What causes "UserRoleDelegate.ERROR_0014_INSUFFICIENT_PRIVILEGES" in pentaho/pentaho-kettle?

Connect to the repository with an administrator account before performing user/role operations.

pentaho/pentaho-kettle · error · KettleException

ERROR_0014_INSUFFICIENT_PRIVILEGES

ERROR_0014_INSUFFICIENT_PRIVILEGES

Error message

UserRoleDelegate.ERROR_0014_INSUFFICIENT_PRIVILEGES

What it means

UserRoleDelegate.ensureHasPermissions throws this KettleException when the security delegate's hasNecessaryPermissions flag is false, i.e., the connected user lacks the admin-level security permissions required to manage users and roles. It is a client-side pre-check before issuing server calls for user/role management.

Solutions

Connect to the repository with an administrator account before performing user/role operations.
Grant the necessary security permissions to the account used (Administer security / manage users and roles).
Check hasPermission support: verify repository capabilities and whether security is managed by the repository vs. an external provider.
Restructure the code so user management is done via the appropriate admin service rather than the delegate.

Example fix

// before
delectate.createUser( newUser ); // throws ERROR_0014 if lacking permissions
// after
if ( delegate.isManaged() && hasAdminRole( currentUser ) ) {
  delegate.createUser( newUser );
} else {
  throw new KettleException( "User management requires an administrator connection" );
}

Defensive patterns

Strategy: validation

Validate before calling

boolean canManageUsers( UserRoleDelegate d ) {
  try { d.getUser( testUserName ); return true; } catch ( KettleException e ) { return false; }
}

Prevention

Use an administrator account for user/role administration
Verify the account has 'Administer security' permissions before automating user tasks
Check repository security capabilities before invoking the delegate
Never run scheduled integrations that manage users with non-admin service accounts

When it happens

Trigger: Calling createUser, deleteUser(s), getUser, updateUser, or createRole while connected to the PUR repository as a user without the necessary security permissions (e.g., not an administrator).

Common situations: Running scheduled jobs or integrations under a service account without admin rights, connecting as a regular business user and attempting user administration, or a tenant where security management is not available to the current role.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/91e3e2c968765f0a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UserRoleDelegate.java:163

  public void updateUserRoleInfo() throws UserRoleException {
    if ( isManaged() ) {
      userRoleSecurityInfo = userRoleWebService.getUserRoleSecurityInfo();
      lookupCache = new UserRoleLookupCache( userRoleSecurityInfo, rsm );
      hasNecessaryPermissions = true;
    } else {
      userRoleInfo = userDetailsRoleListWebService.getUserRoleInfo();
      hasNecessaryPermissions = false;
    }
  }

  public boolean isManaged() {
    return managed;
  }

  private void ensureHasPermissions() throws KettleException {
    if ( !hasNecessaryPermissions ) {
      throw new KettleException( BaseMessages.getString( UserRoleDelegate.class,
          "UserRoleDelegate.ERROR_0014_INSUFFICIENT_PRIVILEGES" ) ); //$NON-NLS-1$
    }
  }

  public void createUser( IUser newUser ) throws KettleException {
    ensureHasPermissions();

    ProxyPentahoUser user = UserRoleHelper.convertToPentahoProxyUser( newUser );
    try {
      ProxyPentahoUser[] existingUsers = userRoleWebService.getUsers();
      if ( existsAmong( existingUsers, user ) ) {
        throw userExistsException();
      }
    } catch ( UserRoleException e ) {
      throw cannotCreateUserException( newUser, e );
    }

    try {

View on GitHub (pinned to f3058517a1)