pentaho/pentaho-kettle · error · KettleException

ERROR_0011_UNABLE_TO_GET_ROLES

ERROR_0011_UNABLE_TO_GET_ROLES

Error message

UserRoleDelegate.ERROR_0011_UNABLE_TO_GET_ROLES

What it means

Thrown by UserRoleDelegate.getRoles() when the full role list cannot be retrieved. Both the privileged path (convertToListFromProxyPentahoRoles via userRoleSecurityInfo) and the restricted fallback path (convertToListFromNonPentahoRoles via userRoleInfo) are inside the try, so any failure is wrapped in a KettleException with ERROR_0011_UNABLE_TO_GET_ROLES.

Solutions

1. Inspect the wrapped cause for the server error.
2. Re-login to the repository to refresh the session.
3. Check Pentaho server logs for security provider (LDAP) errors.
4. Verify server/client plugin version compatibility for the user-role web service.

Example fix

// before
List<IRole> roles = userRoleDelegate.getRoles();
// after
List<IRole> roles;
try {
  roles = userRoleDelegate.getRoles();
} catch (KettleException e) {
  logger.error("Role list unavailable: " + e.getCause(), e);
  roles = Collections.emptyList();
}

if (repository == null || !repository.isConnected()) {
  throw new IllegalStateException("Repository not connected; getRoles() will fail");
}

try {
  List<IRole> roles = userRoleDelegate.getRoles();
} catch (KettleException e) {
  log.error("Role list fetch failed: " + e.getCause(), e);
  // consider one re-login + retry
}

When it happens

Trigger: Calling getRoles() when the permission probe or the web service/role lookup throws: server unreachable, expired session, conversion errors in UserRoleHelper, or security provider failures on the server.

Common situations: Role assignment dialogs in Spoon showing empty after session expiry; Pentaho server backed by a failing LDAP/AD provider; repository connection created against a server version with an incompatible user-role web service.

Related errors

• ERROR_0009_UNABLE_TO_DELETE_ROLES
• ERROR_0010_UNABLE_TO_GET_ROLE
• ERROR_0003_UNABLE_TO_DELETE_USERS
• ERROR_0005_UNABLE_TO_GET_USER
• ERROR_0007_UNABLE_TO_UPDATE_USER

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/aa63cdcf6523b63a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java:403

    try {
      return UserRoleHelper.convertFromProxyPentahoRole( userRoleWebService, UserRoleHelper.getProxyPentahoRole(
          userRoleWebService, name ), lookupCache, rsm );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0010_UNABLE_TO_GET_ROLE", name ), e ); //$NON-NLS-1$
    }
  }

  public List<IRole> getRoles() throws KettleException {
    try {
      if ( hasNecessaryPermissions ) {
        return UserRoleHelper.convertToListFromProxyPentahoRoles( userRoleSecurityInfo, rsm );
      } else {
        return UserRoleHelper.convertToListFromNonPentahoRoles( userRoleInfo, rsm );
      }
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0011_UNABLE_TO_GET_ROLES" ), e ); //$NON-NLS-1$
    }
  }

  public List<IRole> getDefaultRoles() throws KettleException {
    ensureHasPermissions();

    try {
      return UserRoleHelper.convertToListFromProxyPentahoDefaultRoles( userRoleSecurityInfo, rsm );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0011_UNABLE_TO_GET_ROLES" ), e ); //$NON-NLS-1$
    }
  }

  public void updateRole( IRole role ) throws KettleException {
    ensureHasPermissions();

View on GitHub (pinned to f3058517a1)