What causes "AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES" in pentaho/pentaho-kettle?

Verify the repository user has the permissions required to call the role-based authorization policy web service (security administration rights).

pentaho/pentaho-kettle · error · KettleException

AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES

AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES

Error message

AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES

What it means

AbsSecurityManager.initialize() throws ERROR_0005_INSUFFICIENT_PRIVELEGES when the role-binding web service stub (authorizationPolicyRoleBindingService) is null. The stub is created in the constructor via createAuthorizationPolicyService(); a null stub means the service could not be created at all — typically because the user lacks the privileges to access the IRoleAuthorizationPolicyRoleBindingDaoWebService, or the service creation failed (logged as ERROR_0001). This error is misleadingly named: it fires whenever the security manager cannot reach the authorization policy web service, not just on privilege failures.

Solutions

Verify the repository user has the permissions required to call the role-based authorization policy web service (security administration rights).
Check the logs for AbsSecurityManager.ERROR_0001_UNABLE_TO_INITIALIZE_ROLE_BINDING_WEBSVC logged during construction to find the root cause of stub creation failure.
Confirm repositoryMetastore/server URL and credentials in the repository connection metadata are correct and the Pentaho server is reachable.
Reconnect/re-login to the repository to force a fresh AbsSecurityManager construction with valid credentials.
If running as administrator, confirm the Pentaho server's role-binding web service is deployed and enabled on the EE installation.

Defensive patterns

Strategy: try-catch

Validate before calling

if (securityManager != null && repository.getUserInfo() != null) { try { securityManager.initialize(locale); } catch (KettleException e) { /* handle */ } }

Try / catch

try { securityManager.initialize(locale); } catch (KettleException e) { if (e.getMessage().contains("ERROR_0005_INSUFFICIENT_PRIVELEGES")) { /* reconnect with a user that has security admin rights */ } else { throw e; } }

Prevention

Connect with a user that has Pentaho EE security administration privileges
Check logs for ERROR_0001 at construction time to catch stub creation failure early
Validate repository URL and credentials before creating the security manager
Re-create the repository connection after session timeouts instead of reusing old managers

When it happens

Trigger: Calling initialize(locale) (directly or via getSharedObjects, saveSharedObject, getSharedObject, delete, clear) when the web service stub was never created: createAuthorizationPolicyService threw an exception during construction, serviceManager.createService returned null, or the connected user lacks privileges to the role-binding web service.

Common situations: Connecting Pentaho PDI/Spoon to an EE repository with a user lacking security administration rights; wrong repository credentials; Pentaho server web services not reachable/misconfigured; the session was invalidated so stub creation fails silently and later calls hit this throw.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/ef218c863b861314. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java:84

    } catch ( Exception e ) {
      getLogger().error(
          BaseMessages.getString( AbsSecurityManager.class,
              "AbsSecurityManager.ERROR_0001_UNABLE_TO_INITIALIZE_ROLE_BINDING_WEBSVC" ), e ); //$NON-NLS-1$
    }
  }

  public void initialize( String locale ) throws KettleException {
    if ( authorizationPolicyRoleBindingService != null ) {
      try {
        roleBindingStruct = authorizationPolicyRoleBindingService.getRoleBindingStruct( locale );
      } catch ( Exception e ) {
        // The web service stub may be stale after a session timeout and reconnection
        // (e.g. "close method has already been invoked"). Recreate the stub with fresh
        // credentials from the repository and retry once.
        roleBindingStruct = retryGetRoleBindingStruct( locale, e );
      }
    } else {
      throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,
          "AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES" ) ); //$NON-NLS-1$
    }
  }

  /**
   * Attempts to recreate the web service stub and retry the {@code getRoleBindingStruct} call.
   * This handles the case where the original stub became stale after a session timeout and reconnection.
   *
   * @param locale the locale to pass to the service
   * @param originalException the exception from the first attempt
   * @return the {@link RoleBindingStruct} if the retry succeeds
   * @throws KettleException if the retry also fails or the stub cannot be recreated
   */
  private RoleBindingStruct retryGetRoleBindingStruct( String locale, Exception originalException )
      throws KettleException {
    getLogger().info(
        BaseMessages.getString( AbsSecurityManager.class,
            ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES )

View on GitHub (pinned to f3058517a1)