{"record":{"id":"6080582e9b6f5a56","repo":"grpc/grpc-java","slug":"unknown-permission-rule-case-permission-getru","errorCode":null,"errorMessage":"Unknown permission rule case: \" + permission.getRuleCase()","messagePattern":"Unknown permission rule case: \" \\+ permission\\.getRuleCase\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/RbacFilter.java","lineNumber":252,"sourceCode":"      case HEADER:\n        return parseHeaderMatcher(permission.getHeader());\n      case URL_PATH:\n        return parsePathMatcher(permission.getUrlPath());\n      case DESTINATION_IP:\n        return createDestinationIpMatcher(permission.getDestinationIp());\n      case DESTINATION_PORT:\n        return createDestinationPortMatcher(permission.getDestinationPort());\n      case DESTINATION_PORT_RANGE:\n        return parseDestinationPortRangeMatcher(permission.getDestinationPortRange());\n      case NOT_RULE:\n        return InvertMatcher.create(parsePermission(permission.getNotRule()));\n      case METADATA: // hard coded, never match.\n        return InvertMatcher.create(AlwaysTrueMatcher.INSTANCE);\n      case REQUESTED_SERVER_NAME:\n        return parseRequestedServerNameMatcher(permission.getRequestedServerName());\n      case RULE_NOT_SET:\n      default:\n        throw new IllegalArgumentException(\n                \"Unknown permission rule case: \" + permission.getRuleCase());\n    }\n  }\n\n  private static OrMatcher parsePrincipalList(List<Principal> principals) {\n    List<Matcher> anyMatch = new ArrayList<>();\n    for (Principal principal: principals) {\n      anyMatch.add(parsePrincipal(principal));\n    }\n    return OrMatcher.create(anyMatch);\n  }\n\n  private static Matcher parsePrincipal(Principal principal) {\n    switch (principal.getIdentifierCase()) {\n      case OR_IDS:\n        return parsePrincipalList(principal.getOrIds().getIdsList());\n      case AND_IDS:\n        List<Matcher> nextMatchers = new ArrayList<>();","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/RbacFilter.java#L234-L270","documentation":"RBAC permission protos use a oneof 'rule'; parsePermission handles the known cases (and, or, not, any, header, url_path, requested_server_name, etc.). If the rule oneof is unset or a new Envoy case this grpc-xds version doesn't recognize appears, it throws IllegalArgumentException — a hard failure indicating the client cannot build a matcher for that permission.","triggerScenarios":"An RBAC filter config in an LDS response contains a Permission whose rule oneof is RULE_NOT_SET or an enum case newer than the loaded envoy-common protos; parsePermission (recursively via parsePermissionList/parsePermission) reaches the default branch.","commonSituations":"Control plane with a newer Envoy RBAC feature than the gRPC client's protos; RBAC policy with an empty permission block (rule not set); corrupted/partial RBAC config from a custom xDS server.","solutions":["Upgrade io.grpc:grpc-xds (and its envoy-api protos) so the new permission case is supported","Fix the RBAC policy on the control plane so every permission has a set rule","Replace unsupported rule types (e.g. new metadata cases) with combinations of supported matchers","Check the appended rule case value in the message to identify which case is missing"],"exampleFix":"# before (permission with no rule)\npermissions: {}\n# after\npermissions:\n  - header:\n      name: \":path\"\n      path_match: {path: {prefix: \"/svc\"}}","handlingStrategy":"validation","validationCode":"// Guard before installing an RBAC filter:\nif (permission.getRuleCase() == Permission.RuleCase.RULE_NOT_SET) {\n  throw new IllegalArgumentException(\"RBAC permission must have a rule set\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  RbacFilter.RbacConfig config = RbacFilter.parseRbacConfig(any);\n} catch (IllegalArgumentException e) {\n  logger.warning(\"Unsupported RBAC rule: \" + e.getMessage());\n  // reject filter config rather than crashing the LB\n}","preventionTips":["Never ship RBAC permissions with an empty rule oneof","Upgrade grpc-xds before the control plane adopts new Envoy RBAC cases","Test RBAC policies against the target gRPC client version"],"tags":["grpc","xds","rbac","authorization","protobuf"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}