pentaho/pentaho-kettle · error · KettleException

Passwords are not supported directly, try configuring your…

Error message

Passwords are not supported directly, try configuring your connection for trusted access using pg_hba.conf

What it means

createCommandLine() cannot pass a database password on the psql command line securely (it would be visible in process listings and there is no portable way to supply it), so if the 'Use password' flag is checked and the connection metadata has a non-empty password, the step deliberately throws this KettleException. The intended design is trusted (passwordless) access via pg_hba.conf or a .pgpass file.

Solutions

1. Uncheck/disable the password option for the bulk loader step so createCommandLine is called with password=false.
2. Configure trusted authentication in PostgreSQL/Greenplum pg_hba.conf for the Kettle host (e.g. host/trust or ident), then reload the config.
3. Alternatively set up a ~/.pgpass file (chmod 600) on the machine running Kettle so psql can authenticate without a command-line password.
4. Use a passwordless connection definition (empty password) for the step if the DB allows trust auth from that host.

Example fix

// before: pg_hba.conf requiring password
host  all  all  10.0.0.0/24  md5

// after: trusted access for the ETL host
host  all  all  10.0.0.0/24  trust
-- then reload: SELECT pg_reload_conf();

DatabaseMeta dm = meta.getDatabaseMeta();
boolean usePassword = true; // the step's password option
if (usePassword && dm != null
    && dm.getPassword() != null && !dm.getPassword().isEmpty()) {
  throw new IllegalStateException(
    "Configure pg_hba.conf trusted access or a .pgpass file instead of passing a password");
}

try {
  execute(meta, wait);
} catch (KettleException e) {
  if (e.getMessage().contains("Passwords are not supported directly")) {
    throw new IllegalStateException(
      "Enable trusted auth in pg_hba.conf or set up ~/.pgpass, then disable the password option", e);
  } else throw e;
}

When it happens

Trigger: execute() -> createCommandLine(meta, password=true) where dm.getPassword() is non-empty: the step's 'Use password' option is enabled AND the database connection definition contains a password. Any password present with that flag is rejected before the command runs.

Common situations: Developer copies a working JDBC connection with a stored password into the bulk loader step; someone enables the password option thinking it will be passed to psql; running in an environment where pg_hba.conf requires md5 auth so trusted access was never configured.

Related errors

• AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS
• Browser session authentication requested but no JSESSIONID…
• Error while closing output
• Error while executing psql \'
• HTTP.Exception.Authentication

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/bd158a790dbaa93d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/gp-bulk-loader/core/src/main/java/org/pentaho/di/trans/steps/gpbulkloader/GPBulkLoader.java:361

          KettleVFS.getInstance( getTransMeta().getBowl() )
            .getFileObject( environmentSubstitute( meta.getLogFile() ), getTransMeta() );

        sb.append( " -o " );
        sb.append( enclosure ).append( KettleVFS.getFilename( fileObject ) ).append( enclosure );
      } catch ( Exception ex ) {
        throw new KettleException( "Error retrieving logfile string", ex );
      }
    }

    DatabaseMeta dm = meta.getDatabaseMeta();
    if ( dm != null ) {
      String user = Const.NVL( dm.getUsername(), "" );

      // Passwords will not work for now because we can't get them to the command line without assuming UNIX and using
      // an environment variable
      String pass = Const.NVL( dm.getPassword(), "" );
      if ( password && !pass.equalsIgnoreCase( "" ) ) {
        throw new KettleException(
          "Passwords are not supported directly, try configuring "
            + "your connection for trusted access using pg_hba.conf" );
      }
      // if ( ! password )
      // {
      // pass = "******";
      // }
      // String dns = Const.NVL(dm.getDatabaseName(), "");
      // sb.append(" -U ").append(environmentSubstitute(user)).append("/").append(environmentSubstitute(pass));

      sb.append( " -U " ).append( environmentSubstitute( user ) );

      // Hostname and portname
      String hostname = Const.NVL( dm.getHostname(), "" );
      String portnum = Const.NVL( dm.getDatabasePortNumberString(), "" );
      sb.append( " -h " );
      sb.append( hostname );
      sb.append( " -p " );

View on GitHub (pinned to f3058517a1)