials; network/VPN drop; server returns a SOAP/HTTP fault because the user's session is no longer valid; server version incompatible with the client stub.","solutions":["Inspect the cause chain (KettleException.getCause()) for the real failure: HTTP status, SOAP fault, or socket error.","Verify the Pentaho server is running and the role-based authorization web service endpoint is reachable from the client.","Reconnect to the repository with fresh credentials (the embedded credentials in the stub may be stale/expired).","Check that the PDI client and Pentaho server versions are compatible (role-binding web service contract changes).","Retry later if this was a transient network issue; the manager already performs one automatic retry."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Before initialize: verify server reachability\nboolean reachable = java.net.InetAddress.getByName(serverHost).isReachable(5000);","typeGuard":null,"tryCatchPattern":"try { securityManager.initialize(locale); } catch (KettleException e) { Throwable cause = e.getCause(); log.error(\"getRoleBindingStruct failed after retry\", cause); /* reconnect to repository and retry once more, or fail fast */ }","preventionTips":["Monitor Pentaho server health before long-running operations","Keep client and server versions aligned","Handle session timeouts by reconnecting rather than reusing expired stubs","Inspect the exception cause chain to distinguish network vs auth failures"],"tags":["pentaho","kettle","web-service","session-timeout"],"backgroundTag":"api-error-response","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}