{"record":{"id":"91e3e2c968765f0a","repo":"pentaho/pentaho-kettle","slug":"error-0014-insufficient-privileges","errorCode":"ERROR_0014_INSUFFICIENT_PRIVILEGES","errorMessage":"UserRoleDelegate.ERROR_0014_INSUFFICIENT_PRIVILEGES","messagePattern":"UserRoleDelegate\\.ERROR_0014_INSUFFICIENT_PRIVILEGES","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java","lineNumber":163,"sourceCode":"\n  public void updateUserRoleInfo() throws UserRoleException {\n    if ( isManaged() ) {\n      userRoleSecurityInfo = userRoleWebService.getUserRoleSecurityInfo();\n      lookupCache = new UserRoleLookupCache( userRoleSecurityInfo, rsm );\n      hasNecessaryPermissions = true;\n    } else {\n      userRoleInfo = userDetailsRoleListWebService.getUserRoleInfo();\n      hasNecessaryPermissions = false;\n    }\n  }\n\n  public boolean isManaged() {\n    return managed;\n  }\n\n  private void ensureHasPermissions() throws KettleException {\n    if ( !hasNecessaryPermissions ) {\n      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,\n          \"UserRoleDelegate.ERROR_0014_INSUFFICIENT_PRIVILEGES\" ) ); //$NON-NLS-1$\n    }\n  }\n\n  public void createUser( IUser newUser ) throws KettleException {\n    ensureHasPermissions();\n\n    ProxyPentahoUser user = UserRoleHelper.convertToPentahoProxyUser( newUser );\n    try {\n      ProxyPentahoUser[] existingUsers = userRoleWebService.getUsers();\n      if ( existsAmong( existingUsers, user ) ) {\n        throw userExistsException();\n      }\n    } catch ( UserRoleException e ) {\n      throw cannotCreateUserException( newUser, e );\n    }\n\n    try {","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java#L145-L181","documentation":"UserRoleDelegate.ensureHasPermissions throws this KettleException when the security delegate's hasNecessaryPermissions flag is false, i.e., the connected user lacks the admin-level security permissions required to manage users and roles. It is a client-side pre-check before issuing server calls for user/role management.","triggerScenarios":"Calling createUser, deleteUser(s), getUser, updateUser, or createRole while connected to the PUR repository as a user without the necessary security permissions (e.g., not an administrator).","commonSituations":"Running scheduled jobs or integrations under a service account without admin rights, connecting as a regular business user and attempting user administration, or a tenant where security management is not available to the current role.","solutions":["Connect to the repository with an administrator account before performing user/role operations.","Grant the necessary security permissions to the account used (Administer security / manage users and roles).","Check hasPermission support: verify repository capabilities and whether security is managed by the repository vs. an external provider.","Restructure the code so user management is done via the appropriate admin service rather than the delegate."],"exampleFix":"// before\ndelectate.createUser( newUser ); // throws ERROR_0014 if lacking permissions\n// after\nif ( delegate.isManaged() && hasAdminRole( currentUser ) ) {\n  delegate.createUser( newUser );\n} else {\n  throw new KettleException( \"User management requires an administrator connection\" );\n}","handlingStrategy":"validation","validationCode":"boolean canManageUsers( UserRoleDelegate d ) {\n  try { d.getUser( testUserName ); return true; } catch ( KettleException e ) { return false; }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use an administrator account for user/role administration","Verify the account has 'Administer security' permissions before automating user tasks","Check repository security capabilities before invoking the delegate","Never run scheduled integrations that manage users with non-admin service accounts"],"tags":["permissions","security","user-management","pentaho-kettle"],"backgroundTag":"insufficient-permissions","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}