Unexpected response code: 403 (ACL not found) - when wrong management token is used
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Overview of the Issue
Wrong status code and msg for invalid/wrong mgmt token usage with the consul CLI
I think a simple `401` would be more indicative
#### Reproduction Steps
1. Run consul 1.11.4 with simple ACL config (used MacOS for local dev):
```
acl {
enabled = true
default_policy = "deny"
enable_token_persistence = true
}
```
2. `/usr/local/Cellar/consul/1.11.4/bin/consul agent -config-file consul.hcl`
3. `export CONSUL_HTTP_TOKEN=randomToken`
4. try use any consul command:
```
/usr/local/Cellar/consul/1.11.4/bin/consul acl policy list
Failed to retrieve the policy list: Unexpected response code: 403 (ACL not found)
/usr/local/Cellar/consul/1.11.4/bin/consul members
Error retrieving members: Unexpected response code: 403 (ACL not found)
```
to fix: just `export CONSUL_HTTP_TOKEN=correctToken`
### Consul info for both Client and Server
```
/usr/local/Cellar/consul/1.11.4/bin/consul info
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision =
version = 1.11.4
consul:
acl = enabled
bootstrap = true
known_datacenters = 1
leader = true
leader_addr = ----
server = true
raft:
applied_index = 1611
commit_index = 1611
fsm_pending = 0
last_contact = 0
last_log_index = 1611
last_log_term = 2
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{Suffrage:Voter ID:4e8d1e2e-5ac1-1d5c-d7e5-4acd0f04181b Address:-------}]
latest_configuration_index = 0
num_peers = 0
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Leader
term = 2
runtime:
arch = amd64
cpu_count = 8
goroutines = 169
max_procs = 8
os = darwin
version = go1.17.6
serf_lan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 4
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 167
members = 8
query_queue = 0
query_time = 4
serf_wan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1
members = 1
query_queue = 0
query_time = 1
```
### Operating system and Environment details
MacOS 12.5.1 Intel
### Log Fragments
```
2022-09-19T13:44:34.191+0300 [ERROR] agent.http: Request error: method=GET url=/v1/acl/policies from=127.0.0.1:63170 error="ACL not found"
2022-09-19T13:48:43.237+0300 [ERROR] agent.http: Request error: method=GET url=/v1/agent/members?segment=_all from=127.0.0.1:64979 error="ACL not found"
```
Contributor guide
Research direction
Reproduce the issue with Consul 1.11.4 using the shown ACL configuration and an invalid CONSUL_HTTP_TOKEN. Start by tracing the responses for /v1/acl/policies and /v1/agent/members and how the CLI reports them. Done means an invalid management token produces the expected 401 status and an indicative message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100