{"record":{"id":"033ec6802aedf674","repo":"pentaho/pentaho-kettle","slug":"operation-operation-is-unknown-to-the-security-handler","errorCode":null,"errorMessage":"Operation [{operation}] is unknown to the security handler.","messagePattern":"Operation \\[(.+?)\\] is unknown to the security handler\\.","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/repository/filerep/KettleFileRepositorySecurityProvider.java","lineNumber":112,"sourceCode":"          break;\n\n        case MODIFY_SLAVE_SERVER:\n        case MODIFY_CLUSTER_SCHEMA:\n        case MODIFY_PARTITION_SCHEMA:\n          if ( capabilities.isReadOnly() ) {\n            throw new KettleException( operation + \" : repository is read-only\" );\n          }\n          break;\n        case DELETE_SLAVE_SERVER:\n        case DELETE_CLUSTER_SCHEMA:\n        case DELETE_PARTITION_SCHEMA:\n          if ( capabilities.isReadOnly() ) {\n            throw new KettleException( operation + \" : repository is read-only\" );\n          }\n          break;\n\n        default:\n          throw new KettleException( \"Operation [\" + operation + \"] is unknown to the security handler.\" );\n\n      }\n    }\n  }\n\n  public boolean isReadOnly() {\n    return capabilities.isReadOnly();\n  }\n\n  public boolean isLockingPossible() {\n    return capabilities.supportsLocking();\n  }\n\n  public boolean allowsVersionComments( String fullPath ) {\n    return false;\n  }\n\n  public boolean isVersionCommentMandatory() {","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/repository/filerep/KettleFileRepositorySecurityProvider.java#L94-L130","documentation":"validateAction's default branch throws when the given RepositoryOperation enum value is not handled by the file-repository security provider's switch. This usually means a newer operation was added to the RepositoryOperation enum that this security provider does not yet recognize, or an invalid operation is passed programmatically.","triggerScenarios":"Calling securityProvider.validateAction with a RepositoryOperation constant outside the handled cases (e.g. an operation added in a newer Kettle version while using an older KettleFileRepositorySecurityProvider, or null/custom operation).","commonSituations":"Mixing Kettle engine versions (plugins or embedding code compiled against a newer engine), custom repository code passing unexpected operations, upgrade regressions.","solutions":["Upgrade the Kettle engine so KettleFileRepositorySecurityProvider handles the operation.","Wrap the custom operation in a handled RepositoryOperation case or extend the security provider.","Log the actual operation value from the message to identify the unhandled enum constant.","Check for mixed kettle-engine jars on the classpath and align versions."],"exampleFix":"// before\nprovider.validateAction(RepositoryOperation.MY_NEW_OPERATION); // unhandled\n// after\nif (isOperationSupported(provider, RepositoryOperation.MY_NEW_OPERATION)) {\n  provider.validateAction(RepositoryOperation.MY_NEW_OPERATION);\n}","handlingStrategy":"try-catch","validationCode":"Set<RepositoryOperation> supported = Set.of(READ_TRANSFORMATION, ... /* handled ops */);\nif (!supported.contains(operation)) {\n  throw new IllegalArgumentException(\"Operation not supported by file repo security provider: \" + operation);\n}","typeGuard":"boolean isKnownOperation(RepositoryOperation op) {\n  switch (op) {\n    case DELETE_JOB: case MODIFY_DATABASE: case DELETE_DATABASE:\n    case MODIFY_SLAVE_SERVER: case MODIFY_CLUSTER_SCHEMA: case MODIFY_PARTITION_SCHEMA:\n    case DELETE_SLAVE_SERVER: case DELETE_CLUSTER_SCHEMA: case DELETE_PARTITION_SCHEMA:\n      return true;\n    default: return false;\n  }\n}","tryCatchPattern":"try {\n  provider.validateAction(operation);\n} catch (KettleException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"is unknown to the security handler\")) {\n    // upgrade engine version or bypass for supported-only ops\n  } else { throw e; }\n}","preventionTips":["Align kettle-engine versions across classpath/plugins to avoid unknown enum operations.","Enumerate operations your code passes and confirm they exist in your engine version's provider switch.","Wrap validateAction in a compatibility helper when supporting multiple engine versions."],"tags":["repository","unsupported-operation","version-mismatch"],"backgroundTag":"unsupported-operation","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}