{"record":{"id":"ef218c863b861314","repo":"pentaho/pentaho-kettle","slug":"abssecuritymanager-error-0005-insufficient-priveleges","errorCode":"AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES","errorMessage":"AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES","messagePattern":"AbsSecurityManager\\.ERROR_0005_INSUFFICIENT_PRIVELEGES","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java","lineNumber":84,"sourceCode":"    } catch ( Exception e ) {\n      getLogger().error(\n          BaseMessages.getString( AbsSecurityManager.class,\n              \"AbsSecurityManager.ERROR_0001_UNABLE_TO_INITIALIZE_ROLE_BINDING_WEBSVC\" ), e ); //$NON-NLS-1$\n    }\n  }\n\n  public void initialize( String locale ) throws KettleException {\n    if ( authorizationPolicyRoleBindingService != null ) {\n      try {\n        roleBindingStruct = authorizationPolicyRoleBindingService.getRoleBindingStruct( locale );\n      } catch ( Exception e ) {\n        // The web service stub may be stale after a session timeout and reconnection\n        // (e.g. \"close method has already been invoked\"). Recreate the stub with fresh\n        // credentials from the repository and retry once.\n        roleBindingStruct = retryGetRoleBindingStruct( locale, e );\n      }\n    } else {\n      throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,\n          \"AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES\" ) ); //$NON-NLS-1$\n    }\n  }\n\n  /**\n   * Attempts to recreate the web service stub and retry the {@code getRoleBindingStruct} call.\n   * This handles the case where the original stub became stale after a session timeout and reconnection.\n   *\n   * @param locale the locale to pass to the service\n   * @param originalException the exception from the first attempt\n   * @return the {@link RoleBindingStruct} if the retry succeeds\n   * @throws KettleException if the retry also fails or the stub cannot be recreated\n   */\n  private RoleBindingStruct retryGetRoleBindingStruct( String locale, Exception originalException )\n      throws KettleException {\n    getLogger().info(\n        BaseMessages.getString( AbsSecurityManager.class,\n            ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES )","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java#L66-L102","documentation":"AbsSecurityManager.initialize() throws ERROR_0005_INSUFFICIENT_PRIVELEGES when the role-binding web service stub (authorizationPolicyRoleBindingService) is null. The stub is created in the constructor via createAuthorizationPolicyService(); a null stub means the service could not be created at all — typically because the user lacks the privileges to access the IRoleAuthorizationPolicyRoleBindingDaoWebService, or the service creation failed (logged as ERROR_0001). This error is misleadingly named: it fires whenever the security manager cannot reach the authorization policy web service, not just on privilege failures.","triggerScenarios":"Calling initialize(locale) (directly or via getSharedObjects, saveSharedObject, getSharedObject, delete, clear) when the web service stub was never created: createAuthorizationPolicyService threw an exception during construction, serviceManager.createService returned null, or the connected user lacks privileges to the role-binding web service.","commonSituations":"Connecting Pentaho PDI/Spoon to an EE repository with a user lacking security administration rights; wrong repository credentials; Pentaho server web services not reachable/misconfigured; the session was invalidated so stub creation fails silently and later calls hit this throw.","solutions":["Verify the repository user has the permissions required to call the role-based authorization policy web service (security administration rights).","Check the logs for AbsSecurityManager.ERROR_0001_UNABLE_TO_INITIALIZE_ROLE_BINDING_WEBSVC logged during construction to find the root cause of stub creation failure.","Confirm repositoryMetastore/server URL and credentials in the repository connection metadata are correct and the Pentaho server is reachable.","Reconnect/re-login to the repository to force a fresh AbsSecurityManager construction with valid credentials.","If running as administrator, confirm the Pentaho server's role-binding web service is deployed and enabled on the EE installation."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (securityManager != null && repository.getUserInfo() != null) { try { securityManager.initialize(locale); } catch (KettleException e) { /* handle */ } }","typeGuard":null,"tryCatchPattern":"try { securityManager.initialize(locale); } catch (KettleException e) { if (e.getMessage().contains(\"ERROR_0005_INSUFFICIENT_PRIVELEGES\")) { /* reconnect with a user that has security admin rights */ } else { throw e; } }","preventionTips":["Connect with a user that has Pentaho EE security administration privileges","Check logs for ERROR_0001 at construction time to catch stub creation failure early","Validate repository URL and credentials before creating the security manager","Re-create the repository connection after session timeouts instead of reusing old managers"],"tags":["pentaho","kettle","permissions","web-service"],"backgroundTag":"insufficient-permissions","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}