{"record":{"id":"875ddf54244ad142","repo":"pentaho/pentaho-kettle","slug":"purrepository-error-0004-database-update-access-denied","errorCode":"PurRepository.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED","errorMessage":"PurRepository.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED (localized, takes element name; 'access denied' during database update)","messagePattern":"PurRepository\\.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED \\(localized, takes element name; 'access denied' during database update\\)","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/PurRepository.java","lineNumber":2388,"sourceCode":"              + RepositoryObjectType.DATABASE.getExtension() ) ).title( RepositoryFile.DEFAULT_LOCALE,\n            element.getName() ).createdDate( createdDate ).versioned( VERSION_SHARED_OBJECTS ).build();\n\n        file =\n          pur.createFile( getDatabaseMetaParentFolderId(), file,\n            new NodeRepositoryFileData( databaseMetaTransformer.elementToDataNode( element ) ), versionComment );\n      }\n      // side effects\n      ObjectId objectId = new StringObjectId( file.getId().toString() );\n      element.setObjectId( objectId );\n      element.setObjectRevision( getObjectRevision( objectId, null ) );\n      if ( element instanceof ChangedFlagInterface ) {\n        ( (ChangedFlagInterface) element ).clearChanged();\n      }\n      updateSharedObjectCache( element );\n    } catch ( Exception e ) {\n      // determine if there is an \"access denied\" issue and throw a nicer error message.\n      if ( e.getMessage().indexOf( \"access denied\" ) >= 0 ) {\n        throw new KettleException(\n          BaseMessages.getString( PKG, \"PurRepository.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED\", element.getName() ),\n          e );\n      }\n    } finally {\n      readWriteLock.writeLock().unlock();\n    }\n  }\n\n  @Override\n  public DatabaseMeta loadDatabaseMeta( final ObjectId databaseId, final String versionId )\n    throws KettleException {\n    readWriteLock.readLock().lock();\n    try {\n\n      NodeRepositoryFileData\n        data =\n        pur.getDataAtVersionForRead( databaseId.getId(), versionId, NodeRepositoryFileData.class );\n      RepositoryFile file = null;","sourceCodeStart":2370,"sourceCodeEnd":2406,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/PurRepository.java#L2370-L2406","documentation":"Thrown by PurRepository save/update methods (e.g. updateDatabase) when the underlying repository service reports 'access denied'. The adapter inspects the exception message for 'access denied' and rethrows a friendlier localized error (ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED) including the element name.","triggerScenarios":"Calling save/update on a database (or other shared element) whose name matches an object in a repository folder where the current user lacks write permission; server ACL denies the update; read-only role used to modify objects.","commonSituations":"Non-admin users editing shared database connections; repository security policies changed after deployment; connecting with an account lacking metadata update rights.","solutions":["Grant the current user write/update permissions on the target repository folder","Use an account with sufficient privileges for metadata updates","Ask an administrator to adjust the repository ACL for the shared object"],"exampleFix":"// before\nrepository.updateDatabase(id, databaseMeta); // run by read-only user\n// after\n// run as a user with write access, or handle:\ntry { repository.updateDatabase(id, databaseMeta); }\ncatch (KettleException e) { log.error(\"Access denied updating database; check permissions\", e); }","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  repository.updateDatabase(id, databaseMeta);\n} catch (KettleException e) {\n  if (e.getMessage().contains(\"ACCESS_DENIED\") || e.getMessage().contains(\"access denied\")) {\n    log.error(\"No permission to update database \" + databaseMeta.getName()\n      + \"; request write access\", e);\n  }\n}","preventionTips":["Verify the service account has write/update permissions in the repository","Audit repository ACLs after security policy changes","Use admin credentials only for metadata updates"],"tags":["pentaho","kettle","permissions","repository"],"backgroundTag":"permission-denied","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}