pentaho/pentaho-kettle · error · KettleException

ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES

ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES

Error message

ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES

What it means

retryGetRoleBindingStruct wraps any exception thrown by the retried getRoleBindingStruct(locale) call into a KettleException with message ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES, keeping the retry exception as cause. This means the first call failed (e.g. stale stub after session timeout), the stub was recreated, but the second attempt also failed — so the logical role mapping could not be fetched from the authorization policy web service.

Solutions

1. Inspect the cause chain (KettleException.getCause()) for the real failure: HTTP status, SOAP fault, or socket error.
2. Verify the Pentaho server is running and the role-based authorization web service endpoint is reachable from the client.
3. Reconnect to the repository with fresh credentials (the embedded credentials in the stub may be stale/expired).
4. Check that the PDI client and Pentaho server versions are compatible (role-binding web service contract changes).
5. Retry later if this was a transient network issue; the manager already performs one automatic retry.

// Before initialize: verify server reachability
boolean reachable = java.net.InetAddress.getByName(serverHost).isReachable(5000);

try { securityManager.initialize(locale); } catch (KettleException e) { Throwable cause = e.getCause(); log.error("getRoleBindingStruct failed after retry", cause); /* reconnect to repository and retry once more, or fail fast */ }

When it happens

Trigger: initialize(locale) -> first getRoleBindingStruct throws -> retryGetRoleBindingStruct recreates the stub -> second getRoleBindingStruct(locale) throws any Exception (network failure, HTTP error, server-side fault, serialization error).

Common situations: Pentaho server down or restarted mid-session; session timeout invalidated credentials; network/VPN drop; server returns a SOAP/HTTP fault because the user's session is no longer valid; server version incompatible with the client stub.

Related errors

• AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC
• AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES
• ERROR_0012_UNABLE_TO_UPDATE_ROLE
• ERROR_0013_UNABLE_TO_DELETE_ROLE
• PurRepository.FailedLogin.Message

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/2632c38d19ffbfac. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityManager.java:111

   * @param locale the locale to pass to the service
   * @param originalException the exception from the first attempt
   * @return the {@link RoleBindingStruct} if the retry succeeds
   * @throws KettleException if the retry also fails or the stub cannot be recreated
   */
  private RoleBindingStruct retryGetRoleBindingStruct( String locale, Exception originalException )
      throws KettleException {
    getLogger().info(
        BaseMessages.getString( AbsSecurityManager.class,
            ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES )
            + " - attempting to recreate web service stub and retry" );
    IUser currentUser = getRepository().getUserInfo();
    if ( currentUser != null && serviceManager != null ) {
      createAuthorizationPolicyService( currentUser );
      if ( authorizationPolicyRoleBindingService != null ) {
        try {
          return authorizationPolicyRoleBindingService.getRoleBindingStruct( locale );
        } catch ( Exception retryException ) {
          throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,
              ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES ), retryException );
        }
      }
    }
    throw new KettleException( BaseMessages.getString( AbsSecurityManager.class,
        ERROR_0002_UNABLE_TO_GET_LOGICAL_ROLES ), originalException );
  }

  @Override
  public IRole getRole( String name ) throws KettleException {
    IRole role = super.getRole( name );
    if ( role instanceof IAbsRole ) {
      List<String> logicalRoles = getLogicalRoles( role.getName() );
      if ( logicalRoles != null && logicalRoles.size() > 0 ) {
        ( (IAbsRole) role ).setLogicalRoles( logicalRoles );
      }
    }
    return role;

View on GitHub (pinned to f3058517a1)