flowable/flowable-engine · error · org.activiti.engine.ActivitiException

not allowed to access field

Error message

not allowed to access field ${field} on class ${clazz.getCanonicalName()}

What it means

ReflectUtil.getField() wraps a SecurityException from Class.getDeclaredField() in an ActivitiException stating the field is not accessible on the class. This means the JVM security policy (SecurityManager or module access rules) blocked reflective access to the declared field. Note the message may print 'null' because the field variable is still null when the exception is built.

Solutions

1. Grant reflection permission (RuntimePermission accessDeclaredMembers) in the security policy or remove the SecurityManager
2. Add --add-opens for the enclosing module when on Java 9+
3. Check the field name; note the message prints the local variable which is null on this path — confirm via the cause
4. If the field actually doesn't exist, fix the name or superclass lookup

Example fix

// JVM args before
java -jar app.jar
// after
java --add-opens org.flowable.engine/org.flowable.engine.impl.util=ALL-UNNAMED -jar app.jar

// verify access before ReflectUtil.getField
try {
  clazz.getDeclaredField(fieldName);
} catch (SecurityException e) {
  throw new IllegalStateException("reflection denied for " + clazz.getName());
}

boolean fieldAccessible(Class<?> clazz, String name) {
  try { clazz.getDeclaredField(name); return true; }
  catch (Exception e) { return false; }
}

try {
  Field f = ReflectUtil.getField(fieldName, clazz);
} catch (ActivitiException e) {
  logger.warn("field access blocked: " + e.getCause());
  // fall back to getter or configuration value
}

When it happens

Trigger: Calling ReflectUtil.getField(fieldName, clazz) when getDeclaredField raises SecurityException, i.e. reflective field access is denied by the security policy or class visibility rules.

Common situations: Running the engine under a SecurityManager with restrictive policy; accessing private fields in named modules under Java 9+ without --add-opens; container/OSGi environments restricting reflection.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• not allowed to access field
• Not allowed to access method
• Not allowed to access method
• Could not get context class loader
• Could not load class

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/0b32a39c378e3c3c. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable5-engine/src/main/java/org/activiti/engine/impl/util/ReflectUtil.java:166

        }
    }

    /**
     * Returns the field of the given object or null if it doesnt exist.
     */
    public static Field getField(String fieldName, Object object) {
        return getField(fieldName, object.getClass());
    }

    /**
     * Returns the field of the given class or null if it doesnt exist.
     */
    public static Field getField(String fieldName, Class<?> clazz) {
        Field field = null;
        try {
            field = clazz.getDeclaredField(fieldName);
        } catch (SecurityException e) {
            throw new ActivitiException("not allowed to access field " + field + " on class " + clazz.getCanonicalName(), e);
        } catch (NoSuchFieldException e) {
            // for some reason getDeclaredFields doesnt search superclasses
            // (which getFields() does ... but that gives only public fields)
            Class<?> superClass = clazz.getSuperclass();
            if (superClass != null) {
                return getField(fieldName, superClass);
            }
        }
        return field;
    }

    public static void setField(Field field, Object object, Object value) {
        try {
            field.setAccessible(true);
            field.set(object, value);
        } catch (IllegalArgumentException e) {
            throw new ActivitiException("Could not set field " + field, e);
        } catch (IllegalAccessException e) {

View on GitHub (pinned to d6d39ce1c6)