> For the complete documentation index, see [llms.txt](https://academy.pentaho.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.pentaho.com/administrator-path-sandbox/administrator.md).
# Administrator
{% hint style="warning" %}
**🧪 SANDBOX — draft learning path page**
For review only. **Level 1**, **Level 2**, **Level 3** and the **Speciality course** are all built as lesson-based curricula with estimated times.
{% endhint %}
:shield-halved:
Pentaho Administrator
Configure and maintain the Pentaho Suite — from a secured Tomcat deployment to managing users, connections and the repository in production.
{% columns %}
{% column %}
:layer-group: 3 levels plus Speciality
{% endcolumn %}
{% column %}
:list-check: 88 lessons across 17 modules
{% endcolumn %}
{% column %}
:cloud: Hosted labs nothing to install
{% endcolumn %}
{% endcolumns %}
{% hint style="success" icon="cloud-arrow-up" %}
**The labs come with the course.**
Every workshop runs on Pentaho's hosting platform. When you purchase, you're sent a URL and a voucher code — that's your access. Each lab has its Lab Guide embedded, and it starts automatically when you open the lab. Nothing to download, install or configure.
{% endhint %}
***
Choose your level
Everything about a level — outline, lesson count and skills — in one place. Level 1 shown by default.
{% tabs %}
{% tab title="🌱 Level 1 — Practitioner" %}
No prior Pentaho experience needed. Six modules take you from a fresh install to a hardened, production-ready, supportable server with users, connections and the repository configured, ending in a capstone project.
| | | |
| :-------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------: |
|
Context path & port changes · removing the server banner · SSL/TLS · enforcing HTTPS · secure cookies · changing the SHUTDOWN port · memory limits · removing default apps
:sliders:Server configuration
Disabling the evaluator login hint · login autocomplete · Home perspective widgets · removing sample & Geo data · log file rotation with log4j2
:database:Repository management
Users & roles · upload/download content · authentication method · mail server · licenses · data sources
:diagram-project:PDI/Spoon administration
JDBC drivers · database connections · repository connection · kettle.properties · PDI logging · purging · version control
:life-ring:Support & upgrades
Support Portal & tickets · the logging framework · Operations Mart · planning and running a server upgrade
{% endtab %}
{% tab title="🍂 Level 2 — Associate" %}
Builds on Level 1 with directory-based authentication. Four modules connect your server to LDAP or Active Directory, harden the security fundamentals around it, and teach you to diagnose login failures from the logs — ending in a capstone project.
| | | |
| :-------------------------------------------------------------------------------------------------------------------------------: | :--------------------------------------------------------------------------------------------------------------------: | :------------------------------------------------------------------------------------------------------------------------: |
|
ACLs on files and folders · credentials in URL parameters · disabling security · hiding user folders
:diagram-project:LDAP integration
Connection settings, bind credentials, testing the connection, user & role mapping
:windows:Active Directory integration
AD-specific connection quirks, mapping users, security groups and OUs to roles
:magnifying-glass:Troubleshooting logins
Spring Security debug logging · reading "bad credentials" vs. "user not found" · confirming successful logins
{% endtab %}
{% tab title="🌳 Level 3 — Certified" %}
The rest of Pentaho's security surface. Four modules cover SSO, transport/data security, big data security, and awareness of enterprise patterns that need custom development — ending in a peer-reviewed capstone as part of the proctored certification exam.
| | | |
| :-------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------: | :------------------------------------------------------------------------------------------------------------------------: |
|
OIDC/OAuth 2.0 with Keycloak, Entra ID or Okta · Kerberos-based IWA for silent domain login · CAS where it is still in place
:lock:Transport & data security
SSL · AES-encrypted credentials · JDBC-backed security · SSRF prevention · how Spring Security chains providers
:database:Big data security
Kerberos vs. secure impersonation · Kerberos with MongoDB & Spark · Knox & CDP access
:eye:Enterprise security awareness
Pre-authenticated gateways · custom auth providers · multi-tenant isolation · custom access voters — recognising when to bring in a developer
{% endtab %}
{% endtabs %}
***
Speciality course
The advanced tier, for experienced administrators who want to push beyond standard operations.
{% columns %}
{% column %}
{% hint style="success" icon="cube" %}
**Stands alone**
Take the speciality on its own. You don't need to work through the levels first — just the hands-on experience to keep up.
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="award" %}
**Counts towards Level 3**
This speciality forms part of the **Level 3 — Certified** credential, since it covers the same authentication ground in more depth.
{% endhint %}
{% endcolumn %}
{% endcolumns %}
:key:Integrating Authentication Mechanisms
Signing in without a Pentaho login page, beyond Level 2's LDAP and Active Directory — OpenID Connect / OAuth 2.0 with Keycloak and Microsoft Entra ID, Kerberos/SPNEGO silent login for domain-joined users, and where the older SAML and CAS integrations now stand, ending in a capstone.
{% columns %}
{% column %}
{% hint style="success" icon="circle-check" %}
**Yes — if you**
* Configure or upgrade the Pentaho Server
* Harden a Tomcat/Pentaho deployment for production
* Manage users, roles and the repository
* Keep the platform running so ETL specialists and business analysts can create, publish and share content
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="signs-post" %}
**Try another path if you**
* Build and run pipelines day-to-day — **PDI Developer**
* Design the wider architecture rather than operate the platform — **Solution Architect**
* Consume the output in reports and dashboards — **Business Analyst**
{% endhint %}
{% endcolumn %}
{% endcolumns %}
{% hint style="info" icon="circle-info" %}
**Two administrator roles, one path**
The course distinguishes **IT Administrators** (install, configure and upgrade the server; know where data is stored and how to use the command line) from **Pentaho Administrators** (manage users, roles and workstations so ETL specialists and business analysts can work). Level 1 covers tasks for both.
{% endhint %}
***
How to get access
{% stepper %}
{% step %}
**Read the course outlines**
Open the level or speciality you're considering and check the modules cover the work you actually do.
{% endstep %}
{% step %}
**Talk to your Pentaho Account Executive**
Courses and subscriptions are purchased through your Pentaho Account Executive — a single seat or the whole team. They'll size it with you and get the order placed. No Account Executive yet? Email and we'll connect you.
{% endstep %}
{% step %}
**Receive your voucher code**
You'll be sent a voucher code giving access to the course or courses you bought.
{% endstep %}
{% step %}
**Redeem your code and start your lab**
Redeem the code on the Pentaho training portal and your hosted lab deploys with the Lab Guide built in. Every screen is shown step by step in the voucher walkthrough.
{% embed url="" %}
{% endstep %}
{% endstepper %}
***
## At a glance
:layer-group:Levels
3 — Practitioner, Associate and Certified, plus the Integrating Authentication Mechanisms speciality
:chalkboard-user:Format
A mix of hands-on workshops and short reading pages, self-paced, ending each level with a capstone project
:clock:Time
~16h 35m across the three levels · ~3h 10m for the speciality
:cloud:Delivery
On Pentaho's hosting platform — Lab Guide embedded in every lab
:door-open:Entry requirements
No prior Pentaho experience for Level 1. Comfort with the command line and basic networking (ports, certificates) helps.
:tag:Built against
Pentaho Enterprise Edition 11.0.0.3-310
:globe:Language
English
:award:Certification
Levels 1 & 2 — course accreditation. Level 3 — proctored Certification with a peer-reviewed capstone.
:clock-rotate-left:Last updated
October 2026
***
## Common questions
Do I need my own Pentaho environment?
No. The labs are hosted for you — your voucher gives you access to a ready-made environment on our hosting platform, with the Lab Guide embedded in each lab. There's nothing to download, install or configure.
How long does the whole path take?
About 16h 35m across the three levels — 8h 30m at Level 1, 3h 20m at Level 2 and 4h 45m at Level 3 — plus 3h 10m if you take the speciality. At a few hours a week that's roughly a month for the levels.
Do I need to start at Level 1?
Level 1 assumes no prior Pentaho experience, so it's the right entry point for most people. If you already administer Pentaho servers daily, talk to your Account Executive about starting higher.
Is this path for IT Administrators or Pentaho Administrators?
Both. Level 1 covers server installation and hardening tasks (typically IT Administrator work) alongside users, roles and repository management (typically Pentaho Administrator work), since many teams have one person doing both.
Can my whole team take this path?
Yes. Your Account Executive can size the order for the team and have vouchers issued for each learner.
How long do I have access to the labs?
REPLACE-ME — confirm the access period a voucher grants, and what happens when it ends.
Do I buy the whole path, or one course at a time?
REPLACE-ME — confirm whether levels and specialities are sold individually, as a bundle, or under a subscription.
Can I see a lab before I buy?
REPLACE-ME — confirm whether a sample lab is available as a preview.
***
Still have questions?
{% columns %}
{% column %}
{% hint style="info" icon="gitbook-assistant" %}
**Quick answers about the content**
Which tools a module covers, whether a system is included, how the levels differ. Press Ctrl + K and click **Ask** for an instant answer from these pages.
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="envelope" %}
**Talk to the Academy team**
For anything the assistant can't answer — pricing, licensing, access periods, or sizing a programme for your team — email us at .
We read every message and reply as soon as we can. If it's easier to talk it through, we'll set up a call from there.
{% endhint %}
{% endcolumn %}
{% endcolumns %}
***
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://academy.pentaho.com/administrator-path-sandbox/administrator.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
