jeecgboot/JeecgBoot · error · RuntimeException

system_permission_limit

system_permission_limit

Error message

system_permission_limit[username=${userName}]

What it means

Thrown as a RuntimeException from JobGroupPermissionUtil.validJobGroupPermission when the SSO login check succeeds but the authenticated user does not have permission for the requested jobGroup. The error message uses the i18n key 'system_permission_limit' (typically resolving to a localized 'insufficient permissions' string) appended with the username. This is an authorization enforcement point — the user is authenticated but lacks the specific job-group-level access.

Source

Thrown at jeecg-boot/jeecg-server-cloud/jeecg-visual/jeecg-cloud-xxljob/src/main/java/com/xxl/job/admin/framework/util/JobGroupPermissionUtil.java:40

     * check if has jobgroup permission
     */
    public static boolean hasJobGroupPermission(LoginInfo loginInfo, int jobGroup){
        if (XxlSsoHelper.hasRole(loginInfo, Consts.ADMIN_ROLE).isSuccess()) {
            return true;
        } else {
            List<String> jobGroups = (loginInfo.getExtraInfo()!=null && loginInfo.getExtraInfo().containsKey("jobGroups"))
                    ? StringTool.split(loginInfo.getExtraInfo().get("jobGroups"), ",") :new ArrayList<>();
            return jobGroups.contains(String.valueOf(jobGroup));
        }
    }

    /**
     * valid jobGroup permission
     */
    public static LoginInfo validJobGroupPermission(HttpServletRequest request, int jobGroup) {
        Response<LoginInfo> loginInfoResponse = XxlSsoHelper.loginCheckWithAttr(request);
        if (!(loginInfoResponse.isSuccess() && hasJobGroupPermission(loginInfoResponse.getData(), jobGroup))) {
            throw new RuntimeException(I18nUtil.getString("system_permission_limit") + "[username="+ loginInfoResponse.getData().getUserName() +"]");
        }
        return loginInfoResponse.getData();
    }

    /**
     * filter jobGroupList by permission
     */
    public static List<XxlJobGroup> filterJobGroupByPermission(HttpServletRequest request, List<XxlJobGroup> jobGroupListTotal){
        Response<LoginInfo>  loginInfoResponse = XxlSsoHelper.loginCheckWithAttr(request);

        if (XxlSsoHelper.hasRole(loginInfoResponse.getData(), Consts.ADMIN_ROLE).isSuccess()) {
            return jobGroupListTotal;
        } else {
            List<String> jobGroups = (loginInfoResponse.getData().getExtraInfo()!=null
                    && loginInfoResponse.getData().getExtraInfo().get("jobGroups")!=null
            )
                    ? StringTool.split(loginInfoResponse.getData().getExtraInfo().get("jobGroups"), ",")
                    :new ArrayList<>();

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Assign the missing jobGroup ID to the user's 'jobGroups' attribute in the SSO/identity system and have them re-authenticate.
2. Verify the SSO login info correctly populates the 'jobGroups' extra info attribute — check attribute mapping configuration.
3. If the user should be an admin with full access, grant them the ADMIN_ROLE so hasJobGroupPermission returns true unconditionally.
4. Confirm the jobGroup ID in the request matches the IDs configured in the permission system.

Example fix

// before — user has jobGroups="1,2" but requests jobGroup=3
validJobGroupPermission(request, 3);  // throws
// after — admin grants jobGroup 3 to user in SSO, or:
// grant ADMIN_ROLE to user so filterJobGroupByPermission returns all groups

// Check permission before calling the protected API
Response<LoginInfo> resp = XxlSsoHelper.loginCheckWithAttr(request);
if (resp.isSuccess() && JobGroupPermissionUtil.hasJobGroupPermission(resp.getData(), jobGroup)) {
    // proceed with the operation
} else {
    return Response.fail("Insufficient permission for job group: " + jobGroup);
}

boolean canAccessJobGroup(HttpServletRequest request, int jobGroup) {
    Response<LoginInfo> resp = XxlSsoHelper.loginCheckWithAttr(request);
    return resp.isSuccess() && JobGroupPermissionUtil.hasJobGroupPermission(resp.getData(), jobGroup);
}

try {
    LoginInfo info = JobGroupPermissionUtil.validJobGroupPermission(request, jobGroup);
    // proceed
} catch (RuntimeException e) {
    if (e.getMessage().contains("system_permission_limit")) {
        // return 403 with user-friendly message
        return Response.fail(403, "You do not have access to this job group");
    }
    throw e;
}

When it happens

Trigger: An authenticated user attempts to access or operate on an XXL-Job scheduler job group (jobGroup ID) that is not in their allowed list. The permission list comes from loginInfo.getExtraInfo().get("jobGroups") — a comma-separated list of allowed job group IDs attached to the SSO session. If the requested jobGroup ID is not in that list, the exception fires.

Common situations: New user not assigned to the correct job group in SSO/identity management; job group ID changed but user permissions were not updated; admin created a new job group but did not assign it to operators; cross-tenant access attempt; misconfigured SSO extra info attribute name ('jobGroups').

Related errors

• 删除AI知识库文档失败，不能删除其他租户的AI知识库文档！
• 您不是当前组织的创建者，无法删除用户！
• Illegal month number: ${monthNum}
• 请注意，将要排序的列字段不存在：${column}
• 未获取到用户

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/d6d055f92229bf66. Report an issue: GitHub.