What causes "UserRoleDelegate.ERROR_0007_UNABLE_TO_UPDATE_USER" in pentaho/pentaho-kettle?

Inspect the cause for the server's rejection message.

pentaho/pentaho-kettle · error · KettleException

ERROR_0007_UNABLE_TO_UPDATE_USER

ERROR_0007_UNABLE_TO_UPDATE_USER

Error message

UserRoleDelegate.ERROR_0007_UNABLE_TO_UPDATE_USER

What it means

Thrown by UserRoleDelegate.updateUser(IUser) when persisting changes to a user fails via userRoleWebService (updateUsers or setRoles). The original exception is wrapped in a KettleException with ERROR_0007_UNABLE_TO_UPDATE_USER and the user's login name. Calls to ensureHasPermissions() precede it, so permission issues on the client side throw a different error; this one wraps server-side update failures.

Solutions

Inspect the cause for the server's rejection message.
Verify the user still exists before updating.
Ensure new values (password, description, roles) meet server policy.
Re-login if the session may have expired.

Example fix

// before
userRoleDelegate.updateUser(user);
// after
try {
  userRoleDelegate.updateUser(user);
} catch (KettleException e) {
  logger.error("Update of " + user.getLogin() + " failed: " + e.getCause(), e);
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (userRoleDelegate.getUser(user.getLogin()) == null) {
  throw new IllegalStateException("User no longer exists: " + user.getLogin());
}

Try / catch

try {
  userRoleDelegate.updateUser(user);
} catch (KettleException e) {
  log.error("Update of " + user.getLogin() + " failed: " + e.getCause(), e);
}

Prevention

Reload the user from the server before modifying to avoid stale state.
Validate password/role changes against server policy first.
Handle concurrent deletions by other admins.
Re-login if the session may have expired.

When it happens

Trigger: Calling updateUser(user) when updateUsers(...) or setRoles(...) throws: server rejects the update (validation, password policy), transport failure, expired session, or the user no longer exists server-side.

Common situations: Changing a password that violates server password policy; reassigning roles the client isn't allowed to manage; concurrent modification where the user was deleted by another admin.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/b5a6949faaf54dd6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java:315

      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0006_UNABLE_TO_GET_USERS" ), e ); //$NON-NLS-1$
    }
  }

  public void updateUser( IUser user ) throws KettleException {
    ensureHasPermissions();

    try {
      ProxyPentahoUser proxyUser = UserRoleHelper.convertToPentahoProxyUser( user );
      userRoleWebService.updateUser( proxyUser );
      if ( user instanceof IEEUser ) {
        userRoleWebService.setRoles( proxyUser, UserRoleHelper.convertToPentahoProxyRoles( ( (IEEUser) user )
            .getRoles() ) );
      }
      lookupCache.updateUserInLookupSet( user );
      fireUserRoleListChange();
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0007_UNABLE_TO_UPDATE_USER", user.getLogin() ), e ); //$NON-NLS-1$
    }
  }

  public void createRole( IRole newRole ) throws KettleException {
    ensureHasPermissions();

    ProxyPentahoRole role = UserRoleHelper.convertToPentahoProxyRole( newRole );
    try {
      ProxyPentahoRole[] existingRoles = userRoleWebService.getRoles();
      if ( existsAmong( existingRoles, role ) ) {
        throw roleExistsException();
      }
    } catch ( UserRoleException e ) {
      throw cannotCreateRoleException( newRole, e );
    }

    try {

View on GitHub (pinned to f3058517a1)