pentaho/pentaho-kettle · error · RepositoryClientException

Auth error

Error message

Auth error

What it means

throwOnError() centralizes response checking and throws RepositoryClientException("Auth error") when the HTTP status is 302 (moved temporarily), 403 (forbidden), or 401 (unauthorized). In this service those statuses indicate the caller was redirected to a login page or denied, i.e. the session is not authenticated.

Solutions

1. Re-authenticate (perform login to obtain a fresh session cookie) and retry the operation
2. Verify username/password/tenant configuration used to build the authentication
3. Ensure CookieHandler/CookieManager is enabled so session cookies persist across requests (the constructor sets a default CookieManager)
4. Check that the server is not redirecting (302) to SSO/login - configure the client for the deployed security model

Example fix

// before
RepositoryClient client = new RepositoryClient( cfg, url, auth ); // never logged in
client.writeData( path, data ); // Auth error
// after
RepositoryClient client = new RepositoryClient( cfg, url, auth );
client.login(); // establish session cookie
client.writeData( path, data );

// Ensure a session exists before API calls
if ( !client.isLoggedIn() ) { client.login(); }

try {
  client.writeData( path, data );
} catch ( RepositoryClientException e ) {
  if ( "Auth error".equals( e.getMessage() ) ) {
    client.login();          // refresh session cookie
    client.writeData( path, data ); // retry once
  }
}

When it happens

Trigger: Calling writeData, moveTo, rename, or getFileInfo when the session cookie is missing/expired, credentials are wrong, or the server redirects unauthenticated requests to the login page.

Common situations: Long-running jobs whose session expired mid-run; not calling login before API operations; incorrect username/password; server security changes (e.g. requiring new auth headers); proxy stripping cookies.

Related errors

• Carte.Error.NoServerFound
• Carte.Error.NoShutdown
• Client error creating folder
• CmsTokenProvider: Keycloak token request failed — HTTP
• Failed to fetch driver metadata for

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/929a063a8a3a09f2. Report an issue: GitHub.

Appendix: source

Thrown at plugins/repo-vfs/repo-vfs-ws/src/main/java/org/pentaho/di/plugins/repovfs/ws/repo/RepositoryClient.java:281

      default:
        throwOnError( response );
        // unreachable
        return Optional.empty();
    }
  }

  private static String encodePath( String[] path ) {
    return ":" + Stream.of( path ).map( Encode::forUriComponent ).collect( Collectors.joining( ":" ) );
  }

  private void throwOnError( final Response response ) throws RepositoryClientException {
    final int status = response.getStatus();

    if ( status != HttpStatus.SC_OK ) {
      if ( status == HttpStatus.SC_MOVED_TEMPORARILY
        || status == HttpStatus.SC_FORBIDDEN
        || status == HttpStatus.SC_UNAUTHORIZED ) {
        throw new RepositoryClientException( "Auth error" );
      } else {
        String errMsg;
        try {
          errMsg = response.readEntity( String.class );
        } catch ( Exception e ) {
          errMsg = "Unable to get error response entity";
        }
        throw new RepositoryClientException( errMsg + " status:" + status );
      }
    }
  }

  private static String encodePath( String path ) {
    String repoEncoded = RepositoryPathEncoder.encodeRepositoryPath( path );
    return Encode.forUriComponent( repoEncoded );
  }
}

View on GitHub (pinned to f3058517a1)