In #53453 we moved the resolution of the anonymous role from authorization time to authentication time.
As a consequence, it is likely that stored Authentication headers (as used in Watcher, ML and CCR) may see a change in behaviour.
Assume a cluster with the anonymous role set to superuser .
In 7.7, if user with no other roles authenticated and created a new Watch, we would serialize an Authentication object with no roles. When the watch ran we would deserialize that object, but we would run the with superuser privileges because the AuthorizationService would add the role in automatically.
If that same Authentication object is deserialized on 7.8, it will have no roles, and will not be granted the superuser role because the anonymous role logic no longer exists in the AuthorizationService.
We intend to revert #53453 and come up with a new solution to the original problem regarding reporting of anonymous roles.
In #53453 we moved the resolution of the anonymous role from authorization time to authentication time.
As a consequence, it is likely that stored
Authenticationheaders (as used in Watcher, ML and CCR) may see a change in behaviour.Assume a cluster with the anonymous role set to
superuser.In 7.7, if user with no other roles authenticated and created a new Watch, we would serialize an
Authenticationobject with no roles. When the watch ran we would deserialize that object, but we would run the withsuperuserprivileges because theAuthorizationServicewould add the role in automatically.If that same
Authenticationobject is deserialized on 7.8, it will have no roles, and will not be granted thesuperuserrole because the anonymous role logic no longer exists in theAuthorizationService.We intend to revert #53453 and come up with a new solution to the original problem regarding reporting of anonymous roles.