pentaho/pentaho-kettle · error · IllegalStateException

Repository does not support access control

Error message

Repository does not support access control

What it means

ConnectionPermissionsController.sourceToTarget loads ACLs of the selected database connection; if the connection object does not implement IAclObject the repository does not support per-object access control, so it throws IllegalStateException('Repository does not support access control').

Solutions

1. Perform this operation against a Pentaho EE repository whose connection objects implement IAclObject
2. Check rd instanceof IAclObject before opening/enabling the permissions tab and disable ACL UI otherwise
3. Wrap sourceToTarget in try-catch for IllegalStateException and show a friendly 'repository does not support ACLs' message

Example fix

// before
connPermissionsController.sourceToTarget();
// after
if ( dbconnObject instanceof IAclObject ) {
  connPermissionsController.sourceToTarget();
} else {
  // show message: repository does not support access control
}

if (dbconnObject instanceof IAclObject) { /* ACLs supported */ }

static boolean supportsAcls(Object repositoryObject) {
  return repositoryObject instanceof IAclObject;
}

try {
  sourceToTarget();
} catch (IllegalStateException e) {
  log.warn("Repository does not support access control on this connection");
  // hide/disable ACL UI
}

When it happens

Trigger: Opening the permissions tab for a database connection stored in a repository whose objects do not implement IAclObject (no ACL support in that repository type).

Common situations: Using the EE permissions UI against a non-EE repository (database/file repository) lacking ACL support; opening a connection created in an older/newer repository with different object wrappers.

Related errors

• Repository does not support access control
• AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED
• PurRepository.ERROR_0004_DATABASE_UPDATE_ACCESS_DENIED
• AbsSecurityManager.ERROR_0005_INSUFFICIENT_PRIVELEGES
• AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/77cd59535109067c. Report an issue: GitHub.

Appendix: source

Thrown at plugins/pur/core/src/main/java/org/pentaho/di/ui/repository/pur/repositoryexplorer/controller/ConnectionPermissionsController.java:133

            UIDatabaseConnection dbconnObject = ro.get( 0 );
            try {
              if ( dbconnObject instanceof IAclObject ) {
                IAclObject aclObj = (IAclObject) dbconnObject;

                // This is a special case for DB Connections, wipe out the isEnherting flag.
                // This will cause the model to become "dirty", and prompt the user for changes the first time
                // let's make sure the default creation behavior of connections is to be that inheritance is
                // set to false, so this case never presents itself in the wild.

                aclObj.getAcls( viewAclsModel );
                if ( viewAclsModel.isEntriesInheriting() ) {
                  viewAclsModel.setEntriesInheriting( false );
                  aclObj.setAcls( viewAclsModel );
                  viewAclsModel.setModelDirty( false );
                }

              } else {
                throw new IllegalStateException( BaseMessages.getString( PKG, "PermissionsController.NoAclSupport" ) ); //$NON-NLS-1$
              }

              connNameLabel.setValue( BaseMessages.getString( PKG,
                  "AclTab.ConnectionPermission", dbconnObject.getDisplayName() ) ); //$NON-NLS-1$
              bf.setBindingType( Binding.Type.ONE_WAY );
              bf.createBinding( viewAclsModel, "acls", userRoleList, "elements" ); //$NON-NLS-1$ //$NON-NLS-2$
            } catch ( AccessDeniedException ade ) {
              messageBox.setTitle( BaseMessages.getString( PKG, "Dialog.Error" ) );//$NON-NLS-1$
              messageBox.setAcceptLabel( BaseMessages.getString( PKG, "Dialog.Ok" ) );//$NON-NLS-1$
              messageBox.setMessage( BaseMessages.getString( PKG,
                  "PermissionsController.UnableToGetAcls", dbconnObject.getName(), ade.getLocalizedMessage() ) );//$NON-NLS-1$

              messageBox.open();
            } catch ( Exception e ) {
              if ( mainController == null || !mainController.handleLostRepository( e ) ) {
                messageBox.setTitle( BaseMessages.getString( PKG, "Dialog.Error" ) );//$NON-NLS-1$
                messageBox.setAcceptLabel( BaseMessages.getString( PKG, "Dialog.Ok" ) );//$NON-NLS-1$
                messageBox.setMessage( BaseMessages.getString( PKG,

View on GitHub (pinned to f3058517a1)