From 2af220934cb2f52d0df09ca8e830b1fecedaf151 Mon Sep 17 00:00:00 2001 From: sdachepally Date: Mon, 17 Aug 2026 23:45:45 +0530 Subject: [PATCH 1/2] fix(auth): allow anonymous callers to GetJWKS and GetOpenIDConfiguration Signed-off-by: sdachepally --- crates/api-core/src/auth/internal_rbac_rules.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crates/api-core/src/auth/internal_rbac_rules.rs b/crates/api-core/src/auth/internal_rbac_rules.rs index b82de3c15d..964214e8d3 100644 --- a/crates/api-core/src/auth/internal_rbac_rules.rs +++ b/crates/api-core/src/auth/internal_rbac_rules.rs @@ -943,8 +943,8 @@ impl InternalRBACRules { pub(super) fn allowed(&self, msg: &str, user_principals: &[crate::auth::Principal]) -> bool { if let Some(perm_info) = self.perms.get(msg) { if user_principals.is_empty() { - // No proper cert presented, but we will allow stuff that allows just Anonymous - return perm_info.principals.as_slice() == [Principal::Anonymous]; + // No proper cert presented, but we allow any rule that lists Anonymous. + return perm_info.principals.contains(&Principal::Anonymous); } user_principals.iter().any(|user_principal| { perm_info From 07405bdd3df4be65a731c539516c2b8699c6306e Mon Sep 17 00:00:00 2001 From: sdachepally Date: Tue, 18 Aug 2026 15:18:57 +0530 Subject: [PATCH 2/2] add regression test for anonymous access to GetJWKS and GetOpenIDConfiguration. Signed-off-by: sdachepally --- crates/api-core/src/auth/internal_rbac_rules.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/crates/api-core/src/auth/internal_rbac_rules.rs b/crates/api-core/src/auth/internal_rbac_rules.rs index 964214e8d3..02f5f4df16 100644 --- a/crates/api-core/src/auth/internal_rbac_rules.rs +++ b/crates/api-core/src/auth/internal_rbac_rules.rs @@ -1101,6 +1101,17 @@ mod rbac_rule_tests { )); } + #[test] + fn anonymous_rules_allow_certless_callers() { + // Certless callers must be allowed when a rule lists Anonymous among other principals. + for method in ["GetJWKS", "GetOpenIDConfiguration"] { + assert!( + InternalRBACRules::allowed_from_static(method, &[]), + "{method}" + ); + } + } + #[test] fn rbac_rule_tests() -> Result<(), eyre::Report> { assert!(InternalRBACRules::allowed_from_static(