{"record":{"id":"f8b2d8bd0581177c","repo":"jumpserver/jumpserver","slug":"perm-account-invalid","errorCode":"perm_account_invalid","errorMessage":"Account not found","messagePattern":"Account not found","errorType":"error_code","errorClass":"JMSException","httpStatus":400,"severity":"error","filePath":"apps/authentication/api/connection_token.py","lineNumber":737,"sourceCode":"        if ticket:\n            data['from_ticket'] = ticket\n\n        if ticket or self.need_face_verify:\n            data['is_active'] = False\n        if self.face_monitor_token:\n            FaceMonitorContext.get_or_create_context(self.face_monitor_token, self.request.user.id)\n            data['face_monitor_token'] = self.face_monitor_token\n        return data\n\n    @staticmethod\n    def get_permed_account(user, asset, account_alias, protocol):\n        return ConnectionToken.get_user_permed_account(user, asset, account_alias, protocol)\n\n    def _validate_perm(self, user, asset, account_alias, protocol):\n        account = self.get_permed_account(user, asset, account_alias, protocol)\n        if not account or not account.actions:\n            msg = _('Account not found')\n            raise JMSException(code='perm_account_invalid', detail=msg)\n        if account.date_expired < timezone.now():\n            msg = _('Permission expired')\n            raise JMSException(code='perm_expired', detail=msg)\n        return account\n\n    def _record_operate_log(self, acl, asset):\n        from audits.handler import create_or_update_operate_log\n        with tmp_to_org(asset.org_id):\n            after = {\n                str(_('Assets')): str(asset),\n                str(_('Account')): self.input_username\n            }\n            object_name = acl._meta.object_name\n            resource_type = acl._meta.verbose_name\n            create_or_update_operate_log(\n                acl.action, resource_type, resource=acl,\n                after=after, object_name=object_name\n            )","sourceCodeStart":719,"sourceCodeEnd":755,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/authentication/api/connection_token.py#L719-L755","documentation":"Raised in _validate_perm when get_permed_account returns no account or an account with empty actions — i.e. the user has no usable grant of this asset account for the protocol. Code is 'perm_account_invalid'.","triggerScenarios":"Calling connection-token validate/create/exchange for an (asset, account_alias, protocol) combination the user has no asset permission for, or whose grant has empty 'actions'; also when the account alias matches nothing on the asset.","commonSituations":"Permission was revoked or the grant was created without actions; wrong account name; user from a different organization (get_user_permed_account is org-scoped); stale cached permission list on the client side.","solutions":["Verify the user actually has an asset permission granting this account (check the asset permission's accounts and actions in the admin UI)","Confirm org context: request with the correct X-JMS-ORG header matching the asset's org","Re-check exact account username/alias; re-fetch the permed-account list before requesting the token"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"accounts = get_user_permed_accounts(user, asset, protocol)\nif not any(a['username'] == account_alias and a.get('actions') for a in accounts):\n    raise PermissionError('no usable grant for this account')","typeGuard":null,"tryCatchPattern":"try:\n    resp = client.create_connection_token(...)\nexcept JMSException as e:\n    if e.code == 'perm_account_invalid':\n        refresh_permission_cache(); show_grant_dialog()","preventionTips":["Refresh the permed-account list after permission changes","Always issue requests within the asset's org context"],"tags":["connection-token","permissions","account","authorization"],"backgroundTag":"permission-denied","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}