{"record":{"id":"77cd59535109067c","repo":"pentaho/pentaho-kettle","slug":"repository-does-not-support-access-control","errorCode":null,"errorMessage":"Repository does not support access control","messagePattern":"Repository does not support access control","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/ui/repository/pur/repositoryexplorer/controller/ConnectionPermissionsController.java","lineNumber":133,"sourceCode":"            UIDatabaseConnection dbconnObject = ro.get( 0 );\n            try {\n              if ( dbconnObject instanceof IAclObject ) {\n                IAclObject aclObj = (IAclObject) dbconnObject;\n\n                // This is a special case for DB Connections, wipe out the isEnherting flag.\n                // This will cause the model to become \"dirty\", and prompt the user for changes the first time\n                // let's make sure the default creation behavior of connections is to be that inheritance is\n                // set to false, so this case never presents itself in the wild.\n\n                aclObj.getAcls( viewAclsModel );\n                if ( viewAclsModel.isEntriesInheriting() ) {\n                  viewAclsModel.setEntriesInheriting( false );\n                  aclObj.setAcls( viewAclsModel );\n                  viewAclsModel.setModelDirty( false );\n                }\n\n              } else {\n                throw new IllegalStateException( BaseMessages.getString( PKG, \"PermissionsController.NoAclSupport\" ) ); //$NON-NLS-1$\n              }\n\n              connNameLabel.setValue( BaseMessages.getString( PKG,\n                  \"AclTab.ConnectionPermission\", dbconnObject.getDisplayName() ) ); //$NON-NLS-1$\n              bf.setBindingType( Binding.Type.ONE_WAY );\n              bf.createBinding( viewAclsModel, \"acls\", userRoleList, \"elements\" ); //$NON-NLS-1$ //$NON-NLS-2$\n            } catch ( AccessDeniedException ade ) {\n              messageBox.setTitle( BaseMessages.getString( PKG, \"Dialog.Error\" ) );//$NON-NLS-1$\n              messageBox.setAcceptLabel( BaseMessages.getString( PKG, \"Dialog.Ok\" ) );//$NON-NLS-1$\n              messageBox.setMessage( BaseMessages.getString( PKG,\n                  \"PermissionsController.UnableToGetAcls\", dbconnObject.getName(), ade.getLocalizedMessage() ) );//$NON-NLS-1$\n\n              messageBox.open();\n            } catch ( Exception e ) {\n              if ( mainController == null || !mainController.handleLostRepository( e ) ) {\n                messageBox.setTitle( BaseMessages.getString( PKG, \"Dialog.Error\" ) );//$NON-NLS-1$\n                messageBox.setAcceptLabel( BaseMessages.getString( PKG, \"Dialog.Ok\" ) );//$NON-NLS-1$\n                messageBox.setMessage( BaseMessages.getString( PKG,","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/ui/repository/pur/repositoryexplorer/controller/ConnectionPermissionsController.java#L115-L151","documentation":"ConnectionPermissionsController.sourceToTarget loads ACLs of the selected database connection; if the connection object does not implement IAclObject the repository does not support per-object access control, so it throws IllegalStateException('Repository does not support access control').","triggerScenarios":"Opening the permissions tab for a database connection stored in a repository whose objects do not implement IAclObject (no ACL support in that repository type).","commonSituations":"Using the EE permissions UI against a non-EE repository (database/file repository) lacking ACL support; opening a connection created in an older/newer repository with different object wrappers.","solutions":["Perform this operation against a Pentaho EE repository whose connection objects implement IAclObject","Check rd instanceof IAclObject before opening/enabling the permissions tab and disable ACL UI otherwise","Wrap sourceToTarget in try-catch for IllegalStateException and show a friendly 'repository does not support ACLs' message"],"exampleFix":"// before\nconnPermissionsController.sourceToTarget();\n// after\nif ( dbconnObject instanceof IAclObject ) {\n  connPermissionsController.sourceToTarget();\n} else {\n  // show message: repository does not support access control\n}","handlingStrategy":"type-guard","validationCode":"if (dbconnObject instanceof IAclObject) { /* ACLs supported */ }\n","typeGuard":"static boolean supportsAcls(Object repositoryObject) {\n  return repositoryObject instanceof IAclObject;\n}\n","tryCatchPattern":"try {\n  sourceToTarget();\n} catch (IllegalStateException e) {\n  log.warn(\"Repository does not support access control on this connection\");\n  // hide/disable ACL UI\n}\n","preventionTips":["Use EE repositories when ACL management is required","Check IAclObject before enabling permissions tabs","Feature-flag ACL UI based on repository capabilities"],"tags":["pentaho","acl","repository","permissions"],"backgroundTag":"feature-not-enabled","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}