diff --git a/.changelog/15495.txt b/.changelog/15495.txt new file mode 100644 index 000000000..77b38170c --- /dev/null +++ b/.changelog/15495.txt @@ -0,0 +1,3 @@ +```release-note:bug +event stream: Fixed a bug where undefined ACL policies on the request's ACL would result in incorrect authentication errors +``` diff --git a/nomad/stream/event_broker.go b/nomad/stream/event_broker.go index 032a22020..55db9d3db 100644 --- a/nomad/stream/event_broker.go +++ b/nomad/stream/event_broker.go @@ -295,9 +295,14 @@ func aclObjFromSnapshotForTokenSecretID( for _, policyName := range aclToken.Policies { policy, err := aclSnapshot.ACLPolicyByName(nil, policyName) - if err != nil || policy == nil { + if err != nil { return nil, nil, errors.New("error finding acl policy") } + if policy == nil { + // Ignore policies that don't exist, since they don't grant any + // more privilege. + continue + } aclPolicies = append(aclPolicies, policy) } @@ -315,9 +320,14 @@ func aclObjFromSnapshotForTokenSecretID( for _, policyLink := range role.Policies { policy, err := aclSnapshot.ACLPolicyByName(nil, policyLink.Name) - if err != nil || policy == nil { + if err != nil { return nil, nil, errors.New("error finding acl policy") } + if policy == nil { + // Ignore policies that don't exist, since they don't grant any + // more privilege. + continue + } aclPolicies = append(aclPolicies, policy) } }