...
By default, the Pentaho distribution comes with the "in-memory" security data access object (DAO) enabled. Because this is only recommended for testing or small user populations, you'll want to switch over to either a relational database back-end or an LDAP back-end. This page shows you how to switch to the "JDBC" DAO. The instructions below describe a sample security database using HSQLDB.
...