pentaho/pentaho-kettle · error · KettleException

AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC

AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC

Error message

AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC

What it means

getLocalizedLogicalRoles(runtimeRole, locale) throws ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC when the cached roleBindingStruct is null or its logicalRoleNameMap is null — i.e. initialize(locale) was never called successfully or the role-binding web service returned no mapping data, so logical role names cannot be translated to localized display names.

Solutions

Ensure initialize(locale) is called and completes successfully before invoking getLocalizedLogicalRoles.
Check whether an earlier initialize threw ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES and resolve that underlying web service failure first.
Verify the connected user can read the role binding structure (the map may be withheld for insufficient privileges).
Call initialize again to refresh the cached roleBindingStruct after fixing connectivity/permission issues.
Confirm server/client compatibility so RoleBindingStruct.logicalRoleNameMap is populated.

Defensive patterns

Strategy: validation

Validate before calling

// call initialize(locale) first and confirm success before calling getLocalizedLogicalRoles
securityManager.initialize(locale); // throws if the struct cannot be fetched

Try / catch

try { List<String> localized = securityManager.getLocalizedLogicalRoles(runtimeRole, locale); } catch (KettleException e) { if (e.getMessage().contains("ERROR_0003")) { securityManager.initialize(locale); /* retry once after refresh */ } else { throw e; } }

Prevention

Always call initialize(locale) immediately after obtaining the security manager
Treat an ERROR_0002/0005 from initialize as a signal to fix connectivity before other calls
Refresh roleBindingStruct (re-run initialize) after reconnecting to the server
Verify the user can read the role binding structure

When it happens

Trigger: Calling getLocalizedLogicalRoles before (or after a failed) initialize(locale); the role-binding web service returned an empty/null RoleBindingStruct; the logicalRoleNameMap field is null in the returned struct.

Common situations: Calling security-manager APIs out of order (getLocalizedLogicalRoles without initialize); initialize failed earlier with ERROR_0002/ERROR_0005 leaving roleBindingStruct null; server returned a struct without the localization map due to version or permission differences.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/315ac58daceebe01. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java:160

    }
    return roles;
  }

  @Override
  public IRole constructRole() throws KettleException {
    return new AbsRoleInfo();
  }

  public List<String> getLocalizedLogicalRoles( String runtimeRole, String locale ) throws KettleException {
    if ( authorizationPolicyRoleBindingService != null ) {
      List<String> localizedLogicalRoles = new ArrayList<String>();
      if ( roleBindingStruct != null && roleBindingStruct.logicalRoleNameMap != null ) {
        List<String> logicalRoles = getLogicalRoles( runtimeRole );
        for ( String logicalRole : logicalRoles ) {
          localizedLogicalRoles.add( roleBindingStruct.logicalRoleNameMap.get( logicalRole ) );
        }
      } else {
        throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,
            "AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC" ) ); //$NON-NLS-1$
      }
      return localizedLogicalRoles;
    } else {
      throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,
          "AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES" ) ); //$NON-NLS-1$
    }
  }

  public List<String> getLogicalRoles( String runtimeRole ) throws KettleException {
    if ( authorizationPolicyRoleBindingService != null ) {
      if ( roleBindingStruct != null && roleBindingStruct.bindingMap != null
          && roleBindingStruct.bindingMap.containsKey( runtimeRole ) ) {
        return roleBindingStruct.bindingMap.get( runtimeRole );
      }
      return null;
    } else {
      throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,

View on GitHub (pinned to f3058517a1)