{"record":{"id":"9281fc7845f20e9d","repo":"pentaho/pentaho-kettle","slug":"error-0009-unable-to-delete-roles","errorCode":"ERROR_0009_UNABLE_TO_DELETE_ROLES","errorMessage":"UserRoleDelegate.ERROR_0009_UNABLE_TO_DELETE_ROLES","messagePattern":"UserRoleDelegate\\.ERROR_0009_UNABLE_TO_DELETE_ROLES","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java","lineNumber":378,"sourceCode":"  private KettleException roleExistsException() {\n    return new KettleException( BaseMessages.getString( UserRoleDelegate.class,\n        \"UserRoleDelegate.ERROR_0016_ROLE_NAME_ALREADY_EXISTS\" ) );\n  }\n\n  private KettleException cannotCreateRoleException( IRole role, Exception e ) {\n    return new KettleException( BaseMessages.getString( UserRoleDelegate.class,\n        \"UserRoleDelegate.ERROR_0008_UNABLE_TO_CREATE_ROLE\", role.getName() ), e );\n  }\n\n  public void deleteRoles( List<IRole> roles ) throws KettleException {\n    ensureHasPermissions();\n\n    try {\n      userRoleWebService.deleteRoles( UserRoleHelper.convertToPentahoProxyRoles( roles ) );\n      lookupCache.removeRolesFromLookupSet( roles );\n      fireUserRoleListChange();\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,\n          \"UserRoleDelegate.ERROR_0009_UNABLE_TO_DELETE_ROLES\" ), e ); //$NON-NLS-1$\n    }\n  }\n\n  public IRole getRole( String name ) throws KettleException {\n    ensureHasPermissions();\n\n    try {\n      return UserRoleHelper.convertFromProxyPentahoRole( userRoleWebService, UserRoleHelper.getProxyPentahoRole(\n          userRoleWebService, name ), lookupCache, rsm );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,\n          \"UserRoleDelegate.ERROR_0010_UNABLE_TO_GET_ROLE\", name ), e ); //$NON-NLS-1$\n    }\n  }\n\n  public List<IRole> getRoles() throws KettleException {\n    try {","sourceCodeStart":360,"sourceCodeEnd":396,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java#L360-L396","documentation":"Thrown by UserRoleDelegate.deleteRoles(List<IRole>) when the role deletion fails through userRoleWebService.deleteRoles. The exception is wrapped in a KettleException with ERROR_0009_UNABLE_TO_DELETE_ROLES (no parameter). After a successful remote delete the local lookup cache is updated and the role list change event is fired — those never run on failure.","triggerScenarios":"Calling deleteRoles(roles) when the web service throws: server refuses deletion (role still bound to users/permissions, system role), insufficient admin permissions, transport failure, or expired session.","commonSituations":"Deleting default/system Pentaho roles (Admin, Authenticated) that the server protects; cleanup scripts hitting roles still assigned to users; security provider (LDAP) roles that are not server-manageable.","solutions":["Inspect the wrapped cause for the server rejection reason.","Remove all user assignments from the roles before deleting.","Do not attempt to delete protected/system or LDAP-provided roles.","Ensure the client user has Administrator security permissions."],"exampleFix":"// before\nuserRoleDelegate.deleteRoles(roles); // fails if roles still assigned\n// after\nfor (IRole role : roles) {\n  ((IEERole) role).setUsers(new ArrayList<IUser>());\n  userRoleDelegate.updateRole(role); // unbind users first\n}\nuserRoleDelegate.deleteRoles(roles);","handlingStrategy":"try-catch","validationCode":"List<String> protectedRoles = Arrays.asList(\"Admin\", \"Authenticated\");\nboolean safe = roles.stream().noneMatch(r -> protectedRoles.contains(r.getName()));\nif (!safe) throw new IllegalArgumentException(\"Refusing to delete protected/system roles\");","typeGuard":null,"tryCatchPattern":"try {\n  userRoleDelegate.deleteRoles(roles);\n} catch (KettleException e) {\n  log.error(\"Role delete failed: \" + e.getCause(), e);\n  // retry per-role to isolate failures\n  for (IRole r : roles) { try { userRoleDelegate.deleteRole(r.getName()); } catch (KettleException ignored) {} }\n}","preventionTips":["Unassign users from roles before deleting.","Never delete system roles (Admin, Authenticated).","Skip LDAP-provided roles not managed by the server.","Verify admin permissions first."],"tags":["pentaho","role-management","webservice"],"backgroundTag":"api-error-response","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}