{"record":{"id":"06d4c02b2f88f707","repo":"pentaho/pentaho-kettle","slug":"session-based-authentication-is-enabled-but-no-valid-session","errorCode":null,"errorMessage":"Session-based authentication is enabled but no valid session found. Please authenticate through browser first.","messagePattern":"Session-based authentication is enabled but no valid session found\\. Please authenticate through browser first\\.","errorType":"exception","errorClass":"SessionAuthenticationException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/com/pentaho/di/purge/RepositoryCleanupUtil.java","lineNumber":388,"sourceCode":"          SpoonSessionManager.getInstance().getAuthenticationContext( url );\n\n        if ( authContext == null ) {\n          throw new SessionAuthenticationException(\n            \"Unable to obtain authentication context for URL: \" + url\n              + \". Verify the URL is valid and properly formatted.\" );\n        }\n\n        // Check if authenticated\n        if ( authContext.isAuthenticated() ) {\n          String jsessionId = authContext.getJSessionId();\n\n          // Register a ClientRequestFilter to add Cookie header to every request\n          final String finalJsessionId = jsessionId;\n          client.register( (jakarta.ws.rs.client.ClientRequestFilter) requestContext ->\n            requestContext.getHeaders().add( \"Cookie\", \"JSESSIONID=\" + finalJsessionId )\n          );\n        } else {\n          throw new SessionAuthenticationException( \"Session-based authentication is enabled but no valid session found. Please authenticate through browser first.\" );\n        }\n      } else {\n        // Use basic authentication with username/password\n        HttpAuthenticationFeature feature = HttpAuthenticationFeature.basic( username, Encr.decryptPasswordOptionallyEncrypted( password ) );\n        client.register( feature );\n      }\n    }\n\n    WebTarget target = client.target( url + AUTHENTICATION + AdministerSecurityAction.NAME );\n    String response = target.request( MediaType.TEXT_PLAIN ).get( String.class );\n\n    if ( !response.equals( \"true\" ) ) {\n      throw new Exception( Messages.getInstance().getString( \"REPOSITORY_CLEANUP_UTIL.ERROR_0012.ACCESS_DENIED\" ) );\n    }\n  }\n\n  /**\n   * Create URL to access REST API based on provided parameters","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/com/pentaho/di/purge/RepositoryCleanupUtil.java#L370-L406","documentation":"This error is thrown by RepositoryCleanupUtil.authenticateLoginCredentials when session-based authentication is enabled for the purge client but no valid JSESSIONID browser session is available. Instead of registering a basic-auth HttpAuthenticationFeature, the utility registers a ClientRequestFilter that adds a 'Cookie: JSESSIONID=<jsessionId>' header to every request; when jsessionId is null/blank it refuses to proceed and throws SessionAuthenticationException.","triggerScenarios":"Calling purge(), authenticateLoginCredentials(), or the test wrappers when session authentication mode is enabled and the resolved jsessionId is null or empty, so the else branch at line 388 throws SessionAuthenticationException.","commonSituations":"Running the purge utility against a Pentaho repository where session auth was selected but the user never logged into the Pentaho web console (no browser session cookie captured); an expired JSESSIONID supplied via configuration; automated/headless runs with no interactive browser login available.","solutions":["Log into the Pentaho web console in a browser first to obtain a valid JSESSIONID, then re-run with session auth enabled","Switch to basic authentication mode so HttpAuthenticationFeature.basic(username, decryptedPassword) is registered instead of requiring a session cookie","Verify the jsessionId configuration/property is populated and current (not an expired session)","For headless automation, configure basic auth credentials or capture a fresh JSESSIONID programmatically before invoking purge"],"exampleFix":"// before: session auth with missing cookie\nthrow new SessionAuthenticationException( \"Session-based authentication is enabled but no valid session found...\" );\n// after: fall back to basic auth when no session is present\nif ( sessionAuthEnabled && jsessionId != null && !jsessionId.isBlank() ) {\n  client.register( (jakarta.ws.rs.client.ClientRequestFilter) ctx -> ctx.getHeaders().add( \"Cookie\", \"JSESSIONID=\" + jsessionId ) );\n} else if ( username != null && password != null ) {\n  client.register( HttpAuthenticationFeature.basic( username, Encr.decryptPasswordOptionallyEncrypted( password ) ) );\n} else {\n  throw new SessionAuthenticationException( \"...\" );\n}","handlingStrategy":"validation","validationCode":"if ( sessionAuthEnabled && ( jsessionId == null || jsessionId.isBlank() ) ) {\n  throw new IllegalStateException( \"Session auth enabled but no JSESSIONID; log into the Pentaho console first or configure basic auth.\" );\n}","typeGuard":"boolean hasValidSession( String jsessionId ) { return jsessionId != null && !jsessionId.isBlank(); }","tryCatchPattern":"try {\n  purgeUtil.authenticateLoginCredentials( client, username, password, useSessionAuth, jsessionId );\n} catch ( SessionAuthenticationException e ) {\n  log.error( \"No valid browser session; falling back to basic auth or prompting login\", e );\n  registerBasicAuthOrPrompt();\n}","preventionTips":["Log into the Pentaho web console before running session-auth purges","Prefer basic auth for headless/CI runs where no browser session exists","Refresh JSESSIONID whenever the server session times out","Validate the jsessionId config value non-empty before invoking purge"],"tags":["authentication","session","http","pentaho"],"backgroundTag":"authentication-required","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}