{"record":{"id":"72c14e0cda3c6e75","repo":"xpipe-io/xpipe","slug":"principal-p-getname-is-not-accessible","errorCode":null,"errorMessage":"Principal \" + p.getName() + \" is not accessible","messagePattern":"Principal \" \\+ p\\.getName\\(\\) \\+ \" is not accessible","errorType":"exception","errorClass":"BeaconClientException","httpStatus":400,"severity":"error","filePath":"app/src/main/java/io/xpipe/app/beacon/api/SecretEncryptExchange.java","lineNumber":56,"sourceCode":"                        .findFirst();\n                if (byName.isPresent()) {\n                    p = byName.get();\n                } else {\n                    var uuid = UuidHelper.parse(pr);\n                    if (uuid.isPresent()) {\n                        var principal = DataStorageAccessHandler.getInstance().getEncryptionPrincipal(uuid.get());\n                        p = principal.orElse(null);\n                    } else {\n                        p = null;\n                    }\n                }\n\n                if (p == null) {\n                    throw new BeaconClientException(\"Unknown principal \" + pr);\n                }\n\n                if (!p.isAccessible()) {\n                    throw new BeaconClientException(\"Principal \" + p.getName() + \" is not accessible\");\n                }\n\n                resolvedPrincipals.add(p);\n            }\n        }\n\n        if (resolvedPrincipals.isEmpty()) {\n            resolvedPrincipals.add(DataStorageAccessHandler.getInstance().getEncryptAllPrincipal());\n        }\n\n        var secret = MultiPrincipalSecret.of(InPlaceSecretValue.of(msg.getValue()), resolvedPrincipals);\n        return Response.builder().encrypted(secret.serialize()).build();\n    }\n\n    @Jacksonized\n    @Builder\n    @Value\n    public static class Request {","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/xpipe-io/xpipe/blob/d85ca821baa46092a320ebb13546d7240adb74f8/app/src/main/java/io/xpipe/app/beacon/api/SecretEncryptExchange.java#L38-L74","documentation":"After resolving the requested principal, SecretEncryptExchange checks p.isAccessible(). The principal exists but the daemon's process cannot access it — commonly because encryption for that user requires elevated privileges or the daemon runs as a different user without permission. The request is rejected so secrets are never bound to an inaccessible principal.","triggerScenarios":"Requesting encryption for a principal whose credentials/key material the daemon cannot read or impersonate: encrypting for another user while the daemon runs unprivileged, or on systems where cross-user secret access is restricted by OS policy.","commonSituations":"Daemon running as a service account while secrets target an interactive user; restricted OS keychains/credential stores; enterprise policies blocking cross-user access; missing admin elevation on Windows.","solutions":["Run the XPipe daemon with sufficient privileges (or as the target user) so it can access that principal's secret store","Encrypt for a principal the daemon can access, and use an alternative sharing mechanism for others","Check OS-level credential-store/keychain permissions for the daemon user","Consult XPipe docs on multi-user secret accessibility for your platform"],"exampleFix":"// before\nrequest.setPrincipals(List.of(\"otheruser\"));\n// after\nif (!daemonCanAccess(\"otheruser\")) {\n    logger.warn(\"Daemon cannot access 'otheruser'; encrypting for current user instead\");\n    request.setPrincipals(List.of(currentUserName));\n} else {\n    request.setPrincipals(List.of(\"otheruser\"));\n}","handlingStrategy":"fallback","validationCode":"for (String pr : requested) {\n    if (!daemonCanAccessPrincipal(pr)) {\n        logger.warn(\"Principal not accessible to daemon: \" + pr);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    return client.encryptSecret(request);\n} catch (BeaconClientException e) {\n    if (e.getMessage().endsWith(\"is not accessible\")) {\n        return client.encryptSecret(requestForCurrentUser());\n    }\n    throw e;\n}","preventionTips":["Run the daemon with enough privilege (or as the target user) for cross-user secret access","Check OS keychain/credential-store permissions for the daemon user","Prefer encrypting for principals known to be accessible; share secrets another way otherwise"],"tags":["beacon-api","secrets","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"d85ca821baa46092a320ebb13546d7240adb74f8","analyzedAt":"2026-09-06T14:30:08.251Z","contentChangedAt":"2026-09-06T14:30:08.251Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}