No matching resource sets (no_matching_resourcesets)
A denied decision with the code no_matching_resourcesets means the user matched at least one user set, but the resource's attributes don't meet the conditions of any resource set. This page is for developers who find this code in a decision log and need to fix the resource's attributes, the check, or the resource set.
What the no_matching_resourcesets reason means
The policy decision point (PDP) writes this code in the attribute-based access control (ABAC) part of the decision log's debug details (debug.abac). The debug details appear when Debug Mode is on.
| Field | Value |
|---|---|
code | no_matching_resourcesets |
reason | the given resource did not match any resourceset conditions. known resourcesets: <resource-set-keys> |
matching_usersets | The user sets the user matched |
support_link | A link to /errors/no_matching_resourcesets on docs.permit.io |
A resource set (also called a dynamic resource) is a group of resources of one resource type whose attributes meet a set of conditions. The PDP checks resource sets after user sets. This code means the user set check passed, and no resource set matched the resource.
The decision log also has a request.resource object with the resource type and the resource attributes the PDP evaluated. Compare those attributes with the conditions of the resource sets listed in known resourcesets.
Causes of no_matching_resourcesets
| Cause | How to confirm | Fix |
|---|---|---|
| The check doesn't send the resource attributes that the resource set conditions test. | request.resource.attributes in the decision log is missing the attribute. | Send the resource attributes in the check. |
The attribute value has a different type or case than the condition, for example the string "18" instead of the number 18. | The value in request.resource.attributes differs in type or case from the condition value. | Send the value with the type and case the condition uses. |
| The resource set belongs to a different resource type than the resource in the check. | request.resource.type differs from the resource type of the resource set. | Check the resource type in permit.check(), or create a resource set for this resource type. |
| No resource set has conditions that this resource should meet. | known resourcesets doesn't list a resource set for this resource. | Create or edit a resource set. |
Fix no_matching_resourcesets
Send the resource attributes in the check
Pass the attributes in the resource object of permit.check(). For examples in each SDK, see Check an ABAC permission with attributes. To define which resource attributes exist, see Defining attributes.
Create or edit a resource set that matches the resource
- In the dashboard: open the Policy screen, select the ABAC Rules tab, and create or edit a resource set. For the steps, see Define a dynamic resource (resource set).
- With the API: call Create condition set with
"type": "resourceset". For a complete request, see Create condition sets with the API.
A new resource set grants nothing until a rule connects it to a user set. After you create the resource set, grant the action to a user set from matching_usersets in the Policy Editor.
Confirm the fix
- Run the same
permit.check()call again with the same user, action, resource, and attributes. To run the check from a terminal, usepermit pdp checkwith--resource-attributes. - Open the Audit Log and select the new decision.
The debug.abac.code is no longer no_matching_resourcesets. If the code is no_matching_rules, the resource matched a resource set, and no rule grants the action. See No ABAC rule grants the permission (no_matching_rules).