{"record":{"id":"b6034331b699998d","repo":"pentaho/pentaho-kettle","slug":"abssecurityprovider-error-0002-unable-to-access-is-allowed","errorCode":"AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED","errorMessage":"AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED","messagePattern":"AbsSecurityProvider\\.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java","lineNumber":68,"sourceCode":"        BaseMessages.getString( AbsSecurityProvider.class,\n          \"AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC\" ), e );\n    }\n  }\n\n  public List<String> getAllowedActions( String nameSpace ) throws KettleException {\n    try {\n      return allowedActionsActiveCache.get( nameSpace );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,\n        \"AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS\" ), e );\n    }\n  }\n\n  public boolean isAllowed( String actionName ) throws KettleException {\n    try {\n      return isAllowedActiveCache.get( actionName );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,\n        \"AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED\" ), e );\n    }\n  }\n\n  @Override\n  public void validateAction( RepositoryOperation... operations ) throws KettleException {\n\n    for ( RepositoryOperation operation : operations ) {\n      switch ( operation ) {\n        case EXECUTE_TRANSFORMATION:\n        case EXECUTE_JOB:\n          checkOperationAllowed( EXECUTE_CONTENT_ACTION );\n          break;\n\n        case MODIFY_TRANSFORMATION:\n        case MODIFY_JOB:\n          checkOperationAllowed( CREATE_CONTENT_ACTION );\n          break;","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java#L50-L86","documentation":"AbsSecurityProvider.isAllowed consults an active cache of permission checks (isAllowedActiveCache) that ultimately delegates to the Pentaho repository security backend. If any exception occurs while resolving the cached action result, it is wrapped in a KettleException with message 'AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED'. This indicates the permission lookup itself failed — not that a permission was denied, but that the answer could not be obtained (backend communication or internal failure).","triggerScenarios":"Calling repository security operations (validateAction -> checkOperationAllowed -> isAllowed) when the underlying cache loader throws: e.g. the Pentaho BI server is unreachable, the user session/ticket has expired, or the IPermissionTarget/action name lookup throws inside the cache supplier.","commonSituations":"Connecting kettle/pdi to a Pentaho repository (pur plugin) while the BA server is down or restarted mid-session; expired Pentaho web session; misconfigured repository connection URL; network interruption during repository metadata or security calls.","solutions":["Verify the Pentaho BA/Repository server is up and reachable from the client and that the connection URL in the repository definition is correct.","Re-login / refresh the repository session — an expired or invalid session often breaks the underlying permission lookup.","Catch KettleException and inspect the cause (e.getCause()) to find the actual backend failure.","Check pur plugin and Pentaho server version compatibility; upgrade the plugin if a known permission-cache bug was fixed.","Enable Pentaho/kettle debug logging (KETTLE_LOG_LEVEL=DEBUG) to trace the underlying security service call."],"exampleFix":"// before\nboolean ok = securityProvider.isAllowed(\"read\"); // throws KettleException on backend failure\n// after\nboolean ok;\ntry {\n  ok = securityProvider.isAllowed(\"read\");\n} catch (KettleException e) {\n  log.error(\"Could not determine permission, cause: \" + (e.getCause() != null ? e.getCause().getMessage() : e.getMessage()));\n  throw e;\n}","handlingStrategy":"try-catch","validationCode":"// pre-check connectivity/session before permission-sensitive calls\nif (repository == null || !repository.isConnected()) throw new IllegalStateException(\"Repository not connected\");","typeGuard":null,"tryCatchPattern":"try {\n  securityProvider.isAllowed(actionName);\n} catch (KettleException e) {\n  Throwable cause = e.getCause();\n  log.error(\"Permission lookup failed for \" + actionName, cause);\n  // treat as 'unknown', fail closed or retry against a healthy server\n}","preventionTips":["Confirm server reachability and valid credentials before repository operations.","Monitor session expiry in long-running PDI automation and reconnect on failure.","Keep pur plugin and Pentaho server versions aligned.","Log the KettleException cause, not just the wrapper message."],"tags":["pentaho","kettle","permissions","repository"],"backgroundTag":"permission-denied","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}