pentaho/pentaho-kettle · error · KettleException

ERROR_0003_UNABLE_TO_DELETE_USERS

ERROR_0003_UNABLE_TO_DELETE_USERS

Error message

UserRoleDelegate.ERROR_0003_UNABLE_TO_DELETE_USERS

What it means

Thrown by UserRoleDelegate.deleteUsers when one or more users cannot be deleted through the Pentaho user-role web service. The delegate calls userRoleWebService.deleteUsers and wraps any resulting exception in a KettleException with message key ERROR_0003_UNABLE_TO_DELETE_USERS, appending the server's localized message. It indicates the remote Pentaho server refused or failed the batch delete.

Solutions

1. Check the wrapped cause (e.getLocalizedMessage()) to see the server's actual rejection reason.
2. Verify the connected user has the Administrator security role on the Pentaho server.
3. Unassign users from roles/permissions before deleting them.
4. Confirm connectivity and valid login to the Pentaho server (re-login to the repository).

Example fix

// before
userRoleDelegate.deleteUsers(users); // fails if users are assigned to roles
// after
for (IUser user : users) {
  ((IEEUser) user).setRoles(new ArrayList<IRole>());
  userRoleDelegate.updateUser(user); // unassign roles first
}
userRoleDelegate.deleteUsers(users);

boolean deletable = users.stream().allMatch(u -> {
  try { return userRoleDelegate.getUser(u.getLogin()) != null; }
  catch (KettleException e) { return false; }
});

try {
  userRoleDelegate.deleteUsers(users);
} catch (KettleException e) {
  log.error("Batch user delete failed: " + e.getCause().getLocalizedMessage(), e);
  // retry individually to isolate the offending user
  for (IUser u : users) { try { userRoleDelegate.deleteUser(u.getLogin()); } catch (KettleException ignored) {} }
}

When it happens

Trigger: Calling deleteUsers(List<IUser>) when the underlying userRoleWebService.deleteUsers(ProxyPentahoUser[]) throws: server unreachable, insufficient permissions to administer users (ensureHasPermissions passed but server-side admin role missing), a user in the batch is referenced by roles/lockers, or SOAP transport errors.

Common situations: Deleting users from a Pentaho Enterprise Repository via Spoon/kettle while the BI server rejects the deletion (user still assigned to roles, tenant restrictions, admin user deletion attempt), or network/auth failures between client and server (expired session, wrong security provider config).

Related errors

• ERROR_0007_UNABLE_TO_UPDATE_USER
• A deadlock was detected between steps
• AbsSecurityManager.ERROR_0003_UNABLE_TO_ACCESS_ROLE_BINDING_WEBSVC
• AbsSecurityManager.ERROR_0004_UNABLE_TO_APPLY_LOGICAL_ROLES_TO_RUNTIME_ROLE
• AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/ce5dcf2d3c304cae. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java:228

  private KettleException userExistsException() {
    return new KettleException( BaseMessages.getString( UserRoleDelegate.class,
        "UserRoleDelegate.ERROR_0015_USER_NAME_ALREADY_EXISTS" ) );
  }

  private KettleException cannotCreateUserException( IUser user, Exception e ) {
    return new KettleException( BaseMessages.getString( UserRoleDelegate.class,
        "UserRoleDelegate.ERROR_0002_UNABLE_TO_CREATE_USER", user.getName() ), e );
  }

  public void deleteUsers( List<IUser> users ) throws KettleException {
    ensureHasPermissions();

    try {
      userRoleWebService.deleteUsers( UserRoleHelper.convertToPentahoProxyUsers( users ) );
      lookupCache.removeUsersFromLookupSet( users );
      fireUserRoleListChange();
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0003_UNABLE_TO_DELETE_USERS", e.getLocalizedMessage() ), e ); //$NON-NLS-1$
    }
  }

  public void deleteUser( String name ) throws KettleException {
    ensureHasPermissions();

    try {
      ProxyPentahoUser user = userRoleWebService.getUser( name );
      if ( user != null ) {
        ProxyPentahoUser[] users = new ProxyPentahoUser[1];
        users[0] = user;
        userRoleWebService.deleteUsers( users );
        fireUserRoleListChange();
      } else {
        throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
            "UserRoleDelegate.ERROR_0004_UNABLE_TO_DELETE_USER", name ) ); //$NON-NLS-1$
      }

View on GitHub (pinned to f3058517a1)