{"record":{"id":"c75cd27f1608a8a9","repo":"pentaho/pentaho-kettle","slug":"permission-not-allowed","errorCode":null,"errorMessage":" : permission not allowed","messagePattern":" : permission not allowed","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java","lineNumber":109,"sourceCode":"          break;\n\n        case MODIFY_DATABASE:\n          checkOperationAllowed( MODIFY_DATABASE_ACTION );\n          break;\n\n        case SCHEDULER_EXECUTE:\n          checkOperationAllowed( SCHEDULER_EXECUTE_ACTION );\n          break;\n      }\n    }\n  }\n\n  /**\n   * @throws KettleException if an operation is not allowed\n   */\n  private void checkOperationAllowed( String operation ) throws KettleException {\n    if ( !isAllowed( operation ) ) {\n      throw new KettleException( operation + \" : permission not allowed\" );\n    }\n  }\n\n}\n","sourceCodeStart":91,"sourceCodeEnd":114,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java#L91-L114","documentation":"checkOperationAllowed throws when isAllowed(operation) returns false, producing '<operation> : permission not allowed'. This is Pentaho repository security explicitly denying the operation (e.g. 'create', 'read', 'update', 'delete' on repository objects) for the connected user — the check ran fine but access was refused. It is surfaced from validateAction, which the pur repository delegates call before every repository mutation/read.","triggerScenarios":"Any pur repository operation (saving a transformation/job, reading metadata, deleting content) via validateAction when the connected Pentaho user's role lacks the required repository security action, e.g. trying to save into a repository where the user has read-only rights or is a guest.","commonSituations":"Connecting as a user without Admin/Creator role; repository security mapping missing the required permission for the user's role; executing PDI jobs unattended with a service account that has restricted ACLs; tenant/workspace permission changes made on the server.","solutions":["Grant the connected user's role the required Pentaho repository permission (e.g. Create/Read/Update/Delete) in the Pentaho User Console.","Verify you are connected as the intended user — re-enter credentials or inspect Repository.connect.","Test the exact action with the admin account to confirm it is a permission mapping issue and not content corruption.","Check repository security backend settings (jackrabbit/security policy) if using a custom security provider.","If the denial is expected, wrap the repository call in try-catch and handle the KettleException gracefully in your automation."],"exampleFix":"// before\nrepository.save(transMeta, \"v1\", null); // throws '<operation> : permission not allowed'\n// after\ntry {\n  repository.validateAction(RepositoryOperation.MODIFY_TRANSFORMATION);\n  repository.save(transMeta, \"v1\", null);\n} catch (KettleException e) {\n  throw new IllegalStateException(\"User lacks repository permission to save: \" + e.getMessage(), e);\n}","handlingStrategy":"try-catch","validationCode":"// check the user's role/permissions before attempting the repository operation\nrepository.validateAction(RepositoryOperation.MODIFY_TRANSFORMATION); // pre-flight","typeGuard":null,"tryCatchPattern":"try {\n  repository.save(transMeta, versionComment, null);\n} catch (KettleException e) {\n  if (e.getMessage() != null && e.getMessage().endsWith(\": permission not allowed\")) {\n    throw new SecurityException(\"Repository permission denied: \" + e.getMessage(), e);\n  }\n  throw e;\n}","preventionTips":["Use service accounts with the required Pentaho repository roles for automation.","Verify role-to-permission mappings in the Pentaho User Console after server upgrades.","Pre-flight with validateAction(RepositoryOperation...) before batch writes.","Do not share read-only credentials for write operations."],"tags":["pentaho","kettle","permissions","access-control"],"backgroundTag":"permission-denied","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}