pentaho/pentaho-kettle · error · JSchException

Could not get the groups of the current user (error code: )

Error message

Could not get the groups  of the current user (error code: )

What it means

Thrown by SftpFileSystemWindows.getUserGroups() when the remote Windows 'whoami /groups' command (WHO_AMI_GROUPS_FO_LIST) exits with a non-zero code, so the current user's group list cannot be collected for SFTP VFS authorization logic. The thrown JSchException embeds the exit code (the placeholder '(' in the stored message is filled at runtime).

Solutions

  1. SSH into the host manually and run 'whoami /groups' to see the actual failure and exit code
  2. Ensure the SSH server spawns a cmd/Windows-class shell (this class uses WinClass command execution) and the account can run whoami
  3. Check server-side security policy/AV is not blocking whoami.exe for that account
  4. Reconnect with a different account that can enumerate its group memberships
  5. Catch the JSchException and degrade gracefully if group info is optional

Example fix

// before
List<String> groups = fs.getUserGroups();
// after
List<String> groups;
try {
  groups = fs.getUserGroups();
} catch ( JSchException e ) {
  log.logError( "Unable to fetch remote user groups: " + e.getMessage(), e );
  groups = Collections.emptyList();
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Prefer verifying connectivity first
// ssh user@host "whoami /groups" && echo OK
// If it fails remotely, getUserGroups() will throw.

Try / catch

try {
  List<String> groups = fs.getUserGroups();
} catch ( JSchException e ) {
  // parse error code from e.getMessage()
  log.logError( "Remote 'whoami /groups' failed: " + e.getMessage(), e );
} catch ( IOException e ) {
  log.logError( "IO failure reading group output: " + e.getMessage(), e );
}

Prevention

When it happens

Trigger: Calling getUserGroups() (directly or via userGroups) over a Windows SFTP connection when the remote 'whoami /groups' command fails to execute or returns a non-zero exit code.

Common situations: Remote shell restricted or not cmd.exe; whoami blocked by policy or antivirus; user lacks rights to enumerate groups; custom SSH server on Windows not supporting the Win-class command execution path.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/f59c1643fe74989f. Report an issue: GitHub.

Appendix: source

Thrown at core/src/main/java/org/pentaho/di/core/vfs/SftpFileSystemWindows.java:106

  @Override
  public boolean isReleaseable() {
    return !isOpen() && ( null == openStreamCount || openStreamCount.get() == 0 );
  }

  /**
   * get user group on remote windows host
   *
   * @return list of groups + user person
   * @throws JSchException
   * @throws IOException
   */
  List<String> getUserGroups() throws JSchException, IOException {
    if ( userGroups == null ) {
      StringBuilder output = new StringBuilder();
      int code = this.executeCommandWinClass( WHO_AMI_GROUPS_FO_LIST, output );
      if ( code != 0 ) {
        throw new JSchException( "Could not get the groups  of the current user (error code: " + code + ")" );
      }

      this.userGroups = getUserGroups( output.toString() );
      userGroups.add( getUser() );
    }
    return this.userGroups;
  }

  /**
   * cut user groups from output whoami
   *
   * @param commandOutput output from whoami
   * @return list of user groups
   */
  private List<String> getUserGroups( String commandOutput ) {
    List<String> result = new ArrayList<>();
    int startIndex = 0;
    int endIndex;

View on GitHub (pinned to f3058517a1)