pentaho/pentaho-kettle · error · KettleAuthenticationException

Session expired

Error message

Session expired

What it means

UnifiedRepositoryInvocationHandler.invoke wraps every call to the unified repository proxy. When the underlying invocation throws an InvocationTargetException caused by an authentication failure (session expired/invalid), it converts it to KettleAuthenticationException("Session expired"). This surfaces server-side session loss as a typed exception so callers can re-authenticate.

Solutions

1. Reconnect/re-authenticate to the repository (re-call repository.connect with valid credentials) and retry the operation.
2. Catch KettleAuthenticationException and implement a re-login-and-retry wrapper around repository calls.
3. Increase the Pentaho server session timeout or keep the connection alive with periodic activity.
4. Verify the server is not restarting / the load balancer preserves session affinity.

Example fix

// before
RepositoryFile file = pur.getFileById( id ); // throws KettleAuthenticationException on expired session
// after
RepositoryFile file;
try {
  file = pur.getFileById( id );
} catch ( KettleAuthenticationException e ) {
  repository.disconnect();
  repository.connect( username, password ); // re-authenticate
  file = pur.getFileById( id );
}

boolean sessionLikelyValid() {
  try { pur.getRepositoryMeta(); return true; } catch ( KettleAuthenticationException e ) { return false; }
}

try {
  return rep.call( args );
} catch ( KettleAuthenticationException e ) {
  repository.disconnect();
  repository.connect( user, pass );
  return rep.call( args ); // retry once after re-auth
}

When it happens

Trigger: Any repository operation (get, save, delete, list) executed through the proxy after the server HTTP session or auth token expired, or when the server rejects the credentials/session cookie.

Common situations: Long-running jobs whose session timed out mid-run, server restart invalidating sessions, load balancer failing to pin sessions, or shared repository connections left idle beyond the session timeout.

Related errors

• Attempting to create PDI Repository with no Active…
• Browser session authentication requested but no JSESSIONID…
• Session-based authentication is enabled but no valid…
• Unable to obtain authentication context for URL:
• Auth error

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/3eb0674b34031626. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/UnifiedRepositoryInvocationHandler.java:43

class UnifiedRepositoryInvocationHandler<T> implements InvocationHandler {
  private T rep;


  UnifiedRepositoryInvocationHandler( T rep ) {
    this.rep = rep;
  }

  @Override
  public Object invoke( Object proxy, Method method, Object[] args ) throws Throwable {
    try {
      return method.invoke( rep, args );
    } catch ( InvocationTargetException ex ) {
      // Check authentication errors FIRST - session expiry must be detected immediately
      if ( lookupAuthenticationException( ex ) ) {
        // DO NOT close web services here
        // DO NOT retry
        throw new KettleAuthenticationException( "Session expired", ex.getCause() );
      }

      if ( lookupConnectException( ex ) ) {
        throw new KettleRepositoryLostException( ex.getCause() );
      }

      throw ex.getCause();
    }
  }

  private boolean lookupConnectException( Throwable root ) {
    while ( root != null ) {
      if ( root instanceof ConnectException ) {
        return true;
      } else {
        root = root.getCause();
      }
    }

View on GitHub (pinned to f3058517a1)