{"record":{"id":"be527c790db5a223","repo":"pentaho/pentaho-kettle","slug":"abssecurityprovider-error-0003-unable-to-access-get-allowed","errorCode":"AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS","errorMessage":"AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS","messagePattern":"AbsSecurityProvider\\.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java","lineNumber":59,"sourceCode":"          IAuthorizationPolicyWebService.class );\n      if ( authorizationPolicyWebService == null ) {\n        getLogger().error(\n          BaseMessages.getString( AbsSecurityProvider.class,\n            \"AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC\" ) );\n      }\n\n    } catch ( Exception e ) {\n      getLogger().error(\n        BaseMessages.getString( AbsSecurityProvider.class,\n          \"AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC\" ), e );\n    }\n  }\n\n  public List<String> getAllowedActions( String nameSpace ) throws KettleException {\n    try {\n      return allowedActionsActiveCache.get( nameSpace );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,\n        \"AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS\" ), e );\n    }\n  }\n\n  public boolean isAllowed( String actionName ) throws KettleException {\n    try {\n      return isAllowedActiveCache.get( actionName );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,\n        \"AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED\" ), e );\n    }\n  }\n\n  @Override\n  public void validateAction( RepositoryOperation... operations ) throws KettleException {\n\n    for ( RepositoryOperation operation : operations ) {\n      switch ( operation ) {","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java#L41-L77","documentation":"AbsSecurityProvider.getAllowedActions() wraps any Exception thrown while fetching the allowed actions list for a namespace through allowedActionsActiveCache. The KettleException message is ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS and the original failure is preserved as the cause. It means the provider could not retrieve the set of actions (permissions) the current user is allowed to perform.","triggerScenarios":"Calling getAllowedActions(nameSpace) when the backing cache lookup throws — e.g. the underlying Pentaho authorization policy/role-binding lookup fails, the security context is unavailable, or the server call inside the cache loader raises any exception.","commonSituations":"Connecting to a repository where the authorization service rejects the action query; no valid security session (expired or missing Pentaho login); server-side errors while resolving the namespace's allowed actions; callers like allowedActions()/isAllowed() paths that depend on this list.","solutions":["Inspect e.getCause() to identify the underlying authorization failure","Verify you are connected/authenticated to the Pentaho server with a valid security session before querying allowed actions","Confirm the nameSpace value is correct for the Pentaho repository (typically the tenant namespace)","Check server availability and the pur plugin's authorization service configuration, then retry","Catch the KettleException in callers (e.g. UI security checks) and treat it as 'permissions unknown' rather than assuming allow or deny"],"exampleFix":"// before\nList<String> actions = securityProvider.getAllowedActions(nameSpace);\nboolean canEdit = actions.contains(\"org.pentaho.di.job.execute\");\n// after\nList<String> actions;\ntry {\n  actions = securityProvider.getAllowedActions(nameSpace);\n} catch (KettleException e) {\n  throw new KettleException(\"Unable to determine allowed actions: \"\n    + (e.getCause() != null ? e.getCause().getMessage() : e.getMessage()), e);\n}\nboolean canEdit = actions.contains(\"org.pentaho.di.job.execute\");","handlingStrategy":"try-catch","validationCode":"// Ensure an authenticated session and valid namespace before querying\nif (nameSpace == null || nameSpace.isEmpty()) {\n  throw new IllegalArgumentException(\"nameSpace is required for getAllowedActions\");\n}\n// also verify the repository/security session is connected before this call","typeGuard":null,"tryCatchPattern":"try {\n  List<String> actions = securityProvider.getAllowedActions(nameSpace);\n} catch (KettleException e) {\n  Throwable root = e;\n  while (root.getCause() != null) { root = root.getCause(); }\n  log.logError(\"Allowed actions unavailable: \" + root.getMessage());\n  // treat as permissions unknown; do not assume allow or deny\n}","preventionTips":["Establish and verify the Pentaho security session before querying allowed actions","Use the correct namespace for the connected tenant/repository","Never treat an exception result as 'all allowed' — default to deny when permissions are unknown","Retry once on transient errors and unwrap getCause() for diagnosis"],"tags":["kettle","pentaho","security","permissions"],"backgroundTag":"api-request-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}