pentaho/pentaho-kettle · error · KettleException

AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED

AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED

Error message

AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED

What it means

AbsSecurityProvider.isAllowed consults an active cache of permission checks (isAllowedActiveCache) that ultimately delegates to the Pentaho repository security backend. If any exception occurs while resolving the cached action result, it is wrapped in a KettleException with message 'AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED'. This indicates the permission lookup itself failed — not that a permission was denied, but that the answer could not be obtained (backend communication or internal failure).

Solutions

  1. Verify the Pentaho BA/Repository server is up and reachable from the client and that the connection URL in the repository definition is correct.
  2. Re-login / refresh the repository session — an expired or invalid session often breaks the underlying permission lookup.
  3. Catch KettleException and inspect the cause (e.getCause()) to find the actual backend failure.
  4. Check pur plugin and Pentaho server version compatibility; upgrade the plugin if a known permission-cache bug was fixed.
  5. Enable Pentaho/kettle debug logging (KETTLE_LOG_LEVEL=DEBUG) to trace the underlying security service call.

Example fix

// before
boolean ok = securityProvider.isAllowed("read"); // throws KettleException on backend failure
// after
boolean ok;
try {
  ok = securityProvider.isAllowed("read");
} catch (KettleException e) {
  log.error("Could not determine permission, cause: " + (e.getCause() != null ? e.getCause().getMessage() : e.getMessage()));
  throw e;
}
Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check connectivity/session before permission-sensitive calls
if (repository == null || !repository.isConnected()) throw new IllegalStateException("Repository not connected");

Try / catch

try {
  securityProvider.isAllowed(actionName);
} catch (KettleException e) {
  Throwable cause = e.getCause();
  log.error("Permission lookup failed for " + actionName, cause);
  // treat as 'unknown', fail closed or retry against a healthy server
}

Prevention

When it happens

Trigger: Calling repository security operations (validateAction -> checkOperationAllowed -> isAllowed) when the underlying cache loader throws: e.g. the Pentaho BI server is unreachable, the user session/ticket has expired, or the IPermissionTarget/action name lookup throws inside the cache supplier.

Common situations: Connecting kettle/pdi to a Pentaho repository (pur plugin) while the BA server is down or restarted mid-session; expired Pentaho web session; misconfigured repository connection URL; network interruption during repository metadata or security calls.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/b6034331b699998d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java:68

        BaseMessages.getString( AbsSecurityProvider.class,
          "AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC" ), e );
    }
  }

  public List<String> getAllowedActions( String nameSpace ) throws KettleException {
    try {
      return allowedActionsActiveCache.get( nameSpace );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,
        "AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS" ), e );
    }
  }

  public boolean isAllowed( String actionName ) throws KettleException {
    try {
      return isAllowedActiveCache.get( actionName );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,
        "AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED" ), e );
    }
  }

  @Override
  public void validateAction( RepositoryOperation... operations ) throws KettleException {

    for ( RepositoryOperation operation : operations ) {
      switch ( operation ) {
        case EXECUTE_TRANSFORMATION:
        case EXECUTE_JOB:
          checkOperationAllowed( EXECUTE_CONTENT_ACTION );
          break;

        case MODIFY_TRANSFORMATION:
        case MODIFY_JOB:
          checkOperationAllowed( CREATE_CONTENT_ACTION );
          break;

View on GitHub (pinned to f3058517a1)