pentaho/pentaho-kettle · error · IllegalStateException

Repository does not support access control

Error message

Repository does not support access control

What it means

PermissionsController.sourceToTarget loads ACLs of the selected repository object (file/folder/content) when binding the UI. If the object does not implement IAclObject — meaning the repository does not support access control on it — IllegalStateException('Repository does not support access control') is thrown.

Solutions

1. Use a Pentaho EE repository whose repository objects implement IAclObject
2. Check repoObject instanceof IAclObject before showing/initializing the permissions tab
3. Catch IllegalStateException in sourceToTarget and hide/disable the ACL controls for unsupported objects

Example fix

// before
permissionsController.sourceToTarget();
// after
if ( repoObject instanceof IAclObject ) {
  permissionsController.sourceToTarget();
} else {
  // disable ACL tab for this object
}

if (repoObject instanceof IAclObject) { /* safe to load ACLs */ }

static boolean supportsAcls(Object repoObject) {
  return repoObject instanceof IAclObject;
}

try {
  sourceToTarget();
} catch (IllegalStateException e) {
  log.warn("Selected object does not support ACLs; disabling permissions UI");
}

When it happens

Trigger: Selecting a repository object in the explorer whose wrapper class does not implement IAclObject, causing the permissions tab binding to fail while calling getAcls(viewAclsModel).

Common situations: Non-EE repository objects (no ACL support) shown in the explorer with the permissions tab enabled; object types like jobs/transfections stored where ACLs are unsupported; repository object wrappers not upgraded to IAclObject.

Related errors

• Repository does not support access control
• AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED
• PurRepository.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED
• AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES
• AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/7d5cd642723d68a3. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/ui/repository/pur/repositoryexplorer/controller/PermissionsController.java:132

              readCheckbox.setDisabled( true );
              viewAclsModel.setHasManageAclAccess( false );
            } else {
              applyAclButton.setDisabled( false );
              inheritParentPermissionCheckbox.setDisabled( false );
              viewAclsModel.setHasManageAclAccess( true );
            }

            viewAclsModel.setRemoveEnabled( false );
            List<UIRepositoryObjectAcl> selectedAclList = Collections.emptyList();
            // we've moved to a new file/folder; need to clear out what the model thinks is selected
            viewAclsModel.setSelectedAclList( selectedAclList );
            permissionsCheckboxHandler.updateCheckboxes( EnumSet.noneOf( RepositoryFilePermission.class ) );
            UIRepositoryObject repoObject = ro.get( 0 );
            try {
              if ( repoObject instanceof IAclObject ) {
                ( (IAclObject) repoObject ).getAcls( viewAclsModel );
              } else {
                throw new IllegalStateException( BaseMessages.getString( PKG, "PermissionsController.NoAclSupport" ) ); //$NON-NLS-1$
              }

              fileFolderLabel
                  .setValue( BaseMessages.getString( PKG, "AclTab.UserRolePermission", repoObject.getName() ) ); //$NON-NLS-1$
              bf.setBindingType( Binding.Type.ONE_WAY );
              bf.createBinding( viewAclsModel, "acls", userRoleList, "elements" ); //$NON-NLS-1$ //$NON-NLS-2$
              updateInheritFromParentPermission();
            } catch ( AccessDeniedException ade ) {
              if ( mainController == null || !mainController.handleLostRepository( ade ) ) {
                messageBox.setTitle( BaseMessages.getString( PKG, "Dialog.Error" ) );//$NON-NLS-1$
                messageBox.setAcceptLabel( BaseMessages.getString( PKG, "Dialog.Ok" ) );//$NON-NLS-1$
                messageBox.setMessage( BaseMessages.getString( PKG,
                    "PermissionsController.UnableToGetAcls", repoObject.getName(), ade.getLocalizedMessage() ) );//$NON-NLS-1$

                messageBox.open();
              }
            } catch ( Exception e ) {
              if ( mainController == null || !mainController.handleLostRepository( e ) ) {

View on GitHub (pinned to f3058517a1)