pentaho/pentaho-kettle · error · KettleSecurityException

PurRepository.ERROR_0005_INCORRECT_PERMISSION

PurRepository.ERROR_0005_INCORRECT_PERMISSION

Error message

PurRepository.ERROR_0005_INCORRECT_PERMISSION (localized, lists missing permissions in [..])

What it means

Permission check in PurRepository.getExporter: the current user lacks one or more required actions (create/execute content) to export from the Pentaho repository. The code accumulates the missing permission names into the localized ERROR_0005 message, which lists them in brackets.

Solutions

Grant the user the create-content and execute-content permissions in the BI Server
Perform the export with an account that already holds both permissions

Defensive patterns

Strategy: validation

Validate before calling

// before performing a write operation, verify effective permissions
IAclHolder holder = /* file or folder */;
RepositoryFileAcl acl = repo.getAclForObject(folder);
boolean canWrite = acl != null && repo.hasAccess(folder.getName(), RepositoryFilePermission.WRITE);
if (!canWrite) {
  throw new KettleSecurityException("User lacks WRITE permission");
}

Type guard

boolean hasWriteAccess(PurRepository repo, String path) throws KettleException {
  try {
    return repo.hasAccess(path, RepositoryFilePermission.WRITE);
  } catch (Exception e) { return false; }
}

Try / catch

try {
  repo.save(element, comment);
} catch (KettleSecurityException e) {
  if (e.getMessage() != null && e.getMessage().contains("ERROR_0005")) {
    // request access or retry as admin user
  } else { throw e; }
}

Prevention

Check permissions with repository.hasAccess() before write/delete operations
Grant required roles in Pentaho Administration before automation runs
Verify object and parent-folder ACLs after ownership changes
Re-check permissions after server upgrades or tenant switches

When it happens

Trigger: Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/PurRepository.java:3360 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/554f349b24a934e7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/repository/pur/PurRepository.java:3360

  public IRepositoryExporter getExporter() throws KettleException {
    final List<String> exportPerms =
      Arrays.asList( IAbsSecurityProvider.CREATE_CONTENT_ACTION, IAbsSecurityProvider.EXECUTE_CONTENT_ACTION );
    IAbsSecurityProvider securityProvider = purRepositoryServiceRegistry.getService( IAbsSecurityProvider.class );
    StringBuilder errorMessage = new StringBuilder( "[" );
    for ( String perm : exportPerms ) {
      if ( securityProvider == null && PurRepositoryConnector.inProcess() ) {
        return new PurRepositoryExporter( this );
      }
      if ( securityProvider != null && securityProvider.isAllowed( perm ) ) {
        return new PurRepositoryExporter( this );
      }
      errorMessage.append( perm );
      errorMessage.append( ", " );
    }
    errorMessage.setLength( errorMessage.length() - 2 );
    errorMessage.append( "]" );

    throw new KettleSecurityException( BaseMessages.getString( PKG, "PurRepository.ERROR_0005_INCORRECT_PERMISSION",
      errorMessage.toString() ) );
  }

  @Override
  public IRepositoryImporter getImporter() {
    return new PurRepositoryImporter( this );
  }

  @Override
  public IUnifiedRepository getUnderlyingRepository() {
    return pur;
  }

  @Override
  public IMetaStore getRepositoryMetaStore() {
    return metaStore;
  }

View on GitHub (pinned to f3058517a1)