pentaho/pentaho-kettle · error · KettleException

AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS

AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS

Error message

AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS

What it means

AbsSecurityProvider.getAllowedActions() wraps any Exception thrown while fetching the allowed actions list for a namespace through allowedActionsActiveCache. The KettleException message is ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS and the original failure is preserved as the cause. It means the provider could not retrieve the set of actions (permissions) the current user is allowed to perform.

Solutions

Inspect e.getCause() to identify the underlying authorization failure
Verify you are connected/authenticated to the Pentaho server with a valid security session before querying allowed actions
Confirm the nameSpace value is correct for the Pentaho repository (typically the tenant namespace)
Check server availability and the pur plugin's authorization service configuration, then retry
Catch the KettleException in callers (e.g. UI security checks) and treat it as 'permissions unknown' rather than assuming allow or deny

Example fix

// before
List<String> actions = securityProvider.getAllowedActions(nameSpace);
boolean canEdit = actions.contains("org.pentaho.di.job.execute");
// after
List<String> actions;
try {
  actions = securityProvider.getAllowedActions(nameSpace);
} catch (KettleException e) {
  throw new KettleException("Unable to determine allowed actions: "
    + (e.getCause() != null ? e.getCause().getMessage() : e.getMessage()), e);
}
boolean canEdit = actions.contains("org.pentaho.di.job.execute");

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure an authenticated session and valid namespace before querying
if (nameSpace == null || nameSpace.isEmpty()) {
  throw new IllegalArgumentException("nameSpace is required for getAllowedActions");
}
// also verify the repository/security session is connected before this call

Try / catch

try {
  List<String> actions = securityProvider.getAllowedActions(nameSpace);
} catch (KettleException e) {
  Throwable root = e;
  while (root.getCause() != null) { root = root.getCause(); }
  log.logError("Allowed actions unavailable: " + root.getMessage());
  // treat as permissions unknown; do not assume allow or deny
}

Prevention

Establish and verify the Pentaho security session before querying allowed actions
Use the correct namespace for the connected tenant/repository
Never treat an exception result as 'all allowed' — default to deny when permissions are unknown
Retry once on transient errors and unwrap getCause() for diagnosis

When it happens

Trigger: Calling getAllowedActions(nameSpace) when the backing cache lookup throws — e.g. the underlying Pentaho authorization policy/role-binding lookup fails, the security context is unavailable, or the server call inside the cache loader raises any exception.

Common situations: Connecting to a repository where the authorization service rejects the action query; no valid security session (expired or missing Pentaho login); server-side errors while resolving the namespace's allowed actions; callers like allowedActions()/isAllowed() paths that depend on this list.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/be527c790db5a223. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/AbsSecurityProvider.java:59

          IAuthorizationPolicyWebService.class );
      if ( authorizationPolicyWebService == null ) {
        getLogger().error(
          BaseMessages.getString( AbsSecurityProvider.class,
            "AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC" ) );
      }

    } catch ( Exception e ) {
      getLogger().error(
        BaseMessages.getString( AbsSecurityProvider.class,
          "AbsSecurityProvider.ERROR_0001_UNABLE_TO_INITIALIZE_AUTH_POLICY_WEBSVC" ), e );
    }
  }

  public List<String> getAllowedActions( String nameSpace ) throws KettleException {
    try {
      return allowedActionsActiveCache.get( nameSpace );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,
        "AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS" ), e );
    }
  }

  public boolean isAllowed( String actionName ) throws KettleException {
    try {
      return isAllowedActiveCache.get( actionName );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( AbsSecurityProvider.class,
        "AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED" ), e );
    }
  }

  @Override
  public void validateAction( RepositoryOperation... operations ) throws KettleException {

    for ( RepositoryOperation operation : operations ) {
      switch ( operation ) {

View on GitHub (pinned to f3058517a1)