pentaho/pentaho-kettle · error · KettleException

LDAPConnection.Error.Update

LDAPConnection.Error.Update

Error message

LDAPConnection.Error.Update

What it means

LDAPConnection.update(dn, attributes, values, checkEntry) wraps any non-NameNotFound exception from modifyAttributes() in a KettleException with message key 'LDAPConnection.Error.Update' (dn interpolated). The original javax.naming exception (permission problem, invalid attribute, schema violation, connection issue) is the cause.

Solutions

  1. Inspect e.getCause() (SchemaViolationException, NoPermissionException, InvalidAttributeValueException) and address the specific problem.
  2. Grant write permission to the bind account on the target subtree.
  3. Verify each attribute is allowed by the entry's objectClass schema.
  4. Test the same modification with ldapmodify before running the transformation.

Example fix

// before
connection.update(dn, new String[]{"homePostalAddress"}, new String[]{addr}, true);
// after (use a schema-allowed attribute and ensure write rights)
connection.update(dn, new String[]{"description"}, new String[]{addr}, true);
Defensive patterns

Strategy: try-catch

Validate before calling

// Validate attributes against schema before update
for (String attr : attrs) {
  Attributes schema = ctx.getSchema(dn);
  Attribute objClasses = ctx.getAttributes(dn).get("objectClass");
  // ensure attr is in the may/must list of the entry's objectClasses
}

Try / catch

try {
  connection.update(dn, attrs, vals, true);
} catch (KettleException e) {
  Throwable root = ExceptionUtils.getRootCause(e);
  if (root instanceof SchemaViolationException) { /* attribute not allowed / wrong syntax for objectClass */ }
  else if (root instanceof NoPermissionException) { /* grant write ACI */ }
  throw e;
}

Prevention

When it happens

Trigger: Updating with an attribute not defined in the schema for the entry's objectClass; modifying an attribute the bind user may not write (e.g. uid, entryDN); passing an attribute name that doesn't exist; connection dropped mid-operation.

Common situations: Bind account without write ACI on the target OU; trying to modify a operational/immutable attribute; schema in target directory (e.g. AD vs OpenLDAP) lacking the attribute; single-valued attribute receiving multiple values.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/bbcdb6ecc9cb591d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/LDAPConnection.java:325

          log
            .logDebug( BaseMessages.getString( PKG, "LDAPConnection.Update.Attribute", attributes[i], values[i] ) );
        }
        // Save update action on attribute
        mods[i] = new ModificationItem( DirContext.REPLACE_ATTRIBUTE, mod );
      }
      // We have all requested attribute
      // let's update now
      getInitialContext().modifyAttributes( dn, mods );
      return STATUS_UPDATED;
    } catch ( NameNotFoundException n ) {
      // The entry is not found
      if ( checkEntry ) {
        throw new KettleException(
          BaseMessages.getString( PKG, "LDAPConnection.Error.Deleting.NameNotFound", dn ), n );
      }
      return STATUS_SKIPPED;
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( PKG, "LDAPConnection.Error.Update", dn ), e );
    }
  }

  public int add( String dn, String[] attributes, String[] values, String multValuedSeparator, boolean checkEntry ) throws KettleException {
    try {
      Attributes attrs = buildAttributes( dn, attributes, values, multValuedSeparator );
      // We had all attributes
      getInitialContext().modifyAttributes( dn, DirContext.ADD_ATTRIBUTE, attrs );
      return STATUS_ADDED;
    } catch ( NameNotFoundException n ) {
      // The entry is not found
      if ( checkEntry ) {
        throw new KettleException(
          BaseMessages.getString( PKG, "LDAPConnection.Error.Deleting.NameNotFound", dn ), n );
      }
      return STATUS_SKIPPED;
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( PKG, "LDAPConnection.Error.Add", dn ), e );

View on GitHub (pinned to f3058517a1)